JP2020057908A - Communication failure analysis device, system, method, and program - Google Patents

Abstract

To easily detect the occurrence of a failure and identify the location of a failure when a system is divided into multiple management areas.SOLUTION: Packet information including information on the source and destination of a packet passing through a first communication device that is connected to a second communication device existing in a second range, and that exists in a first range different from the second range is acquired from the first communication device, and is stored in a packet information storage unit, and for each of a transmission source device that is the transmission source second communication device and a transmission destination device that is the transmission destination second communication device, whether a failure location is a first range or a second range is estimated, and the estimation result is output on the basis of whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination passes through the first communication device existing between the pair of the transmission source device and the transmission destination device.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a communication failure analysis device, system, method, and program.

  An example of a method for specifying a failure occurrence point on a network is described in Patent Document 1. In this method, each information processing device in the network outputs a log to the user terminal before and after execution of the process, and the user terminal specifies a failure occurrence location based on the log.

Japanese Patent No. 5869513

  However, the method described in Patent Document 1 is based on the premise that the user terminal can collect logs from all devices in the network. Therefore, when there is a range where logs cannot be collected in the network, it is difficult for the user terminal to detect a fault that has occurred in a range where logs cannot be collected and to specify a fault occurrence location.

  For example, when the management range of the service provider and the tenant (user) are different, such as IaaS (Infrastructure as a Service), the business entity is the information of the tenant, and the tenant is the information processing of the management range of the enterprise. Device logs cannot be collected. Therefore, it is difficult for the business operator to detect a failure that has occurred within the management range of the tenant. Further, even if the tenant detects that a communication failure has occurred due to the inability to communicate, it is difficult to determine whether the failure has occurred in the management range of the tenant or the business entity.

  An object of the present invention is to provide a communication failure analysis device, system, method, and program that enables easy detection of a failure and identification of a failure location when the system is divided into a plurality of management ranges. To provide.

  In order to solve the above-described problem, in one embodiment of the present invention, a communication failure analysis device is connected to a second communication device existing in a second range, and is different from the second range. From a first communication device existing in one range, obtain packet information including information on a source and a destination of the packet of the packet passing through the first communication device, and store the packet information in the packet information. The packet information acquisition unit to be stored in the unit, for each of the set of the transmission source device is the second communication device of the transmission source and the destination device is the second communication device of the transmission destination, the transmission source device, A failure occurs in the first communication device existing between the pair of destination devices based on whether or not the packet having the source device as the source and the destination device as the destination has passed. The location is in the first range or before To estimate the second range, characterized in that it comprises an analyzing unit for outputting the estimation result.

  In another embodiment of the present invention, the communication failure analysis method is connected to a second communication device existing in a second range, and exists in a first range different from the second range. From the first communication device, obtain packet information including information on the transmission source and the transmission destination of the packet of the packet passing through the first communication device, and obtain the transmission source which is the second communication device of the transmission source. For each set of a destination device that is a device and the second communication device of the destination, the first communication device existing between the set of the source device and the destination device, the source device Based on whether or not the packet having the transmission source and the transmission destination device as the transmission destination has passed, the failure occurrence location is estimated to be the first range or the second range, and the estimation result is output. It is characterized by the following.

  In another embodiment of the present invention, a communication failure analysis program is connected to a computer, a second communication device existing in a second range, and a first range different from the second range. From the first communication device existing in the first communication device, the packet information including the information of the source and destination of the packet of the packet passing through the first communication device, and stores the packet information in the packet information storage unit Packet information acquisition function to be performed, and for each of a set of a transmission source device that is the second communication device of the transmission source and a destination device that is the second communication device of the transmission destination, the transmission source device and the transmission destination The first communication device that exists between a set of devices, based on whether or not the packet having the source device as the source and the destination device as the destination has passed, the fault occurrence location is the First range Estimating whether said second range, characterized in that to realize an analysis function of outputting the estimation result.

  The communication failure analysis device, system, method, and program according to the present invention facilitate detection of a failure and identification of a failure location when the system is divided into a plurality of management ranges.

It is a figure showing the example of composition of the communication failure analysis device of a first embodiment of the present invention. FIG. 7 is a diagram illustrating an operation example of the communication failure analysis device according to the first to third embodiments of the present invention. It is a figure showing the example of composition of the communication failure analysis system of a second embodiment of the present invention. It is a figure showing the example of composition of the communication failure analysis system of a second embodiment of the present invention. It is a figure showing the example of composition of the communication fault analysis device of the 2nd and 3rd embodiments of the present invention. It is a figure showing the example of the definition information of a 2nd and 3rd embodiment of the present invention. It is a figure showing an example of packet information of a 2nd and 3rd embodiment of the present invention. It is a figure showing an example of an estimation method of a 2nd and 3rd embodiment of the present invention. It is a figure showing an example of an estimation result of a 2nd and 3rd embodiment of the present invention. It is a figure showing the example of operation of the communication failure analysis device of a 2nd and 3rd embodiment of the present invention. It is a figure showing the example of composition of the communication failure analysis system of a 2nd and 3rd embodiment of the present invention. It is a figure showing the example of composition of the communication failure analysis system of a third embodiment of the present invention. It is a figure showing the example of composition of the communication failure analysis system of a third embodiment of the present invention. FIG. 14 is a diagram illustrating an example of a set of a transmission source device and a transmission destination device in the communication failure analysis system according to the third embodiment of the present invention. It is a figure showing an example of an estimation method of a communication fault analysis device of a third embodiment of the present invention. FIG. 3 is a diagram illustrating a hardware configuration example of each embodiment of the present invention.

