JP2011109587A - Device, method, and system for monitoring bgp traffic variation - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology to detect a traffic variation caused by a BGP path variation factor. <P>SOLUTION: A BGP path receiving part 101 collects BGP Update messages and manages BGP path information, and accumulates the BGP log information of the BGP Update messages classified in unites of attributes of a BGP. A traffic information receiving part 102 collects traffic information, totalizes traffic in units of attributes of the BGP based on the BGP path information, and accumulates the totalized traffic totalization data. A correlation collation function part 103 detects the traffic variation from the similarity of the traffic totalization data neighboring in terms of time, compares the attribute value of the BGP that contributes to the traffic variation with the BGP log information at time intervals, and evaluates whether or not the BGP path variation related to the attribute value of the BGP has been generated. By this, it is possible to detect the traffic variation caused by the BGP path variation factor. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a monitoring technique for detecting traffic fluctuation due to a path fluctuation factor of a path notified by the BGP protocol.

  The Internet is an organic connection of 10,000 or more autonomous systems (ASs) operated by different organizations such as Internet Service Providers (ISPs) and companies and universities. The ASs described above are connected by a dedicated line or Internet Exchange (IX), and BGP route information is exchanged by a Border Gateway Protocol (BGP). The information to be exchanged includes a BGP Next address attribute, an AS path attribute, and a Community attribute that are routed to the route information.

  The adjacent AS number of the AS passing through the traffic is a number indicating the leading number of the AS path attribute, and represents the AS directly adjacent to the ISP receiving the BGP protocol. The number indicating the end number of the AS path attribute represents the Origin AS number, and indicates the AS of the final destination of the route. The AS number string described in the adjacent AS number and the Origin AS number indicates the AS that is being routed. The BGP Next address attribute indicates the IP address of the next BGP router as viewed from the router receiving the BGP protocol. “Community” is an identifier that can be arbitrarily set for these routes so that a network operator or the like can easily identify the route information. As shown in Non-Patent Document 1, this is generally said to be given to a regional information unit or a customer type unit.

  In this way, BGP is a protocol for exchanging route information between different ASs, and is a protocol for exchanging route information of the entire Internet between main backbone routers in the same AS.

  As described above, the destination of the Internet traffic is based on route information exchanged by BGP, and the change of the route information is not only the change of the traffic between routers in the same AS but also the inflow / outflow to the adjacent AS. It has a great impact on traffic. A route change may occur due to a failure of a router or the like, or a failure of a cable connecting devices, but it affects traffic on the backbone network, so it is desired to monitor it. .

  However, the amount of path variation (that is, the number of BGP Update messages) reaches several thousand even in one minute, and it is not easy to simply monitor. A system that collects the number of paths in units of adjacent AS (Peer AS) or Nexthop and monitors the fluctuation amount is also conceivable. However, the fluctuation amount of the path number and the fluctuation amount of the actual traffic amount are not related, and There is a case where the traffic is not affected even when the value of the value changes greatly.

  In addition, it is possible to search for causes on the Internet by selecting and grouping BGP reception information and extracting common parts, but this is also not related to actual traffic, so traffic actually flows. I have a problem of detecting a problem in a missing part.

  On the other hand, Non-Patent Document 2 develops a system for analyzing the received route, classifying it into a type that causes traffic fluctuation, and predicting the degree of influence by matching it with actual traffic. . However, in this method, only the traffic fluctuation amount is predicted, monitoring is performed in real time, and the cause is searched by associating related route information with the actual traffic fluctuation amount. I can't say that.

JP 2008-167484 A

RFC4384 BGP Communities for Data Collection Jian Wu, Z. Morley Mao, Jennifer Rexford, and Jia Wang, Finding a needle in a haystack: Pinpointing significant BGP routing changes in an IP network, Proc.Networked Systems Design and Implementation, May 2005. J. Scudder, et. Al, “BGP Monitoring Protocol,” Internet-Draft <draft-ietf-grow-bmp-02>, July, 2009.

  Although the amount of traffic flowing on the Internet is increasing, packet routing between ISPs is determined by route information notified by the BGP protocol. The traffic fluctuation may be caused by a failure such as attack traffic or a router, but may also be caused by a factor due to BGP path fluctuation. If sudden traffic fluctuations occur, it is possible that the routers and lines will be tightened and the service will be hindered. There is a demand for rapidly detecting such traffic fluctuations and searching for BGP path fluctuations that cause the traffic fluctuations.

