JP2014179938A - Quality deterioration factor estimation device, quality deterioration factor estimation method, and quality deterioration factor estimation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique for automatically isolating a part in which a factor to deteriorate user sensory quality exists on the basis of a packet acquired from a network by passive monitoring.SOLUTION: The quality deterioration factor estimation device for estimating a quality deterioration factor of communication among at least two devices in a communication network comprises: capture data storage means for storing capture data acquired by capturing a packet associated with communication among the devices from the communication network; characteristic value calculation means for, from the capture data, calculating at least reorder width of a packet as a characteristic value associated with communication among the devices; estimation means for estimating a place to be a quality deterioration factor of communication among the devices by determining normality of the characteristic value; and output means for outputting an estimation result by the estimation means.

Description

  The present invention relates to application service monitoring in a communication network, and more particularly to a technique for estimating a location that causes deterioration in user experience quality in an application service.

  Application service monitoring is often performed to measure the performance of an application in a network environment and whether the user is stressed.

  Application service monitoring includes a method of directly collecting information at a server and a method of estimating the operation of the entire system from the outside. As a method for directly collecting information, conventionally, a method for acquiring and monitoring parameters related to server performance such as process information, CPU, and memory of a server device to be monitored has been generally performed. As an estimation method from the outside, there are active monitoring in which a measurement probe for performing pseudo communication is installed and monitoring the communication, and passive monitoring in which user communication actually flowing is monitored.

  In the method of directly collecting and monitoring information, since only the server is monitored, it is difficult to find problems other than the server factor such as the experience quality deterioration due to the network factor. On the other hand, the estimation method from the outside can find the problem of the network factor, but has the following problems.

  The problem with active monitoring is that the measurement result is the value of the probe for measurement to the last, and there is no means to confirm that the correlation with the actual user in the measurement time zone is taken. There is a problem that the credibility of the converted information is low.

  As a conventional technique for evaluating the quality of an application, for example, there are techniques described in Patent Documents 1 and 2.

JP 2011-142473 A JP 2011-142474 A

  Passive monitoring has the advantage that it does not affect the user equipment because it does not need to install a measurement probe in the existing equipment, and the quality of the actual communication itself can be directly monitored without sending monitoring packets to the network. When monitoring from the user's perspective, passive monitoring is often preferred.

  However, with the conventional passive monitoring method, it is possible to visualize the characteristic values of each element (application element, network element, etc.) that can be calculated from the traffic information, but this causes the deterioration of the user experience quality. In identifying the location, it is currently necessary to rely on the operator's know-how and many years of experience from the calculated results.

  In particular, due to the complexity of application operations and the enhancement of user terminal performance, simply measuring and monitoring values such as packet loss and jitter that have been used in the past is the reason that the user experience quality is reduced. The number of cases where it is not possible to isolate which part of the area is increasing.

  The present invention has been made in view of the above points, and based on a packet acquired from a network by passive monitoring, it is possible to automatically determine which part has a factor that lowers the user experience quality. The purpose is to provide the technology that enables it.

In order to solve the above problem, the present invention is a quality degradation cause estimation device for estimating a cause of quality degradation of communication between at least two devices in a communication network,
Capture data storage means for storing capture data acquired by capturing packets related to communication between the devices from the communication network;
Characteristic value calculation means for calculating at least a packet reorder width as a characteristic value related to communication between the devices from the capture data;
By determining the normality of the characteristic value, an estimation means for estimating a location that causes a deterioration in communication quality between the devices;
And an output means for outputting an estimation result by the estimation means.

  The two devices are, for example, a user terminal and a server that provides an application service to the user terminal, and the location is the user terminal, the server, or a communication network that connects the user terminal and the server. is there.

  For example, the estimation unit compares the reorder width with a predetermined threshold, and determines that the location that causes the quality degradation exists in the communication network when the reorder width is equal to or larger than the predetermined threshold.

  The characteristic value calculating means calculates a traffic flow rate, RTT, packet loss, jitter, session establishment rate, window size, and server response time in addition to the reorder width as characteristic values related to communication between the devices. It may be.

  In addition, the estimation means performs normality determination in the order of traffic flow rate, RTT, packet loss, jitter, reorder, session establishment rate, window size, and server response time, and when an abnormal determination result is obtained. Thus, the output means may output the determination result.