[First embodiment]
A first embodiment of the present invention will be described.

  FIG. 1 shows a configuration example of a communication failure analysis device 10 of the present embodiment. The communication failure analysis device 10 according to the present embodiment includes a packet information acquisition unit 11, a packet information storage unit 12, and an analysis unit 13.

  The packet information acquisition unit 11 is connected to the second communication device existing in the second range, and performs the first communication from the first communication device existing in the first range different from the second range. Obtains packet information of packets passing through the device. Then, the packet information acquisition unit 11 stores the packet information in the packet information storage unit. The packet information includes information on the transmission source and the transmission destination of the packet.

  The analysis unit 13 is configured such that, for each pair of the transmission source device that is the transmission source second communication device and the transmission destination device that is the transmission destination second communication device, the failure location is in the first range or the second range. Estimate the range and output the estimation result. At this time, the analysis unit 13 determines whether or not a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device existing between the pair of the transmission source device and the transmission destination device. Based on this, it is estimated whether the failure location is the first range or the second range.

  By configuring the communication failure analysis device 10 in this manner, the communication failure analysis device 10 is connected to the second communication device existing in the second range, and is connected to the first communication device existing in the first range. From the device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 10 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 10 detects occurrence of a failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  Next, FIG. 2 shows an example of the operation of the communication failure analysis device 10 of the present embodiment.

  The packet information acquisition unit 11 is connected to the second communication device existing in the second range, and performs the first communication from the first communication device existing in the first range different from the second range. Obtains packet information of packets passing through the device. Then, the packet information acquisition unit 11 stores the packet information in the packet information storage unit (Step S101).

  The analysis unit 13 is configured such that, for each pair of the transmission source device that is the transmission source second communication device and the transmission destination device that is the transmission destination second communication device, the failure location is in the first range or the second range. The range is estimated (step S102), and the estimation result is output (step S103). At this time, the analysis unit 13 determines whether or not a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device existing between the pair of the transmission source device and the transmission destination device. Based on this, it is estimated whether the failure location is the first range or the second range.

  By operating in this manner, the communication failure analysis device 10 is connected to the second communication device existing in the second range, and receives the first communication device from the first communication device existing in the first range. Obtain packet information of a packet passing through the communication device. Then, the communication failure analysis device 10 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  As described above, in the first embodiment of the present invention, the communication failure analysis device 10 is connected to the second communication device existing in the second range, and is connected to the second communication device existing in the first range. From one communication device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 10 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 10 detects occurrence of a failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

[Second embodiment]
Next, a second embodiment of the present invention will be described. In the present embodiment, the communication failure analysis device 20 will be described more specifically.

  First, FIG. 3 shows a configuration example of the communication failure analysis system of the present embodiment. The communication failure analysis system of the present embodiment includes a communication failure analysis device 20, a network device group 50, a first communication device 70 (70-1, 70-2), and a second communication device 80 (80-1, 80- 2).

  The communication failure analysis device 20, the first communication device 70, and the network device group 50 are devices existing in the first range. The first range is, for example, a management range of the first administrator.

  The second communication device 80 is a device that exists in a second range different from the first range. The first communication device 70-1 connects to the second communication device 80-1, and the first communication device 70-2 connects to the second communication device 80-2. The second range is, for example, a management range of the second administrator.

  The first administrator in the first range and the second administrator in the second range may be different or the same. For example, the same administrator may divide and manage the system into a first range and a second range. It should be noted that a log (information on the occurrence of a failure) of a device existing in the second range is obtained from a device existing in the first range, and a device existing in the first range is obtained from a device existing in the second range. Log cannot be directly checked.

  The first communication device 70 is a device connected to the second communication device 80 and existing in the first range. That is, the first communication device 70 is a device that exists in the first range and exists at the boundary between the first range and the second range.

  The communication failure analysis device 20 exists in a first range. Therefore, the log of the second communication device 80 existing in the second range cannot be confirmed.

  One or more second communication devices 80 can be connected to one first communication device 70. Further, a state where no second communication device 80 is connected to the first communication device 70 is also possible. Also, one or more first communication devices 70 and two or more second communication devices 80 can exist in the communication failure analysis system.

