JP2012191526A - Network failure detection system, network failure detection method, and network failure detection program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently and quickly detect a failure in a wide-area Ether network.SOLUTION: A network failure detection system 100 is configured by: packet capture means 110 which is connected to a monitoring domain different from existing domains in a wide-area Ether network 10; and failure determination means 111 which counts the number of packets transmitted to addresses other than an own address among packets received by the packet capture means 110 in a predetermined time, and when the counted number of packets exceeds a predetermined threshold, transmits notification of failure detection to a predetermined terminal 200 of which address is stored in a storage unit 101 in advance.

Description

  The present invention relates to a network failure detection system, a network failure detection method, and a network failure detection program. Specifically, the present invention relates to a technique for efficiently and quickly detecting a failure in a wide area Ethernet network.

  When monitoring a network device, ping confirmation from the monitoring device and information collection by SNMP (Simple Network Management Protocol) are performed. Ping uses a rule that a node that receives an ICMP (Internet Control Message Protocol) echo request returns an echo response. In this case, an IP packet is issued to a host whose network communication is to be confirmed, and a failure is detected by confirming whether a response corresponding to the packet has been received. If the ping command can be executed normally, it is determined that the network between the hosts is normal.

  SNMP (Simple Network Management Protocol) is a protocol that performs UDP / IP-based network monitoring. For network devices, the number of packets transmitted and received on each port, the number of error packets, the state of the port, and the like are monitored. . In this case, an SNMP agent is arranged in advance in the monitoring target, and the status of the monitoring target can be grasped from information (MIB: Management information Base) collected by the SNMP agent.

  Other network fault monitoring techniques include the following. For example, a network management system that includes a plurality of management devices that are connected to each other via a network and that each manage a failure of a certain domain of the network, the domain managed by one of the plurality of management devices When a failure is detected in the management device, the management device tries to identify the cause of the failure, and when the management device cannot identify the cause of the failure in the domain managed by the management device, the other management device in the network A network management system (see Patent Document 1) and the like, which is characterized by trying to identify the cause of the failure in the domain of the other management device in cooperation with the above, has been proposed.

  Further, in a communication network in which a plurality of relay devices each having a plurality of terminals connected thereto constitute a network, and one of the plurality of terminals functions as a management terminal of the network, the management terminal transfers the plurality of terminals to the plurality of terminals. Means for circulating the first packet in a predetermined order; detection means for detecting whether the first packet returns to the management terminal after the circulation; and when the first packet does not return, Sending means for sending a second packet to each of the terminals; means for receiving response packets from the plurality of terminals for the second packet at the management terminal; and receiving the response packet at the management terminal A communication network (refer to Patent Document 2) characterized by comprising means for identifying a fault location in the network based on the status It has been proposed.

  In addition, the first LAN transmission / reception control device set in the network monitor mode, the second LAN transmission / reception control device set in the normal LAN transmission / reception mode and monitoring the reception of the failure notification message, the message on the LAN When the failure notification message is received by the logging memory for storing and storing and the second LAN transmission / reception control device, the network monitor mode of the first LAN transmission / reception control device is stopped, and the messages stored from the logging memory are logged. A LAN fault monitoring device (see Patent Document 3) characterized by having a CPU that reads data as data has also been proposed.

Japanese Patent Laid-Open No. 10-340235 JP-A-9-83556 JP-A-6-132960

  Here, for example, it is assumed that the fault monitoring target is a wide area Ethernet work. Then, it is assumed that a cause of flooding or broadcasting such as a loop failure occurs in a certain domain, which causes an increase in load in the network due to abnormal traffic. Under such circumstances, it is difficult to perform detection work for all of a huge number of domains in the wide-area Ethernet work even if it is attempted to apply the conventional methods such as ping and SNMP as described above. It is also impossible for the administrator of each domain to individually monitor the entire wide area Ethernet work in addition to its own domain. In any case, it can be said that it is difficult to detect a failure until a report is made by a user who notices a problem in his / her domain.

  Accordingly, an object of the present invention is to provide a technique for efficiently and quickly detecting a failure in a wide area Ethernet work.

  The network failure detection system of the present invention that solves the above-mentioned problems is characterized in that a packet capture unit connected to a monitoring domain different from an existing domain in a wide area Ethernet network, and a self-address among packets received by the packet capture unit at a predetermined time A failure determination unit that counts the number of packets other than the destination and, when the counted number of packets exceeds a predetermined threshold, sends a failure detection notification to a predetermined terminal that holds an address in the storage unit in advance; It is characterized by providing.