  There are many BGP route monitoring systems and traffic fluctuation monitoring systems, but there is still no system that detects the cause of traffic fluctuations due to path fluctuations by monitoring the data of both. In particular, in a route, it is necessary to analyze thousands of route information in one minute, and it is necessary to match a huge amount of traffic.

  An object of the present invention is to provide a technique for detecting traffic fluctuation due to a BGP path fluctuation factor.

  Of the inventions disclosed in this specification, the outline of typical ones will be briefly described as follows.

  The first invention collects the BGP Update message, manages the BGP route information, collects the BGP route receiver that stores the BGP log information in which the BGP Update message is classified into BGP attribute units, and the traffic information. Based on the BGP route information, the traffic is aggregated in units of BGP attributes, and traffic fluctuation is detected from the similarity of the traffic information receiving unit that accumulates the aggregated traffic aggregated data and the traffic aggregated data that changes in time. A correlation matching function unit that compares the attribute value of BGP that contributed to traffic fluctuation and the BGP log information of the time interval and evaluates whether or not BGP path fluctuation related to the attribute value of the BGP has occurred; It is characterized by providing.

  According to a second invention, in the first invention, the BGP route receiving unit compares the newly received BGP Update message with the BGP Update message that has already been received, and updates the Update message for each BGP attribute unit that affects traffic fluctuations. A BGP Update classification function unit is provided.

  In a third aspect based on the first aspect, the BGP route receiving unit includes a routing management function unit that manages BGP route information as a routing table, and the traffic information receiving unit is based on the collected traffic information. A traffic totaling function unit that searches the routing table and totals traffic in BGP attribute units that affect traffic fluctuations is provided.

  In a fourth aspect based on the third aspect, when the traffic totaling function unit performs traffic totaling for each BGP attribute unit, the traffic counting function unit converts the source IP address, NextHop address, or area information from the routing table. Based on this, a routing table as a reference destination is selected.

  In a fifth aspect based on the first aspect, the BGP traffic fluctuation monitoring device is configured to perform a time-series change of traffic amount in BGP attribute units and a time-series of generation amount of a BGP Update message indicating that the BGP attribute has changed. It is characterized by displaying changes.

  According to the present invention, it is possible to detect a traffic fluctuation due to a BGP path fluctuation factor.

1 is a system configuration diagram of an embodiment of the present invention. It is a function block diagram of a BGP path | route receiving part. It is a figure which shows the BGP message classification method. It is a function block diagram of a traffic information receiving part. It is a figure which shows the comparative evaluation method when a traffic item increases. It is a figure which shows the comparative evaluation method when a traffic item reduces. It is a figure which shows the example of a display.

  FIG. 1 shows a schematic configuration diagram of a system according to an embodiment of the present invention. In FIG. 1, 100 is a BGP traffic fluctuation monitoring device, 101 is a BGP route receiving unit, 102 is a traffic information receiving unit, 103 is a correlation matching function unit, 110 is its own AS domain, and 111 to 115 are in its own AS domain 110. 120, the neighboring AS # 1, 121 is the router in the neighboring AS # 1 (120), 130 is the Internet connected via the neighboring AS # 1 (120), 140 is the neighboring AS # 2, 141 Router in adjacent AS # 2 (140), 150 is adjacent AS # 3, 151 is a router in adjacent AS # 3 (150), 160 is the Internet connected via adjacent AS # 3, 170 is a terminal Web drawing client. The number of routers in each AS is arbitrary and is not limited to that shown.

  The BGP traffic fluctuation monitoring device 100 is arranged in the own AS domain 110. The BGP traffic fluctuation monitoring apparatus 100 is directly connected to the BGP routers 111 to 115 using the BGP protocol and collects BGP route information. Here, route information may be collected using a BMP protocol (Non-Patent Document 3) in addition to BGP. Further, the BGP traffic fluctuation monitoring apparatus 100 may connect to a plurality of route reflectors by BGP instead of connecting to all BGP routers in the own AS domain 110 and collect routes.