  In addition, the quality degradation cause estimation device may include network configuration information storage means that stores network configuration information of the communication network. In this case, the estimation means includes normality of the session establishment rate or the window size. When determining whether or not there is a predetermined device between the two devices in the communication network with reference to the network configuration information, a determination is made based on whether or not there is the predetermined device It is good as well.

  Further, the present invention provides a quality deterioration cause estimation method executed by the quality deterioration cause estimation device, and a quality deterioration cause estimation for causing a computer to function as the characteristic value calculation means and the estimation means in the quality deterioration cause estimation device. You may comprise as a program.

  According to the present invention, based on a packet acquired from a network by passive monitoring, it is possible to automatically determine which part has a factor that lowers the user experience quality.

It is a figure for demonstrating the outline | summary of embodiment of this invention. It is a functional block diagram of the quality degradation cause estimation apparatus 10. It is a flowchart which shows the operation example 1 which concerns on embodiment of this invention. It is a figure for demonstrating the example of a determination process regarding a session establishment rate. It is a figure for demonstrating the example of a determination process regarding window size. It is a flowchart which shows the operation example 2 which concerns on embodiment of this invention. It is a flowchart which shows the operation example 3 which concerns on embodiment of this invention. It is a figure which shows the example of a display.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. For example, in the following embodiment, eight types of characteristic values are calculated, but these are only examples, and it is also possible to calculate fewer types of characteristic values than these, or more than these. It is good also as calculating the characteristic value of a kind. Also, a plurality of characteristic values including characteristic values other than the eight types of characteristic values may be calculated.

(System configuration)
In the present embodiment, for example, in the network system configuration shown in FIG. 1, a packet flowing through the network 3 is captured, and the quality degradation cause estimation device 10 analyzes the captured packet, thereby affecting the user experience quality. Various characteristic values are calculated, normality determination and the cause thereof are estimated based on the calculated characteristic values, and the result is output. The “characteristic value” is a generic name of at least eight types of values described later.

  The network system shown in FIG. 1 has a configuration in which a server 1 that provides an application service and a user terminal 2 are connected via a network 3, and is a basic configuration to which the technology according to the present embodiment is applied. . In addition, this structure is an example and the structure which can apply this invention is not restricted to what is shown in FIG. For example, it is possible to estimate the cause of quality deterioration related to communication between three or more devices.

  In the present embodiment, the quality degradation cause estimation device 10 may capture a packet from the network 3 in real time, and perform quality degradation cause estimation in real time based on the captured packet. The cause of quality degradation may be estimated by providing capture data to the quality degradation cause estimation apparatus 10, but in the example described below, analysis is performed using capture data already acquired by another apparatus or the like. It is assumed that

  In addition, this embodiment assumes a case where a user experience quality deterioration report is received from a user and analysis / determination is performed accordingly. However, even if there is no report, analysis / determination is performed periodically. In addition, it is possible to prevent the user from experiencing quality degradation by quickly taking action when an abnormality is detected.

  In FIG. 2, the functional block diagram of the quality degradation cause estimation apparatus 10 is shown. As shown in FIG. 2, the quality degradation cause estimation apparatus 10 according to the present embodiment includes a characteristic value calculation unit 11, a determination unit 12, an input / output unit 13, a capture data storage unit 14, and a network configuration information storage unit 15. .

  The characteristic value calculation unit 11 receives input of information (such as an IP address) for specifying a device (in this embodiment, the server 1 and the user terminal 2 shown in FIG. 1) and a target time, which are targets of quality degradation cause estimation. This is a functional unit that extracts capture data transmitted / received between the devices in a predetermined time length including the time from the capture data storage unit 14 and calculates various characteristic values to be described later from the capture data.

  The determination unit 12 is a functional unit that estimates whether or not each characteristic value calculated by the characteristic value calculation unit 11 is normal and where the cause of quality degradation is in the server, the network, or the user terminal. Moreover, the determination part 12 is provided with the memory | storage part 121 which memorize | stores a determination result.

  The input / output unit 13 is a user interface of a user who uses the quality degradation cause estimation device 10. The input / output unit 13 may display an operation screen to the user and may perform information input or information display using the screen, or a user operation terminal may be connected to the input / output unit 13 via a network. Information input / output may be performed in

  The capture data storage unit 14 stores data acquired (captured) from the network. It is assumed that the capture data includes data necessary for obtaining characteristic values to be described later. In particular, in this example, the capture data includes at least TCP protocol data in order to calculate characteristic values such as packet loss, reorder, and session establishment for the TCP packet.