  Next, FIG. 4 shows a configuration example of a communication failure analysis system when the communication failure analysis device 20 of the present embodiment is applied to a virtual environment.

  In this example, the operator manages the communication failure analysis device 20, the network device group 50, and the virtual switches 71 (71-1, 71-2). The business corresponds to the manager in the first range in FIG. Also, the tenant manages the virtual server 81 (81-1, 81-2). The tenant corresponds to the administrator in the second range in FIG. The virtual switch 71 corresponds to the first communication device 70 in FIG. 3, and the virtual server 81 corresponds to the second communication device 80 in FIG. The virtual switch 71 and the virtual server 81 are configured in the host server 60.

  Note that one or more virtual servers 81 can be connected to one virtual switch 71. Further, a state in which no virtual server 81 is connected to the virtual switch 71 is also possible. Further, one or more virtual switches 71 and two or more virtual servers 81 can exist in the system. Also, one or more host servers 60 can exist in the system, and one host server 60 can have one or more virtual switches 71.

  Next, FIG. 5 shows a configuration example of the communication failure analysis device 20 of the present embodiment. The communication failure analysis device 20 of the present embodiment differs from the communication failure analysis device 10 (FIG. 1) of the first embodiment in that a definition information registration unit 24, a definition information storage unit 25, a setting unit 26, an estimation result storage unit 27, This is a configuration in which an output unit 28 is added. Here, description will be made using the example of the system configuration in FIG.

  The definition information registration unit 24 causes the definition information storage unit 25 to store the definition information. The definition information storage unit 25 stores definition information. The definition information includes a tenant identifier that specifies a tenant who is the administrator of the second range, in the case of the present embodiment, the second range. The definition information includes information of the virtual server 81 managed by the tenant, for example, identification information of the virtual server 81, identification information of the virtual NIC (Network Interface Card), MAC (Media Access Control) address of the virtual NIC, and IP (Internet). Protocol) information such as an address and a subnet mask may be included. Hereinafter, for simplicity, the MAC address of the virtual NIC of the virtual server 81 is referred to as the MAC address of the virtual server 81.

  When there is a service provision request from the tenant, the business operator determines a tenant identifier that specifies the requesting tenant. Then, the business entity causes the definition information storage unit 25 to store the definition information (tenant identifier) via the definition information registration unit 24.

  Further, the business operator creates the virtual server 81 according to a request from the tenant. At this time, the provider creates a virtual server 81 in the host server 60 including the tenant identifier in the MAC address. Further, the business entity stores the created MAC address of the virtual server 81 in the definition information storage unit 25.

  FIG. 6 shows an example of the definition information stored in the definition information storage unit 25. In this example, the definition information storage unit 25 stores “AAAAAAA” as the tenant identifier of the tenant A. Further, the definition information storage unit 25 stores information on two virtual servers 81 managed by tenant A. The information of the virtual server 81-1 having the identification information “VM1” includes the identification information “VM1-NIC1” of the virtual NIC, the MAC address “AA: AA: AA: 00: 00: 01”, and the IP address “192.168”. ..1.1 "and the subnet mask" 24 ". Thus, the virtual server 81 managed by tenant A includes the tenant identifier “AAAAAAA” in its MAC address.

  The setting unit 26 sets the packet information acquisition unit 11 regarding the conditions of the packet for acquiring the packet information. The setting unit 26 sets the packet information acquisition unit 11 to acquire the packet information of the packet including the tenant identifier stored in the definition information storage unit 25 in the transmission source MAC address or the transmission destination MAC address.

  The packet information acquisition unit 11 acquires, from the virtual switch 71 in the system, packet information of a packet that includes the tenant identifier in the source MAC address or the destination MAC address among the packets passing through the virtual switch 71. Then, the packet information acquisition unit 11 causes the packet information storage unit 12 to store the packet information.

  The setting unit 26 sets the packet information obtaining unit so that the MAC address stored in the definition information storage unit 25 obtains the packet information of the packet whose MAC address is the source MAC address or the destination MAC. 11 may be set.

  However, in this case, as the number of virtual servers 81 in the system increases, the number of packet conditions for acquiring packet information, which is set in the packet information acquisition unit 11, increases. Each time a virtual server 81 is added to the system, the setting unit 26 needs to change the settings of the packet information acquisition unit 11.

  Therefore, in the present embodiment, the administrator creates the virtual server 81 including the tenant identifier in the MAC address, and the packet information acquisition unit 11 performs the packet information processing on the packet including the tenant identifier in the transmission source MAC address or the transmission destination MAC address. To get. Accordingly, the number of packet conditions for acquiring packet information, which is set in the packet information acquisition unit 11, can be reduced to the number of tenants. No need to change settings.