  Further, the BGP traffic fluctuation monitoring apparatus 100 collects traffic information called flow information from each router and switch in its own AS domain 110 by a traffic distribution protocol such as NetFlow, sFlow, and IPFIX. It is also possible to collect traffic information called flow information from routers and switches of customer users other than the own AS by using a traffic distribution protocol such as NetFlow, sFlow, and IPFIX, and aggregate traffic based on the BGP route information of the own AS. And

  The traffic information obtained from the own AS domain 110 is called flow information, and includes IP / TCP / UDP / ICMP header information of the packet.

  The BGP traffic fluctuation monitoring apparatus of the present embodiment correlates the fluctuation situation of BGP with the actual traffic fluctuation, and detects a match that matches this as a traffic fluctuation due to a path fluctuation. The BGP route fluctuation is classified by comparing the already received BGP route information with the newly received BGP route information, determining whether or not the unit has been changed to a BGP attribute unit that contributes to the traffic fluctuation. Using the traffic information (called flow information) distributed from the router by NetFlow, sFlow, and IPFIX, the traffic amount in units of BGP attributes is aggregated. The change in traffic volume is evaluated based on the similarity between the traffic volume measured at a certain time interval and the traffic volume measured in the previous period. By extracting the BGP attribute having the greatest degree of influence that deviates from a certain threshold value, and evaluating whether or not BGP path fluctuation actually occurred within the time interval when traffic fluctuation occurred, It is identified as traffic fluctuation due to BGP path fluctuation.

  The BGP traffic fluctuation monitoring device 100 collects BGP Update messages, manages the BGP route information, and stores BGP log information 206 (see FIG. 2) in which the BGP Update messages are classified into BGP attribute units. A traffic information receiving unit 102 that collects traffic information, aggregates traffic in BGP attribute units based on BGP route information, and accumulates the aggregated traffic total data 404 (see FIG. 4); The traffic fluctuation is detected from the similarity of the traffic aggregated data before and after, and the BGP attribute value contributing to the traffic fluctuation is compared with the BGP log information of the time interval, and the BGP path fluctuation related to the BGP attribute value has occurred. And a correlation matching function unit 103 for evaluating whether or not It is.

  The BGP traffic fluctuation monitoring device 100 collects and classifies BGP Update messages, performs traffic aggregation in BGP attribute units based on the BGP route information, detects traffic fluctuations from the similarity to past data, and detects traffic. By evaluating whether or not BGP Update is changed at the time interval under the attribute condition that contributes to the fluctuation, it is possible to detect the traffic fluctuation due to the BGP path fluctuation factor.

  The operation of each part is described below.

[Outline of operation of BGP route receiver]
FIG. 2 shows a detailed configuration of the BGP route receiving unit 101. In FIG. 2, 201 is a BGP session management unit, 202 is a routing management function unit, 203 is a BGP Update classification function unit, 204 is a two-branch routing table, 205 is a deleted route table, and 206 is BGP log information.

  The BGP session management unit 201 collects route information by connecting to each BGP router.

  The BGP Update classification function unit 203 compares the newly received BGP Update message with the already received BGP Update message, classifies the Update message into BGP attribute units that affect traffic fluctuation, and accumulates the BGP log information 206. .

  The routing management function unit 202 manages BGP route information as a routing table. At that time, information is stored in units of peering destination addresses. Information to be stored includes a two-branch routing table 204 and a deleted route table 205.

  In the two-branch routing table 204, a Patria Trie generally configured for routing is created, and the routing management function unit 202 always maintains the latest state and is configured in units of BGP peering address destinations. The bifurcated routing table 204 stores the time accepted by BGP and BGP attribute information in addition to the route (network address, prefix length). When an Update message is received, the information is always updated, and the same information is overwritten. When the Withdraw message is received, the route is also deleted from the two-branch routing table.

  When the Withdraw message is received, the deleted route table 205 stores the route and the time received by the routing management function unit 202 through BGP in the deleted route table 205.

  The BGP log information 206 classifies the BGP Update message received by the BGP Update classification function unit 203 and stores it as log information for each path. The classification of BGP Update is classified in Table 1 below. Whether or not the attribute of the BGP has been changed is evaluated by referring to the bifurcated routing table 204 and comparing the information of the search result with the attribute included in the received BGP Update. When a plurality of BGP attributes are changed, a plurality of message types can be specified. For example, when there is a change in both the BGP Next attribute and the Peer AS, a plurality of message types (P and H) are designated. For those with Withdraw, OriginAS, PeerAS, BGP Nexthop, and AS path Change, a path variation that may affect the traffic variation is shown.