  When capturing from a plurality of points on the network, the capture data storage unit 14 stores capture data for each point. At this time, the characteristic value calculation unit 11 calculates characteristic values for each capture point, and the determination unit 12 also performs determination for each capture point. As a result, when capturing data is acquired before and after the failure location, a difference is generated in the determination result for each point, so that the location of the failure can be easily identified.

  The network configuration information storage unit 15 stores the type of each device, topology information (information indicating to which device each device is connected), link bandwidth information, and the like. By referring to the configuration information storage unit 15, it is possible to grasp that there is a bandwidth control device or the like between the target devices (server and user terminal).

  The quality degradation cause estimation apparatus 10 in the present embodiment can be realized, for example, by causing one or a plurality of computers to execute a program describing the processing contents described in the present embodiment. That is, the function of each unit of the quality degradation cause estimation device 10 is a process performed by each unit using hardware resources such as a CPU, a memory, and a hard disk built in the computer constituting the quality degradation cause estimation device 10. This can be realized by executing a program corresponding to the above.

  Moreover, you may provide the quality degradation cause estimation program for functioning a computer as the characteristic value calculation part 11 and the estimation means 12 in the quality degradation cause estimation apparatus 10. FIG.

  The above-mentioned program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

(Operation example 1 of the quality degradation cause estimation device)
Hereinafter, the operation example 1 of the quality deterioration cause estimation device 10 having the above-described configuration will be described along the procedure illustrated in the flowchart of FIG. 3.

<Step 1: Specify analysis target>
The characteristic value calculation unit 11 of the quality degradation cause estimation device 10 receives the target time of quality degradation cause estimation and the target device (in this example, the server 1 and the user terminal 2 in FIG. 1) via the input / output unit 13. Receives input of information (IP address, MAC address, etc.).

<Step 2: Traffic flow calculation and determination>
The characteristic value calculation unit 11 first calculates the traffic flow between the user terminal 2 and the server 1 by identifying the input target time and data corresponding to the target device from the data in the capture data storage unit 14. . More specifically, the maximum value of the traffic flow rate within a predetermined time is calculated. Then, the determination unit 12 compares the calculated traffic flow rate with the contracted bandwidth of the user to determine whether the bandwidth is insufficient (normal) or not, and the result (band shortage, network cause, etc.) Is stored in the storage unit 121 such as a memory. In addition, you may display this determination result at this time. Similarly, in each of the following steps, the determination result in each step may be displayed at the time of each step.

  The calculation and determination of the traffic flow may be performed on each of the upstream (user terminal 2 → server 1) and downstream (server 1 → user terminal 2), or may be performed only on the downstream, for example. In addition, for example, the contracted bandwidth × 0.8 and the traffic flow rate are compared, and when the traffic flow rate is equal to or higher than the contracted bandwidth × 0.8, it can be determined that the bandwidth is insufficient. When the band is insufficient, the band is being squeezed.

<Step 3: RTT calculation and determination>
Next, the characteristic value calculation unit 11 uses the capture data to transmit an RTT between the target server 1 and the user terminal 2, more specifically, from the server 1 after transmitting a packet from the user terminal 2. RTT (Round Trip Time), which is the time until the response is returned, is calculated. A plurality of RTTs may be calculated, and the average value may be used as the calculated value.

  The determination unit 12 calculates the RTT theoretical value based on the network configuration information stored in the network configuration information storage unit 15 from the number of hops and the distance between the server 1 and the user terminal 2, and the theoretical value and the characteristic value described above. By comparing with the RTT calculated by the calculation unit 11, it is determined whether or not the RTT is larger than the theoretical value. The determination result is stored in the storage unit 121. The theoretical value of the RTT value may be a value measured in advance for each site.

  When the RTT becomes larger than the theoretical value, the cause is mainly a processing delay due to an inter-device distance or server overload.

  When the RTT is large, the jitter often increases. However, when the RTT is large, a problem is likely to occur in the user experience quality, etc. regardless of the magnitude of the jitter.