  The network failure detection method of the present invention includes a process in which an information processing apparatus connected to a wide area Ethernet work so as to be communicable captures a packet in a monitoring domain different from an existing domain in the wide area Ethernet work, The number of packets other than those addressed to the self-address is counted among the packets received at a fixed time by the processing, and when the counted number of packets exceeds a predetermined threshold, the packet is addressed to a predetermined terminal that holds an address in advance in the storage unit And a process of transmitting a failure detection notification.

  Further, the network failure detection program of the present invention includes a process for capturing a packet in a monitoring domain different from an existing domain in the wide area Ethernet work, to an information processing apparatus that is communicably connected to the wide area Ethernet work; The number of packets other than those addressed to the self-address is counted among the packets received at a fixed time by the processing, and when the counted number of packets exceeds a predetermined threshold, the packet is addressed to a predetermined terminal that holds an address in advance in the storage unit And a process of transmitting a failure detection notification.

  According to the present invention, it is possible to efficiently and quickly detect a failure in a wide area Ethernet work.

It is a network block diagram including the network failure detection system of this embodiment. It is a block diagram which shows the structural example of the packet capture apparatus in this embodiment. It is explanatory drawing which shows the packet structure example. It is a figure which shows the example of a data structure of the notification destination table in this embodiment. It is a flowchart which shows the example 1 of a failure in this embodiment. It is a flowchart which shows the example 2 of a failure in this embodiment. It is a flowchart which shows the example of a process sequence of the network failure detection method in this embodiment.

--- System configuration ---
Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a network configuration diagram including the network failure detection system of the present embodiment. The network failure detection system shown in FIG. 1 is a computer system that detects a failure in the wide area Ethernet work 10 efficiently and quickly. In the present embodiment, as an example, it is assumed that the network failure detection system 100 is realized by a packet capture device. Therefore, hereinafter, the packet capture device 100 will be described as a network failure detection system.

  The wide-area Ethernet work 10 to which the packet capture device 100 is connected is a network that can transparently transfer Ethernet frames = packets of each user in each domain and connect remote bases. In the example shown in FIG. 1, there are domains of bases A to C, and packets generated at each base are transmitted and received across the bases via the wide area Ethernet work 10. Since a single wide area Ethernet work 10 transfers a plurality of users 'packets, it is necessary to separate the users' packets. In this case, a situation in which a VLAN (Virtual LAN) is used can be assumed. In the wide area Ethernet work 10, user packets are separated by IEEE802.1Q VLAN tags.

  The wide-area Ethernet work 10 has no restriction on the routing protocol between bases due to the property of transparently transferring packets, and uses RIP (Routing Information Protocol) and OSPF (Open Shortest Path First) in the existing network. In this case, it is possible to perform dynamic routing between bases with almost no change in the configuration of the routing protocol even after shifting to wide area Ethernet.

  In the wide area Ethernet work 10 having such characteristics, when abnormal traffic occurs due to a loop failure or the like at a certain site, a large amount of broadcast communication and flooding communication occur in the network. This communication is propagated to all bases connected to the network. Therefore, the packet capture device 100 of this embodiment is connected to a predetermined monitoring domain in the wide area Ethernet work 10 to monitor such an abnormal situation.

  For example, the router 300 at the base A (“Router A” in the figure) has “192.168.0.1” as the address, and the router 300 at the base B (“Router B” in the figure) has the address “192.168.”. Assume that “0.2” is set, and the router 300 (“router C” in the figure) at the base C has “192.168.0.3” as the address. The packet capture device 100 is connected to “192.168.0.10” as a monitoring domain in a domain different from the domains of the respective bases A to C.

  In this case, the packet addressed to the site A is referred to the destination IP address (see FIG. 3) of the packet by the router or the like that has received the packet, and is forwarded from the router to the address “192.168.0.1”. The packet addressed to the site B is transferred to the address “192.168.0.2”, and the packet addressed to the site C is transferred to “192.168.0.3”.

  Therefore, there is no information transferred to the packet capture device 100 = “192.168.0.10” in the routing information in the wide area Ethernet network. That is, normally, packets other than those addressed to the address of the packet capture device 100 do not arrive. If it arrives, it can be determined as broadcast communication or flooding communication.

  As a packet capture function provided in the packet capture device 100, for example, a technique using a mirroring function such as a LAN switch is used. This mirroring function is a function for copying a packet transmitted / received on a specific port such as a LAN switch to another port. As an existing packet capture function, it is also possible to specify a plurality of mirroring ports to be captured traffic or to specify a capture target on a VLAN basis. Normally, the NIC checks the destination MAC address of the packet and is set not to receive any packets other than the packet addressed to itself. Of course, the packet capture device 100 of the present embodiment is set to receive a packet not addressed to itself. Has been made.