  The method for actual classification is shown below.

  FIG. 3 is a diagram showing a BGP message classification method. When the BGP route information is received, the BGP Update classification function unit 203 is a Withdraw message in 301? In the case of Yes, the message type: W is set. In the case of No, is the same route information existing in 302 by referring to the 2-branch routing table 204? Judging. If yes, 303 is OriginAS the same? Judging. If Yes, the process proceeds to 304. If No, the message type: O is set, and then the process proceeds to 304. In 304, is PeerAS the same? Judging. If Yes, the process proceeds to 305. If No, the message type: P is set and then the process proceeds to 305. Is 305 BGP NextHop the same? Judging. If Yes, the process proceeds to 306. If No, the message type: H is set, and then the process proceeds to 306. Is 306 the same AS path? (Other than PeerAS, OriginAS) is determined. If Yes, the process proceeds to 307. If No, the message type: C is set and then the process proceeds to 307. Is 307 the same community? Judging. If yes, go to 308; if no, set message type: M and then go to 308. Are the above attributes the same at 308? If yes, the message type: D is set. If No in 302, the deleted route table 205 is referred to in 309, and does it exist in the deleted route table? Judging. In the case of Yes, the message type: R is set, and in the case of No, the message type: N is set.

  The classified route information is stored as BGP log information 206 including the information elements in Table 2 below, including information on each message type.

[Outline of operation of traffic information receiver]
Separately from the BGP route receiving unit 101, the traffic information receiving unit 102 totals traffic items in units of BGP attributes. FIG. 4 shows a configuration diagram of the traffic data information receiving unit 102. In FIG. 4, 401 is a flow information receiving unit, 402 is a traffic totaling function unit, 403 is a peering IP management table, 404 is traffic totaling data, and 204 is a two-branch routing table. The two-branch routing table 204 is created by the BGP path receiving unit 101 in units of BGP peering destination IP addresses.

  The traffic totaling function unit 402 searches the two-branch routing table 204 based on the traffic information collected by the flow information receiving unit 401, and totals traffic for each BGP attribute unit that affects traffic fluctuation. Further, when the traffic totaling function unit 402 performs traffic totaling for each BGP attribute unit, the routing as a reference destination based on the source IP address, the NextHop address, or the region information from the two-branch routing table 204 is used. Select a table.

  When the traffic aggregation function unit 402 aggregates traffic items in units of BGP attributes, it is necessary to collect BGP attribute information by referring to the bifurcated routing table 204 based on the transmission source IP address and transmission destination IP address. is there. It is necessary to determine which table of the two-branch routing table 204 stored for each BGP peering destination router is to be used. The traffic information receiving unit 102 holds in advance a peering IP management table 403 in which all IF addresses (IP address and netmask) of the BGP connection destination peering router are stored. This may be collected based on the IP-MIB from the router by SNMP. The peering IP management table 403 also holds regional information of the BGP peering connection destination router. Based on this, the traffic totaling function unit 402 selects the reference table in the following order.

  1) When the source IP address distributed by NetFlow, IPFIX, and sFlow is included in the IP addresses of all IFs of the BGP connection destination peering router, the bifurcated routing table of the peering router is used. .

  2) Other than the above, if the source IP address distributed by NetFlow, IPFIX, and sFlow belongs to the network address of all IFs of the peering router to which BGP is connected, use the bifurcated routing table of the peering router To do.

  3) Other than the above, when the NextHop address included in the flow information is included in the IP addresses of all IFs of the peering router to which the BGP is connected, the two-branch routing table of the peering router is used.

  4) Other than the above, the regional information is referred to from the source IP address distributed by NetFlow, IPFIX, and sFlow, and the two-branch routing table of the peering router belonging to the same region is used.

  The traffic counting function unit 402 refers to the two-branch routing table 204 configured by the BGP route receiving unit 101 based on the transmission source IP address and transmission destination IP address included in the received traffic information at the time of traffic counting. To collect BGP route information. When referring to the table, a search is performed so that the address length is the longest match (longest match). Based on the obtained BGP route information, the following traffic items are tabulated in units of BGP attributes.