<Step 4: Packet loss calculation and determination>
Next, the characteristic value calculation unit 11 calculates the packet loss (specifically, the packet loss rate) between the server 1 and the user terminal 2 using the capture data. The determination unit 12 compares the packet loss rate with a predetermined threshold (for example, 0.1), determines that a packet loss that affects communication occurs if the packet loss rate is equal to or higher than the predetermined threshold, If it is less than the threshold, it is determined as normal. The determination result is stored in the storage unit 121. If there are a plurality of capture points, the packet loss on the upstream side (server side) and the packet loss on the downstream side (user terminal side) may be calculated and determined.

  The cause of packet loss that affects communication is a device failure, insufficient processing capability of the network device (CPU, memory size, etc.), incomplete physical connection, and the like. Packet loss occurs due to insufficient processing capacity of the network device. When traffic exceeding the processing capacity flows into the network device, the transfer of the received packet is abandoned according to the state of the CPU and memory, and the packet is discarded. Is to do.

<Step 5: Jitter calculation and determination>
Next, the characteristic value calculation unit 11 calculates jitter in communication between the user terminal 2 and the server 1 based on the capture data. Jitter is packet delay variation (that is, arrival interval variation). For example, the determination unit 12 compares the jitter value with a predetermined value to determine whether or not jitter that affects communication occurs, and stores the determination result in the storage unit 121.

  When the traffic flow rate approaches the processing performance limit of the network device (router or the like), jitter in packet transfer increases. That is, when jitter occurs, the cause is often the processing performance of the network device. In addition, when the degree of jitter becomes severe, it leads to packet loss.

<Step 6: Reorder width calculation and determination>
Next, the characteristic value calculation unit 11 calculates the average value of the reorder width of packets within a predetermined time in communication between the user terminal 2 and the server 1 using the capture data. The determination unit 12 compares the calculated reorder width with a predetermined threshold (eg, 3), and determines that packet reversal that affects communication has occurred (abnormal) if the reorder width is equal to or greater than the threshold. If the reorder width is less than the threshold, it is determined to be normal, and the determination result is stored in the storage unit 121.

  The reorder is the reversal of packets (order change). The ratio of reorders occurring within the specified time is the reorder rate, and the skipping width of a packet when a reorder occurs is called the reorder width. In the present embodiment, the reorder width is particularly used. For example, when the reorder width is 3 or more, a retransmission request is made, the window size is reduced, and the throughput is reduced.

  Note that although there is no packet loss, the quality may be deteriorated. In such a case, the reorder width may be large. In other words, even if it appears that there is no packet loss and the packet is transferred normally at first glance, it can be estimated that there is a problem on the network side by looking at the reorder width.

  Even if the reorder rate is high, if the RTT is short, the user experience quality often does not deteriorate. Therefore, in the present embodiment, RTT is calculated and determined first, and the reorder rate is not calculated. However, it may be determined to calculate the reorder rate and compare it with a predetermined threshold.

  The main cause of reordering is the order control by multiple paths. The plurality of paths include those due to redundancy of the network path, and cases where processing is performed using a plurality of CPUs in the network apparatus. Even if reordering occurs, packets are almost always delivered, so there are many cases where there is no problem with packet loss. However, when the reorder width is large, the processing load such as retransmission increases, so the user experience quality decreases. There are many.

<Step 7: Calculation and determination of session establishment rate>
Next, the characteristic value calculation unit 11 calculates the session establishment rate of the TCP session between the server 1 and the user terminal 2 using the capture data. The session establishment rate is a ratio of the number of sessions established in the total number of sessions established. In the determination, the session establishment rate may be replaced with a session establishment failure rate (= 100% −session establishment rate).

  Here, when a device (for example, a bandwidth control device or a firewall) that terminates a session exists between the server 1 and the user terminal 2, the session establishment may be revoked depending on setting conditions. Therefore, in the present embodiment, the determination unit 12 performs determination according to the procedure shown in FIG. 4 by grasping the presence / absence of a device that performs session termination from the network configuration information in the network configuration information storage unit 15.

  First, the determination unit 12 determines whether the session establishment failure rate exceeds a predetermined threshold (eg, 10%) (step 71). If not exceeded, it is determined that session establishment is normal (step 72). If the session establishment failure rate exceeds a predetermined threshold, the presence / absence of a device that terminates the session is confirmed (step 73). If there is a device, the session termination device may have a cause. It is determined that it is necessary to confirm the processing content (log) (step 74). If there is no session termination device, it is determined that there is a cause in the server 1 (step 75). The determination result is stored in the storage unit 121.