  Note that the packet information includes information on the source IP address, destination IP address, source MAC address, and destination MAC address of the packet. Further, the packet information may include information such as a time, a protocol, a sequence number (in the case of Transmission Control Protocol (TCP)), a source port number, and a destination port number.

  FIG. 7 shows an example of packet information stored in the packet information storage unit 12. In this example, packet information is stored for each of the virtual switch 71-1 and the virtual switch 71-2. The stored packet information includes time, protocol, sequence number, source MAC address, IP address, port number, destination MAC address, IP address, and port number. As described above, the definition information storage unit 25 stores the packet information of the packet related to the virtual server 81 including the tenant identifier in the MAC address.

  FIG. 7 shows the packet information of the packet in the direction from the virtual server 81-1 to the virtual server 81-2. However, when a packet in the opposite direction has passed through the virtual switch 71, the packet information acquisition unit 11 causes the definition information storage unit 25 to store the packet information of the packet as well.

  The analysis unit 13 determines whether the failure location is the management range (first range) of the business entity for each set of the transmission source virtual server 81 (transmission source device) and the transmission destination virtual server 81 (transmission destination device). , The device (virtual server 81) within the management range of the tenant. Then, the analysis unit 13 outputs the estimation result to the estimation result storage unit 27. The estimation result storage unit 27 stores the estimation result.

  At this time, the analysis unit 13 determines whether or not a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the virtual switch 71 existing between the pair of the transmission source device and the transmission destination device. Based on this, it is estimated whether the failure location is the management range of the business operator or the management range of the tenant.

  In FIG. 4, the virtual switches 71 existing between the virtual server 81-1 and the virtual server 81-2 are a virtual switch 71-1 and a virtual switch 71-2. Therefore, the analysis unit 13 estimates the location of the failure based on the packet information of the packet that has passed through the virtual switch 71-1 and the virtual switch 71-2.

  In addition, in the case of the system configuration of FIG. 4, the source device and the destination device include a virtual server 81-1 as the source device, a virtual server 81-2 as the destination device, and the source device and the destination device. There could be two sets of inverted tip devices. The analysis unit 13 estimates a failure occurrence location for each of the two sets based on whether or not a packet having the transmission source as the transmission source device and the transmission destination as the transmission destination device has passed.

  FIG. 8 shows an example of a method of estimating a failure occurrence location. This example is an example of an estimation method in a case where two virtual switches 71 exist between a transmission source device and a transmission destination device.

  Pattern 1 is a pattern in which a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has not reached the virtual switch 71 connected to the transmission source virtual server 81. In the case of the pattern 1, since the packet has not reached the virtual switch 71 connected to the transmission source virtual server 81, the analysis unit 13 can estimate that the transmission source virtual server 81 is a failure occurrence point. In this case, the failure location is within the management range of the tenant.

  Note that the analysis unit 13 can determine the virtual server 81 that is the source of each packet based on the source IP address. In addition, the analysis unit 13 can determine the destination virtual server 81 of each packet based on the destination IP address. The IP address of each virtual server 81 is stored in the definition information storage unit 25. In addition, the analysis unit 13 can determine that the packet has not reached the virtual switch 71 by determining that the packet has not arrived for a predetermined time.

  In pattern 2, a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination reaches the virtual switch 71 connected to the transmission source device, but reaches the virtual switch 71 connected to the transmission destination device. Not a pattern. In the case of pattern 2, since the packet has arrived at the virtual switch 71 connected to the transmission source device, the analysis unit 13 can estimate that the network device group 50 is the location where the failure has occurred. In this case, the failure location is within the management range of the business operator.

  Since the communication failure analysis device 20 can communicate with the virtual switch 71, the failure of the virtual switch 71 can be directly detected. Therefore, it is assumed that no failure has occurred in the virtual switch 71 at the time when the analysis unit 13 estimates the location where the failure has occurred.

  Whether or not the packets that have passed through the two virtual switches 71 are the same can be determined by checking whether the tenant identifier, time, protocol, sequence number, IP address, and port number included in the MAC address match. .

  Pattern 3 is a pattern in which a packet having a transmission source device as a transmission source and a transmission destination device as a transmission destination is passing through both virtual switches 71. In the case of pattern 3, since the packet has arrived at the virtual switch 71 connected to the destination virtual server 81, the analysis unit 13 determines that the destination device is the location where the failure has occurred, or that no failure has occurred. It can be estimated. In this case, when a failure occurs, the failure location is within the management range of the tenant.

  FIG. 9 shows an example of the estimation result stored in the estimation result storage unit 27.

  In this example, the estimation result storage unit 27 stores the tenant identifier, time, protocol, destination port number, source virtual server identification information, destination virtual server identification information, pattern, fault location, management I remember the range.

  In FIG. 7, the packet at time “1/1 00:00:00” passes through the virtual switch 71-1 but does not pass through the virtual switch 71-2. For this reason, the analyzing unit 13 estimates that the pattern 2, that is, the failure location is the network device group 50, based on FIG. Then, the estimation result is stored in the estimation result storage unit 27. Note that the analysis unit 13 can specify the identification information of the transmission source and destination virtual servers based on the definition information (FIG. 6) stored in the definition information storage unit 25.