-Origin AS
-PeerAS
-BGP Next address-AS Path
-AS Link (a pair of arbitrarily adjacent ASs included in the AS Path)
-Prefix
-Community

  The above traffic items may not be aggregated for all traffic, but only the items up to the top N may be aggregated based on the traffic flow rate (number of bytes, number of packets, number of flows) per unit time. If the above traffic items are in a steady state with no path fluctuation, the similarity of the top N traffic is maintained except for traffic fluctuation due to daily fluctuation. OriginAS represents the amount of traffic toward the final base point AS, PeerAS represents the amount of traffic with an adjacent AS, and AS Path and AS Link have their own AS / AS arrival on the Internet. This indicates what AS the traffic has passed through. In addition, according to Non-Patent Document 1, Community is generally assigned a community number in many units, and the traffic amount in community unit represents the traffic amount in region unit. In addition, the BGP Next address indicates the amount of traffic for the egress router because it indicates the egress router in the self AS area.

  These traffic volumes are important information for designing facilities such as router capacity and physical lines. If sudden traffic fluctuations occur due to BGP route fluctuations, reexamine the equipment design. Not only is necessary, but traffic to a certain line / router may become tight, which may hinder service. Therefore, it is necessary to aggregate these traffic volumes.

[Overview of correlation collation function operation]
The correlation matching function unit 103 detects traffic fluctuation from the similarity of the traffic summary data 404 that fluctuates in time, compares the attribute value of BGP that contributed to the traffic fluctuation, and the BGP log information 206 of the time interval, It is evaluated whether or not a BGP route fluctuation related to the BGP attribute value has occurred.

  The correlation matching function unit 103 evaluates the correlation from the obtained traffic total data 404 and the BGP log information 206. The fluctuation of the traffic total data is evaluated based on the similarity with the previous cycle by the following procedure. Reference is made to Patent Document 1.

  ・ Traffic fluctuation (increase / decrease) is detected based on the key attribute of the higher traffic volume for each cycle.

  ・ Detected as an alert when the ranking change is large for a specific key attribute. At that time, key attributes that may cause traffic fluctuations are also used as alerts.

  -The key attribute for performing traffic analysis is applied to the traffic items that have been aggregated.

・ Traffic fluctuation is detected according to the following detection formula.
-Assume that a Top N ranking change in Origin AS (example) is detected.
-Extract traffic amount (b / s) of Origin AS of Top N.
-Let OriginAS at the i-th position for a certain time (t) be f (i, t).
− Let c (f (i, t), t) be the traffic volume of Origin AS during a certain time (t).
-Extracting the traffic volume data string up to the top N for a certain time (t)-C (t) _i = {c (f (1, t), t), c (f (2, t), t), ..., c (f (N, t), t)} (i = 1, 2,..., N)
− Extract traffic volume data sequence based on f (i, t) at time (t−1) one slot before − C (t−1) _i = {c (f (1, t), t− 1), c (f (2, t), t-1), ..., c (f (N, t), t-1)} (i = 1, 2, ..., N)
-In this case, the amount of traffic outside the rank is considered to be zero.
The correlation coefficients of the array {(C (t) _i , C (t−1) _i )} (i = 1, 2,..., N) are determined.
-The correlation coefficient r (t, t-1) is as follows.

C _avg (t) is the average of the top N traffic volumes for a certain time (t).

-C _avg (t-1) is the average of the traffic volume of time (t-1) based on Origin AS of the top N rank of time (t).
-The correlation coefficient takes a value from 1 to -1, and if it is closer to 1, it is determined that there is no change in rank.
-The info level is displayed on the assumption that there is a change when the value falls below a certain threshold (M: for example 0.5).

Detect f (i, t) (ex. OriginAS) and traffic c (f (i, t), t) estimated to be the cause of fluctuation. In the search for the cause of fluctuation, the correlation coefficient is obtained by omitting the data of each f (i, t), and the one larger than the threshold is extracted. It is shown below.
− Create a data string from which data of a certain rank (k) is removed − C (t) _i = {c (f (1, t), t), c (f (2, t), t), ..., c (F (k, t), t), ..., c (f (N, t), t)}
-Let the correlation coefficient thus obtained be r (k) (t, t-1).