  Note that in the case of reaching step 74, if it can be confirmed that the operation for repelling the session is not performed as a result of confirming the log of the session termination device, it can be presumed that the cause is the server 1. In such a case, the FW setting of the server 1, the CPU load factor, etc. are confirmed.

<Step 8: Calculation and determination of window size>
Returning to FIG. 3, next, the characteristic value calculation unit 11 calculates a window size (maximum value within a predetermined time) from the capture data, and the determination unit 12 compares the threshold value with a predetermined threshold value to determine whether the characteristic value is normal or abnormal. Determine whether.

  When the server 1 is appropriately set, when the window size reaches the logical line bandwidth, congestion occurs and the window size decreases, but when the server 1 setting is not appropriate, Before reaching the line bandwidth, the window size is reduced or the window size itself is kept constant (not sawed). However, when a bandwidth control device exists between the server 1 and the user terminal 2, there is a case where control that does not increase the window size is performed and control that does not increase the throughput is performed. Therefore, in the present embodiment, determination is made according to the procedure shown in FIG. 5 by grasping the presence / absence of the bandwidth control device from the network configuration information in the network configuration information storage unit 15.

  First, the determination unit 12 determines whether or not the maximum value of the window size within a predetermined time has reached a predetermined threshold (corresponding to the above line bandwidth) (step 81). If it is equal to or greater than the predetermined threshold, it is determined that normal window size control is being performed (step 82).

  If the maximum value of the window size has not reached the predetermined threshold (Yes in Step 81), the presence / absence of the bandwidth control device is confirmed (Step 83). If there is a bandwidth control device, there is a possibility that the bandwidth control device has a cause. Therefore, it is determined that log confirmation of the bandwidth control device is necessary (step 84). If there is no bandwidth control device, it is determined that there is a cause in the setting or application of the server 1 (step 85). The determination result is stored in the storage unit 121.

  In the determination process, a window size change graph may be displayed to determine whether or not the user has a saw shape, and the normality may be determined in consideration of the determination result. .

  As a result of checking the log of the bandwidth control device when the above step 84 is reached, if it is found that the bandwidth control device is not intervening in the flow control, it can be estimated that the cause is on the server side.

<Step 9: Server response time calculation and determination>
Returning to FIG. 3, next, the characteristic value calculation unit 11 calculates the server response time (in this example, the maximum value within a predetermined time) using the capture data. The server response time is the time from when the server 1 receives a request until it returns a response. The determination unit 12 determines whether or not the server performance is normal by comparing the maximum value of the server response time with a predetermined threshold value. The determination result is stored in the storage unit 121.

  When the server response time is large, the cause is often insufficient server performance or application creation. When the server response time increases, the user experience quality decreases due to an increase in the response to the user request.

<Step 10: Output determination result>
Next, the input / output unit 13 outputs the determination result determined by the determination unit 12 and stored in the storage unit 121. In outputting the determination result, all of the normal result and the abnormal result may be output, or only the determination result that is not normal may be output. Moreover, the determination part 12 estimates that there exists a factor of quality degradation in the network side, when there exists an abnormal result in the at least 1 determination result of step 2-6 among said each determination, and steps 2-6 Is normal and there is an abnormal result in at least one of the determination results in steps 7 to 9, it is estimated that there is a factor of quality degradation on the server side, and all of steps 2 to 9 are normal May estimate that there is a factor of quality degradation on the user terminal side, and output the estimation result. Thereby, the user (network administrator) can quickly determine whether there is a factor in the network, a factor on the server side, or a factor on the user terminal side.

(Other examples)
In the above operation example 1, calculation and determination of characteristic values are performed for all characteristic values. The order of the calculation / determination basically has a relationship that if the determination result of the characteristic value in the first order is not good, the determination result in the subsequent order is likely not good. For example, when the line bandwidth is under pressure, the RTT also becomes longer, the packet loss and jitter also increase, the reorder with a large width is likely to occur, and the server response time calculated from the captured data becomes larger. . Although there are exceptions, in general, when the determination result of the characteristic value in the first order is not good, the determination result in the subsequent order is often poor.