  Next, the configuration of the packet capture device 100 will be described. FIG. 2 is a block diagram illustrating a configuration example of the packet capture device 100 according to the present embodiment. For example, the packet capture device 100 according to the present embodiment can be assumed to have a packet capture application installed in a general personal computer. Accordingly, in this case, the packet capture device 100 includes a storage unit 101 configured by a nonvolatile storage device such as an HDD, a storage unit 101 storing a program 102 and a table, a memory 103 as a volatile storage device such as a RAM, and the storage unit 101. An instruction from a user is received via a computation unit 104 such as a CPU that reads and executes the program 102 stored in the memory 103 and executes it, a communication unit 105 such as a NIC for connecting to the wide area Ethernet work 10, a keyboard, a mouse, and the like. An input unit 106 and an output unit 107 that controls a display, a speaker, and the like that output processing results are configured. Each of these components is connected by a BUS, a bridge, or the like.

  The packet capture device 100 includes a packet capture unit 110 that captures packets flowing into the monitoring domain “192.168.0.10”. As described above, the packet capture unit 110 should normally have no opportunity to receive packets other than those addressed to itself. However, if flooding or the like occurs at another site, the packet capture unit 110 receives a packet derived therefrom. . An existing packet capture technique may be employed as the capture method.

  In addition, the packet capture device 100 counts the number of packets other than those addressed to its own address among the packets received by the packet capture unit 110 at a predetermined time, and when the counted number of packets exceeds a predetermined threshold, A failure determination unit 111 that transmits a failure detection notification to the administrator terminal 200 that holds an address in the notification destination table 125 of the storage unit 101 is provided. Note that the functions 110 and 111 described here can be said to be implemented by executing the program 102 provided in the packet capture device 100, for example.

--- Data structure example ---
Next, an example of a data structure in a table used by the packet capture device 100 which is the network failure detection system of the present embodiment will be described. FIG. 4 is a diagram showing an example of the data structure of the notification destination table 125 in this embodiment. This notification destination table 125 is a table used by the failure determination unit 111 of the packet capture device 100 to specify the transmission destination of the failure detection notification. The notification destination table 125 associates, for example, notification destinations (“manager 1”, “manager 2”,... It has become a thing. Of course, the notification destination is not limited to such an e-mail address, and any other notification means via a network may be used. When a plurality of persons to be notified are set as in the notification destination table 125 shown in the figure, the failure determination unit 111 notifies, for example, according to the degree that the counted number of packets exceeds a predetermined threshold. Select the target person (example: “Administrator 1” is selected when the threshold is exceeded by 10% or more, “Administrator 2” is selected when the threshold is exceeded by 20%), and the notification is sent to the address of the person concerned You may control to do.

--- Example of flooding ---
Next, an example of flooding detected by the packet capture device 100 of this embodiment will be described. FIG. 5 is a flowchart showing failure example 1 in the present embodiment, and FIG. 6 is a flowchart showing failure example 2 in the present embodiment. In this case, two lines are laid at the site A in preparation for a line failure. If the routing design of this site A is wrong, the outgoing and return communication paths may be different in communication with other sites. For example, if the outgoing line is the line a and the return line is the line b, the communication is established, but the FDB (forwarding database) in the wide area Ethernet is not generated any time. Therefore, all communication between the domain of the base A and the domain of the base B is flooded. Communications flooded within the network are also sent to the base C, which has nothing to do with it. If the bandwidth of the lines at sites A and B is, for example, 100 Mbps, and the bandwidth of the line at site C is 1 Mbps, the line bandwidth at site C is engulfed by flooding originating from the site A, and communication is unstable. Or you can not communicate at all.

  Further, the base A and the base B have the same segment “Seg. D”. (For example, when using a local address that cannot be routed by wide area Ethernet) Seg. D is extended by TagVLAN 500 so as to straddle the wide area Ethernet work 10. Site A Seg. If a loop failure occurs at D, the broadcast is replicated in large quantities. The replicated broadcast flows into the wide area Ethernet work 10 through the Tag VLAN. The L2SW in the wide-area Ethernet work 10 also transfers this blade cast packet as a broadcast throughout the network. As a result, the inside of the network becomes unstable.

--- Processing procedure example ---
Hereinafter, an actual procedure of the network failure detection method according to the present embodiment will be described with reference to the drawings. Various operations corresponding to the network failure detection method described below can be assumed to be realized by a program 102 that the packet capture device 100 as a network failure detection system reads out and executes in the memory 103. And this program 102 is comprised from the code | cord | chord for performing the various operation | movement demonstrated below. Of course, each function of the packet capture device 100 may be realized as hardware.