・ The parameters specified in advance are as follows.
-N: Traffic ranking information up to the top N that is enabled by the rank fluctuation detection function. (It can be specified for each key attribute.)
-M: Correlation coefficient threshold (1 to 0), alert target when smaller than threshold M. (The threshold value can be specified for each key attribute type.)

  The following is an event image when traffic fluctuation occurs.

  Correlation checking function section 103 determines whether or not path fluctuation has actually occurred based on the obtained traffic item in which traffic fluctuation has occurred and the BGP attribute value that has caused the fluctuation. The determination method is performed for each BGP attribute as follows.

  -From the traffic volume of the previous cycle, evaluate whether the traffic attribute item of the BGP attribute value caused by the fluctuation has increased or decreased, and perform comparative evaluation with the BGP log information 206.

  When the traffic attribute of the BGP attribute value caused by the fluctuation increases, the evaluation is performed with the BGP log information 206 during the period when the traffic fluctuation occurs.

  FIG. 5 is a diagram illustrating a comparative evaluation method when traffic items increase.

  Is the BGP log information of BGP message type = New (N), Renew (R) including the BGP attribute value generated in 501? Make a decision. In the case of Yes, it is determined that traffic fluctuation is caused by BGP route information. In the case of No, the process proceeds to 502 and is classified by the traffic item. In step 503, is BGP log information of BGP message type = Origin AS Change (O) including the BGP attribute value in the new information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In step 504, is BGP log information of BGP message type = PeerAS Change (P) including the BGP attribute value in the new information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In step 505, is BGP log information of BGP message type = BGP NextHop Change (H) included in the new information including the BGP attribute value? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In 506, is BGP log information of BGP message type = AS Path Change (C) including the BGP attribute value in the new information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In step 507, is BGP log information of BGP message type = Community (M) that includes the BGP attribute value in the new information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change.

  When the traffic item of the BGP attribute value due to the fluctuation decreases, the comparison with the BGP log information in the period when the traffic fluctuation occurs is performed.

  FIG. 6 is a diagram showing a comparative evaluation method when traffic items are decreased.

  In 601, is BGP log information of BGP message type = Withdraw (W) including the BGP attribute value generated? Make a decision. In the case of Yes, it is determined that traffic fluctuation is caused by BGP route information. In the case of No, the process proceeds to 602, and classification is performed according to traffic items. In step 603, is BGP log information of BGP message type = Origin AS Change (O) including the BGP attribute value in the old information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In step 604, is BGP log information of BGP message type = PeerAS Change (P) including the BGP attribute value in the old information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In 605, is BGP log information of BGP message type = BGP NextHop Change (H) including the BGP attribute value in the old information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In 606, is BGP log information of BGP message type = AS Path Change (C) including the BGP attribute value in the old information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change. In step 607, is BGP log information of BGP message type = Community (M) that includes the BGP attribute value in the old information generated? In the case of Yes, it is determined that the traffic is changed due to the BGP route change.

  Moreover, it is also possible to display these results in time series as the actual traffic item of the BGP attribute value and the BGP log information 206 for each BGP message type including the information. The traffic volume and the number of occurrences by BGP message type can be displayed on the same time axis, and the correlation between traffic fluctuations due to BGP fluctuations is confirmed from the results actually obtained by narrowing down with specific BGP attribute values. Also possible. FIG. 7 shows a display example in which the time series change of the traffic volume and the time series change of the number of occurrences for each BGP message type are displayed on the same time axis. Such a display may be performed by the BGP traffic fluctuation monitoring apparatus 100 via the terminal Web drawing client 170 or may be displayed by another method.

  The BGP traffic fluctuation monitoring apparatus described above can be composed of a computer and a program. Moreover, you may comprise a part or all of the program with a hardware.