  Also, in FIG. 7, the packets at time “1/1 00:10:00” and time “1/1 00:20:00” pass through both the virtual switch 71-1 and the virtual switch 71-2. I have. Therefore, the analysis unit 13 estimates that the pattern is Pattern 3, and stores the estimation result in the estimation result storage unit 27.

  The output unit 28 outputs the estimation result stored in the estimation result storage unit 27. The output destination is, for example, a display unit of the communication failure analysis device 20, a display unit of a management terminal of a business or a tenant, or the like. The output unit 28 can also transmit the estimation result to the administrator by e-mail or the like.

  In the estimation method described above, the analysis unit 13 estimates a failure occurrence location for each packet. Therefore, there is a possibility of erroneous detection. In order to reduce false detections, for example, the analysis unit 13 aggregates the pattern of the failure location estimated for each packet for a predetermined period, and determines the pattern estimated most frequently during the predetermined period. It is good.

  When the protocol is TCP, whether or not a failure has occurred in the destination virtual server 81 can be estimated based on whether or not an ACK (acknowledgment) packet has been transmitted. When no failure has occurred, the destination virtual server 81 transmits an ACK packet for the received packet. Therefore, when the ACK packet having the same sequence number passes through the virtual switch 71 in the pattern 3 of FIG. 8, the analysis unit 13 can estimate that no failure has occurred.

  By configuring the communication failure analysis device 20 in this manner, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and is connected to the first communication device existing in the first range. From the device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 20 detects the occurrence of the failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  Further, in the present embodiment, the administrator creates a virtual server 81 (second communication device 80) including the tenant identifier in the MAC address. Further, the communication failure analysis device 20 acquires packet information of a packet including the tenant identifier in the source MAC address or the destination MAC address. Accordingly, the communication failure analysis device 20 can reduce the number of packet conditions for acquiring packet information, which is set in the packet information acquisition unit 11, to the number of tenants. Further, it is not necessary to change the setting of the packet information acquisition unit 11 when adding the virtual server 81 (second communication device 80).

  Next, an operation example of the communication failure analysis device 20 of the present embodiment will be described with reference to FIGS. FIG. 10 is an operation example when registering a new tenant.

  First, the business entity receives an application from tenant A, and pays out tenant identifier “AAAAAAA” to tenant A. Then, the business entity causes the definition information storage unit 25 to store the tenant identifier via the definition information registration unit 24 of the communication failure analysis device 20 (Step S201). At this point, the system configuration for tenant A is as shown in FIG.

  In response to the registration of the tenant identifier, the setting unit 26 of the communication failure analysis device 20 sets a packet condition for acquiring packet information in the packet information acquisition unit 11 (step S202). Specifically, the setting unit 26 instructs the packet information acquisition unit 11 to acquire packet information of a packet in which the first 24 bits of the source MAC address or the destination MAC address match the tenant identifier “AAAAAAA”. Set.

  Further, in response to a request from the tenant, the business operator creates a virtual server 81 in the host server 60 that includes the tenant identifier “AAAAAAA” in the MAC address (step S208). At this time, when the business operator creates the virtual server 81-1 in the host server 60-1 and the virtual server 81-2 in the host server 60-2, the system configuration is as shown in FIG. Note that the business operator can create the virtual server 81 by instructing the host server 60 using a management terminal or the like.

  Further, the business entity stores the created information of the virtual server 81 in the definition information storage unit 25 via the definition information registration unit 24 (step S204). At this time, the definition information stored in the definition information storage unit 25 is as shown in FIG.

  Next, the packet information acquisition unit 11 acquires packet information of the packet including the tenant identifier “AAAAAAA” in the first 24 bits of the source MAC address or the destination MAC address from the virtual switch 71-1 and the virtual switch 71-2. I do. Then, the packet information acquisition unit 11 stores the packet information in the packet information storage unit 12 (Step S101 in FIG. 2).

  Next, based on the packet information in the packet information storage unit 12, the analysis unit 13 estimates whether the failure location is the management range of the business operator or the management range of the tenant (step S102). The analysis unit 13 performs the analysis of FIG. 8, for example, based on the packet information of FIG. Then, the analysis unit 13 outputs and stores the estimation result to the estimation result storage unit 27 (Step S103). Thus, the estimation result as shown in FIG. 9 is stored in the estimation result storage unit 27.

  7 and 9 show packet information and an estimation result when the virtual server 81-1 is the transmission source and the virtual server 81-2 is the transmission destination. When the packet also passes in the reverse direction, the packet information acquired by the packet information acquisition unit 11 includes packet information in which the virtual server 81-2 is the transmission source and the virtual server 81-1 is the transmission destination. Then, the analysis unit 13 analyzes the packet information in which the virtual server 81-2 is the transmission source and the virtual server 81-1 is the transmission destination by the estimation method in FIG. Further, the estimation result includes packet information in which the virtual server 81-2 is the transmission source and the virtual server 81-1 is the transmission destination.