  Therefore, the determination may be performed in order, and when the determination result is not normal, the analysis may be terminated and the determination result may be output. FIG. 6 shows an operation example (operation example 2) in that case. As shown in FIG. 6, for each calculation / determination of each characteristic value, if the determination result is not normal, the determination result is output without proceeding to the next characteristic value. The contents of calculation / determination of each characteristic value are as described above. Also in this case, as in the case of the operation example 1, it may be estimated and output where the cause is in the network / server / user terminal.

  Further, instead of calculating and determining each characteristic value, as shown in FIG. 7, first, all characteristic values are obtained and stored in a storage unit (the storage unit 121 or another storage area may be used). (Step 32) After that, determination on each characteristic value (Step 33) and determination result output (Step 34) may be performed.

  Regarding the output of the judgment result, it may be output in characters, such as “abnormal”, “normal”, “requires bandwidth control device log check”, etc., and the characteristic value is graphed in time series and the target It is also possible to output an image indicating that the threshold value is exceeded at the time, or an image indicating an apparatus requiring log confirmation.

  Also, for example, with respect to a certain application, a characteristic value (eg, RTT value) and quality (comfort value, use limit value) felt by an actual user are obtained in advance by experiments, and between the server and the user terminal at each point, The characteristic value based on the packet capture described above may be calculated and displayed on a screen as shown in FIG.

(Summary of the embodiment, effects, etc.)
As described above, according to the embodiment, a packet of communication flowing over the network is captured by passive monitoring, each characteristic value is calculated based on the captured data, and the user experience quality deterioration factor based on each characteristic value Therefore, the cause of quality degradation can be automatically estimated without collecting information directly from the server.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

DESCRIPTION OF SYMBOLS 1 Server 2 User terminal 3 Network 10 Quality degradation cause estimation apparatus 11 Characteristic value calculation part 12 Determination part 13 Input / output part 14 Capture data storage part 15 Network configuration information storage part 121 Storage part

Claims (8)

A quality degradation cause estimation device that estimates a cause of communication quality degradation between at least two devices in a communication network,
Capture data storage means for storing capture data acquired by capturing packets related to communication between the devices from the communication network;
Characteristic value calculation means for calculating at least a packet reorder width as a characteristic value related to communication between the devices from the capture data;
By determining the normality of the characteristic value, an estimation means for estimating a location that causes a deterioration in communication quality between the devices;
An output means for outputting an estimation result obtained by the estimation means. The two devices are a user terminal and a server that provides an application service to the user terminal, and the location is the user terminal, the server, or a communication network that connects the user terminal and the server. The quality degradation cause estimation apparatus according to claim 1, wherein: The estimating means compares the reorder width with a predetermined threshold value, and determines that the location causing the quality degradation is in the communication network when the reorder width is equal to or larger than the predetermined threshold value. The quality degradation cause estimation apparatus according to claim 2. The characteristic value calculation means calculates a traffic flow rate, RTT, packet loss, jitter, session establishment rate, window size, and server response time in addition to the reorder width as characteristic values related to communication between the devices. The quality deterioration cause estimation device according to claim 1, wherein The estimation means performs normality determination in the order of traffic flow rate, RTT, packet loss, jitter, reorder, session establishment rate, window size, and server response time, and when an abnormal determination result is obtained, The quality degradation cause estimation apparatus according to claim 4, wherein the output unit outputs a determination result. The quality degradation cause estimation device includes network configuration information storage means for storing network configuration information of the communication network,
When the estimation means determines the session establishment rate or the normality of the window size, the estimation means refers to the network configuration information to determine whether there is a predetermined device between the two devices in the communication network. The quality degradation cause estimation device according to claim 4, wherein the determination is made based on whether or not the predetermined device is present. A quality degradation cause estimation method executed by a quality degradation cause estimation device for estimating a quality degradation cause of communication between at least two devices in a communication network,
The quality degradation cause estimation device includes capture data storage means for storing capture data acquired by capturing a packet related to communication between the devices from the communication network,
A characteristic value calculation step for calculating at least a packet reorder width as a characteristic value related to communication between the devices from the capture data;
An estimation step for estimating a location that causes quality degradation of communication between the devices by determining normality of the characteristic value;
An output step for outputting an estimation result obtained by the estimation step.   A quality deterioration cause estimation program for causing a computer to function as the characteristic value calculation means and the estimation means in the quality deterioration cause estimation device according to any one of claims 1 to 6.