  FIG. 7 is a flowchart illustrating an example of a processing procedure of the network failure detection method according to the present embodiment. Here, the packet capture unit 110 of the packet capture device 100 receives a packet flowing from the wide area Ethernet work 10 (s100). At this time, the failure determination unit 111 of the packet capture device 100 confirms the IP header of the packet received by the packet capture unit 110 (s101), and the destination IP address is the IP address “192.168.0.10” of the packet capture device 100. Is determined (s102).

  If it is determined in step s102 that the destination IP address of the received packet is that of the packet capture device 100 (s103: Yes), the packet capture device 100 returns the process to step s100.

  On the other hand, when the destination IP address of the received packet is not that of the packet capture device 100 in the determination of step s102 (s103: No), the failure determination unit 111 of the packet capture device 100 is constant for the past 1 second or the like. The amount of received packets per time, that is, the packet flow rate (packets / second) is counted, and it is determined whether this value exceeds a predetermined threshold (previously held in the storage unit 101) (s104). As an example of the threshold value, 500 pps (packets / second) can be assumed, but the magnitude of the threshold value changes according to the scale of the network.

  When the number of domains included in the wide area Ethernet work 10 is large and communication is performed at a high frequency, the value of the packet flow rate becomes large even in a normal state. On the contrary, when the number of domains included in the wide area Ethernet work 10 is small and communication is performed only infrequently, the value of the packet flow rate is small even at the time of abnormality. In any case, broadcast and flatting occur all the time, and it is necessary to consider that a failure is not determined when normal. For example, the packet capture device 100 stores a past failure occurrence history in the storage unit 101, periodically calculates an average value of packet flow rates at the time of a past failure occurrence, and calculates the calculated value as the threshold value. It is preferable to perform processing such as setting.

  If it is determined in step s104 that the amount of received packets per certain time does not exceed the predetermined threshold (s105: No), the packet capture device 100 returns the process to step s100. On the other hand, if it is determined in step s104 that the amount of received packets per certain time exceeds a predetermined threshold (s105: Yes), the failure determination unit 111 of the packet capture device 100 stores the notification destination table 125 of the storage unit 101. The failure detection notification (eg, electronic mail) is transmitted to the address set in the notification destination table 125 (s106). As described above, a control is performed such that a notification target person is selected in the notification destination table 125 according to the degree that the number of received packets per predetermined time exceeds a predetermined threshold value, and the notification is transmitted to the address of the corresponding person. You can go.

  Such failure detection notification processing may be realized by setting an SNMP agent in the packet capture device 100 and using an SNMP trap. The SNMP trap is transmitted to the SNMP manager, that is, the manager terminal 200 when a predetermined event occurs on the terminal on which the SNMP agent operates or when a threshold value is reached.

  The administrator terminal 200 displays the failure detection notification on a display or the like for browsing by the administrator. The administrator views this notification, recognizes the occurrence of the failure, and executes necessary failure handling.

  Although the best mode for carrying out the present invention has been specifically described above, the present invention is not limited to this, and various modifications can be made without departing from the scope of the invention.

  According to the present embodiment, it is possible to efficiently and quickly detect a failure in the wide area Ethernet work.

10 Wide area Ethernet work 100 Network failure detection system (packet capture device)
DESCRIPTION OF SYMBOLS 101 Memory | storage part 102 Program 103 Memory 104 Operation part 105 Communication part 106 Input part 107 Output part 110 Packet capture part (packet capture means)
111 Failure determination unit (failure determination means)
125 Notification destination table 200 Administrator terminal (predetermined terminal)
300 routers

Claims (3)

Packet capture means connected to a monitoring domain different from the existing domain in wide area Ethernet work,
A predetermined terminal that counts the number of packets that are not addressed to its own address among the packets received by the packet capture means at a predetermined time, and holds the address in advance in the storage unit when the counted number of packets exceeds a predetermined threshold Failure determination means for sending a failure detection notification to
A network failure detection system comprising: An information processing device that is communicably connected to a wide area Ethernet network
A process of capturing a packet of a monitoring domain different from the existing domain in the wide area Ethernet network;
A predetermined terminal that counts the number of packets that are not addressed to its own address among the packets received in a certain time by the capture process, and holds the address in advance in the storage unit when the counted number of packets exceeds a predetermined threshold Processing to send notification of failure detection to
A network failure detection method characterized by executing: To an information processing device that is communicably connected to a wide area Ethernet work,
A process of capturing a packet of a monitoring domain different from the existing domain in the wide area Ethernet network;
A predetermined terminal that counts the number of packets that are not addressed to its own address among the packets received in a certain time by the capture process, and holds the address in advance in the storage unit when the counted number of packets exceeds a predetermined threshold Processing to send notification of failure detection to
A network failure detection program characterized in that

Images