  Then, the output unit 28 outputs the estimation result stored in the estimation result storage unit 27 at an arbitrary timing.

  For example, as a result of the analysis of the analysis unit 13, when it is estimated that the pattern 2 is the pattern 2 in FIG. 8, it is highly likely that somewhere in the network device group 50 has lost or filtered the packet. Notify the failure to the management terminal of the company.

  Further, when the tenant detects a failure due to a situation such as a communication failure, the tenant management terminal requests the output unit 28 of the communication failure analysis device 20 for an estimation result, and the tenant identifier of the requesting tenant is The output unit 28 can return the estimation result.

  After that, even when tenant A adds the virtual server 81 to the host server 60, the setting unit 26 does not need to change the condition of the packet from which the packet information acquisition unit 11 acquires the packet information. The packet information acquisition unit 11 acquires the packet information of the packet including the tenant identifier “AAAAAAA” in the source MAC address or the destination MAC address in the same manner as before the addition of the virtual server 81.

  By operating in this manner, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and from the first communication device existing in the first range, Obtain packet information of a packet passing through the communication device. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  As described above, in the second embodiment of the present invention, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and is connected to the second communication device existing in the first range. From one communication device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 20 detects the occurrence of the failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  Further, in the present embodiment, the administrator creates a virtual server 81 (second communication device 80) including the tenant identifier in the MAC address. Further, the communication failure analysis device 20 acquires packet information of a packet including the tenant identifier in the source MAC address or the destination MAC address. Accordingly, the communication failure analysis device 20 can reduce the number of packet conditions for acquiring packet information, which is set in the packet information acquisition unit 11, to the number of tenants. Further, it is not necessary to change the setting of the packet information acquisition unit 11 when adding the virtual server 81 (second communication device 80).

[Third embodiment]
Next, a third embodiment of the present invention will be described. In the present embodiment, a case where a plurality of second communication devices 80 (virtual servers 81) are connected to one first communication device 70 (virtual switch 71) will be described.

  First, FIG. 12 shows a configuration example of the communication failure analysis system of the present embodiment. The first communication device 70-1 has the second communication device 80-1 and the second communication device 80-3, and the first communication device 70-2 has the second communication device 80-2 and the second communication device. 80-4 are connected.

  FIG. 13 shows a configuration example of a communication failure analysis system when the first communication device 70 is a virtual switch 71 and the second communication device 80 is a virtual server 81. The virtual server 81-1 and the virtual server 81-3 are connected to the virtual switch 71-1. The virtual server 81-2 and the virtual server 81-4 are connected to the virtual switch 71-2. Hereinafter, description will be made based on the configuration example of FIG.

  Next, a configuration example of the communication failure analysis device 20 of the present embodiment will be described. The configuration example of the communication failure analysis device 20 of the present embodiment is the same as that of the second embodiment (FIG. 5).

  When the communication failure analysis system has the configuration of FIG. 13, there are twelve types of combinations of the transmission source device and the transmission destination device shown in FIG. 14. Of these packets, the analysis unit 13 estimates the failure occurrence location of the packets of the set numbers 1, 3, 4, 5, 8, 9, 10, and 12 by the estimation method of FIG. 8 as in the second embodiment. can do.

  For the packets of the set numbers 2, 6, 7, and 11, one virtual switch 71 exists between the transmission source device and the transmission destination device. Therefore, the analysis unit 13 estimates the location of the failure based on whether or not the packet has passed through the virtual switch 71 existing between the transmission source device and the transmission destination device.

  FIG. 15 shows an example of an estimation method in the analysis unit 13 when there is one virtual switch 71 between the source device and the destination device.

  Pattern 1 is a case where a packet having a transmission source device as a transmission source and a transmission destination device as a transmission destination does not pass through the virtual switch 71 existing between the transmission source device and the transmission destination device. In this case, since the packet has not reached the virtual switch 71, the analysis unit 13 estimates that the failure location is the virtual server 81 of the transmission source. In this case, the management range of the failure location is the tenant.

  Pattern 2 is a case where a packet having the transmission source as the transmission source and the transmission destination as the transmission destination is transmitted through the virtual switch 71 existing between the transmission source device and the transmission destination device. In this case, since the packet has reached the virtual switch 71, the analysis unit 13 estimates that the failure location is the virtual server 81 of the transmission destination or that no failure has occurred. In this case, the management range of the failure location is the tenant.

  As described above, even when the number of virtual switches 71 existing between the transmission source device and the transmission destination device is one, the analysis unit 13 can estimate a failure occurrence location as shown in FIG.