  As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

DESCRIPTION OF SYMBOLS 100 ... BGP traffic fluctuation | variation monitoring apparatus, 101 ... BGP path | route receiving part, 102 ... Traffic information receiving part, 103 ... Correlation verification function part, 110 ... Own AS domain, 111-115 ... Router in own AS domain 110, 120 ... Adjacent AS # 1, 121 ... router in adjacent AS # 1 (120), 130 ... Internet connected via adjacent AS # 1 (120), 140 ... adjacent AS # 2, 141 ... adjacent AS # 2 Router in (140), 150 ... Adjacent AS # 3, 151 ... Router in adjacent AS # 3 (150), 160 ... Internet connected via adjacent AS # 3, 170 ... Terminal Web rendering client, 201 ... BGP session management unit, 202 ... routing management function unit, 203 ... BGP Update classification function unit, 204 ... 2 minutes Routing table 205 ... deleted route table 206 ... the BGP log information 401 ... flow information receiving unit, 402 ... traffic aggregator unit, 403 ... peering IP management table, 404 ... traffic aggregated data

Claims (7)

A BGP traffic fluctuation monitoring device for detecting traffic fluctuation due to a BGP path fluctuation factor,
A BGP route receiver that collects BGP Update messages, manages the BGP route information, and accumulates BGP log information in which BGP Update messages are classified into BGP attribute units;
A traffic information receiving unit that collects traffic information, performs traffic aggregation in BGP attribute units based on the BGP route information, and accumulates the aggregated traffic aggregation data;
The traffic fluctuation is detected from the similarity of the traffic aggregated data before and after the time, the BGP attribute value contributing to the traffic fluctuation is compared with the BGP log information of the time interval, and the BGP path fluctuation related to the BGP attribute value is detected. A correlation matching function unit that evaluates whether or not it occurred,
A BGP traffic fluctuation monitoring apparatus comprising: The BGP traffic fluctuation monitoring apparatus according to claim 1,
The BGP route receiving unit includes a BGP Update classification function unit that compares a newly received BGP Update message with a BGP Update message that has already been received, and classifies the Update message into BGP attribute units that affect traffic fluctuations. A BGP traffic fluctuation monitoring device. The BGP traffic fluctuation monitoring apparatus according to claim 1,
The BGP route receiving unit includes a routing management function unit that manages BGP route information as a routing table,
The traffic information receiving unit includes a traffic totaling function unit that searches the routing table based on the collected traffic information and totals traffic in BGP attribute units that affect traffic fluctuations. Fluctuation monitoring device. In the BGP traffic fluctuation monitoring device according to claim 3,
The traffic aggregation function unit selects a routing table as a reference destination from the routing table based on a source IP address, a NextHop address, or regional information when performing traffic aggregation in BGP attribute units. A BGP traffic fluctuation monitoring apparatus characterized by that. The BGP traffic fluctuation monitoring apparatus according to claim 1,
The BGP traffic fluctuation monitoring apparatus displays a BGP traffic fluctuation characterized by displaying a time-series change in traffic amount in BGP attribute units and a time-series change in the amount of BGP Update messages indicating that the BGP attribute has changed. Monitoring device. A BGP traffic fluctuation monitoring method in a BGP traffic fluctuation monitoring device for detecting traffic fluctuation due to a BGP path fluctuation factor,
The BGP traffic fluctuation monitoring device includes a BGP route receiving unit, a traffic information receiving unit, and a correlation checking function unit,
The BGP route receiving unit collects a BGP Update message, manages the BGP route information, and stores BGP log information obtained by classifying the BGP Update message into BGP attribute units.
The traffic information receiving unit collects traffic information, performs traffic aggregation in BGP attribute units based on the BGP route information, accumulates aggregated traffic aggregation data,
The correlation matching function unit detects traffic fluctuations from the similarity of traffic aggregated data that fluctuates in time, compares the attribute values of BGP that contributed to traffic fluctuations and the BGP log information of the time interval, and Evaluate whether or not BGP route fluctuation has occurred regarding the attribute value of
A BGP traffic fluctuation monitoring method characterized by the above. A BGP traffic fluctuation monitoring system for detecting traffic fluctuation due to a BGP path fluctuation factor,
BGP route receiving means for collecting BGP Update messages, managing the BGP route information, and storing BGP log information in which BGP Update messages are classified into BGP attribute units;
Traffic information receiving means for collecting traffic information, performing traffic aggregation in BGP attribute units based on the BGP route information, and storing the aggregated traffic aggregation data;
The traffic fluctuation is detected from the similarity of the traffic aggregated data before and after the time, the BGP attribute value contributing to the traffic fluctuation is compared with the BGP log information of the time interval, and the BGP path fluctuation related to the BGP attribute value is detected. Correlation checking function means for evaluating whether or not it occurred,
A BGP traffic fluctuation monitoring system comprising:

Images