  The other parts are the same as in the second embodiment, and a description thereof will be omitted.

  By configuring the communication failure analysis device 20 in this manner, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and is connected to the first communication device existing in the first range. From the device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 20 detects the occurrence of the failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  Further, the communication failure analysis device 20 according to the present embodiment is configured such that, for each pair of the transmission source device and the transmission destination device, a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination passes through the first communication device. Based on whether or not the failure has occurred, it is estimated whether the failure location is the first range or the second range. Therefore, even when the number of the first communication devices 70 existing between the transmission source device and the transmission destination device is one, it is possible to estimate a failure occurrence location.

  Next, an operation example of the communication failure analysis device 20 of the present embodiment will be described.

  An operation example of the communication failure analysis device 20 of the present embodiment is substantially the same as that of the second embodiment.

  In step S101 in FIG. 2, the packet information acquisition unit 11 acquires packet information of a packet including a tenant identifier in a transmission source MAC address or a transmission destination MAC address. As a result, the estimation result storage unit 27 stores packet information of packets that have passed through the virtual switch 71 existing between the transmission source device and the transmission destination device, out of the twelve types of sets in FIG.

  In step S102 in FIG. 2, the analysis unit 13 performs the analysis in FIG. 8 or FIG. 15 for each of the twelve types of sets in FIG.

  Other operations are the same as in the second embodiment, and a description thereof will not be repeated.

  By operating in this manner, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and from the first communication device existing in the first range, Obtain packet information of a packet passing through the communication device. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  As described above, in the third embodiment of the present invention, the communication failure analysis device 20 is connected to the second communication device existing in the second range, and is connected to the second communication device existing in the first range. From one communication device, packet information of a packet passing through the first communication device is obtained. Then, the communication failure analysis device 20 determines, for each pair of the transmission source device and the transmission destination device, whether a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination has passed through the first communication device. It is estimated whether the failure location is the first range or the second range based on the. Thereby, the communication failure analysis device 20 detects the occurrence of the failure of the second communication device existing in the second range based on the packet information of the packet passing through the first communication device existing in the first range. It is possible to improve the possibility of being able to do so. Further, the administrator of the second range can know whether the failure location is the first range or the second range by referring to the estimation result. Therefore, when the system is divided into a plurality of management ranges, it is possible to easily detect a failure occurrence and specify a failure occurrence location.

  Further, the communication failure analysis device 20 according to the present embodiment is configured such that, for each pair of the transmission source device and the transmission destination device, a packet having the transmission source device as the transmission source and the transmission destination device as the transmission destination passes through the first communication device. Based on whether or not the failure has occurred, it is estimated whether the failure location is the first range or the second range. Therefore, even when the number of the first communication devices 70 existing between the transmission source device and the transmission destination device is one, it is possible to estimate a failure occurrence location.

[Example of hardware configuration]
A configuration example of hardware resources that realizes the communication failure analysis device (10, 20) in each embodiment of the present invention using one information processing device (computer) will be described. The communication failure analysis device may be realized physically or functionally using at least two information processing devices. Further, the communication failure analysis device may be realized as a dedicated device. Further, only a part of the functions of the communication failure analysis device may be realized using the information processing device.

  FIG. 16 is a diagram schematically illustrating a hardware configuration example of an information processing device capable of realizing the communication failure analysis device according to each embodiment of the present invention. The information processing device 90 includes a communication interface 91, an input / output interface 92, a computing device 93, a storage device 94, a nonvolatile storage device 95, and a drive device 96.

  The communication interface 91 is communication means for the communication failure analysis device of each embodiment to communicate with an external device by wire or / and wirelessly. When the communication failure analysis device is realized using at least two information processing devices, the devices may be connected so as to be able to communicate with each other via the communication interface 91.

  The input / output interface 92 is a man-machine interface such as a keyboard as an example of an input device and a display as an output device.

  The arithmetic unit 93 is an arithmetic processing unit such as a general-purpose CPU (Central Processing Unit) or a microprocessor. The arithmetic unit 93 can read various programs stored in the non-volatile storage device 95 into the storage device 94 and execute processing according to the read programs.

  The storage device 94 is a memory device such as a RAM (Random Access Memory) that can be referred to by the arithmetic device 93, and stores programs, various data, and the like. The storage device 94 may be a volatile memory device.

  The non-volatile storage device 95 is a non-volatile storage device such as a ROM (Read Only Memory) and a flash memory, for example, and can store various programs and data.

  The drive device 96 is, for example, a device that processes reading and writing of data from and to a recording medium 97 described later.

  The recording medium 97 is any recording medium that can record data, such as an optical disk, a magneto-optical disk, and a semiconductor flash memory.

  In each embodiment of the present invention, for example, a communication failure analysis device is configured by the information processing device 90 illustrated in FIG. 16, and a program capable of realizing the functions described in each of the above embodiments is provided to the communication failure analysis device. May be realized by supplying

  In this case, the embodiment can be realized by the arithmetic device 93 executing the program supplied to the communication failure analysis device. It is also possible for the information processing device 90 to configure some, but not all, of the communication failure analysis devices.

  Further, the program may be recorded on the recording medium 97, and the program may be stored in the non-volatile storage device 95 at the shipping stage or the operating stage of the communication failure analysis device as appropriate. In this case, as a method for supplying the program, a method of installing the program in the communication failure analyzer using an appropriate jig at a manufacturing stage or an operation stage before shipping may be adopted. In addition, a general procedure such as a method of externally downloading the program via a communication line such as the Internet may be adopted as a method for supplying the program.

  Each of the above-described embodiments is a preferred embodiment of the present invention, and various modifications can be made without departing from the spirit of the present invention.

  Some or all of the above embodiments can be described as in the following supplementary notes, but are not limited to the following.

(Appendix 1)
A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. A packet information acquisition unit that acquires packet information including information on a transmission source and a transmission destination of the packet, and stores the packet information in a packet information storage unit;
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication unit for estimating the range and outputting an estimation result.

(Appendix 2)
The packet acquired by the packet information acquisition unit is a packet that includes a tenant identifier that specifies the second range in a source (MAC) address of a transmission source or a destination (Media Access Control). The communication failure analysis device according to the above.

(Appendix 3)
The analysis unit exists between the pair of the transmission source device and the transmission destination device, and sets the first communication device connected to the transmission source device to the transmission source device for a predetermined period of time. The communication failure analysis device according to claim 1 or 2, wherein when the packet does not pass, the estimation is performed that the transmission source device is the failure occurrence location.

(Appendix 4)
The analysis unit exists between the pair of the transmission source device and the transmission destination device, and the packet having the transmission destination device as a transmission destination passes through the first communication device connected to the transmission destination device. The communication failure analysis device according to any one of Supplementary notes 1 to 3, wherein the communication device performs the estimation that the transmission destination device is the failure occurrence location.

(Appendix 5)
The analysis unit may be configured to determine that the destination device is the location where the failure has occurred by determining that the ACK (acknowledgment) packet for the packet destined to the destination device is connected to the destination device. 5. The communication failure analysis device according to claim 4, wherein the communication failure analysis device is performed when the communication failure does not pass through one communication device.

(Appendix 6)
The analysis unit has two first communication devices between the pair of the transmission source device and the transmission destination device, the packet passing through the first communication device connected to the transmission source device is Any of supplementary notes 1 to 5, wherein the estimation is performed that the first range is the fault occurrence location when the vehicle does not pass through the first communication device connected to the transmission destination device. A communication failure analysis device according to any of the above.

(Appendix 7)
The packet information includes any one of a time, a protocol, a sequence number, a source IP (Internet Protocol) address, a destination IP address, a source MAC address, a destination MAC address, a source port number, and a destination port number of the packet. Or one or more,
The analysis unit determines, based on the packet information, whether the packets passing through the two first communication devices existing between the pair of the source device and the destination device are the same. 7. The communication failure analysis device according to supplementary note 6, wherein

(Appendix 8)
The analysis unit tabulates the pattern of the failure occurrence location estimated during a predetermined period, and uses the pattern estimated most during the predetermined period as the estimation result. 8. The communication failure analyzer according to any one of supplementary notes 7.

(Appendix 9)
The first communication device is a virtual switch,
9. The communication failure analysis device according to any one of supplementary notes 1 to 8, wherein the second communication device is a virtual server.

(Appendix 10)
A communication failure analysis device according to any one of supplementary notes 1 to 9,
The first communication device,
A communication failure analysis system, comprising: the second communication device.

(Appendix 11)
A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. Obtaining packet information including information on the source and destination of the packet,
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication failure analysis method characterized by estimating the range of the second and outputting the estimation result.

(Appendix 12)
The communication failure analysis method according to claim 11, wherein the acquired packet is a packet that includes a tenant identifier that specifies the second range in a MAC address of a transmission source or a transmission destination.

(Appendix 13)
The packet, which exists between the pair of the source device and the destination device and passes through the first communication device connected to the source device for a predetermined time, passes the source device as the source. 13. The communication failure analysis method according to appendix 11 or 12, wherein when there is no communication failure, the estimation is performed that the transmission source device is the failure occurrence location.

(Appendix 14)
When the packet destined for the destination device passes through the first communication device that exists between the pair of the source device and the destination device and connects to the destination device, the transmission is performed. The communication failure analysis method according to any one of Supplementary Notes 11 to 13, wherein the estimation is made that the destination device is the failure occurrence location.

(Appendix 15)
The estimation that the destination device is the fault occurrence location is based on the assumption that an ACK packet for the packet destined for the destination device does not pass through the first communication device connected to the destination device. 15. The communication failure analysis method according to any one of supplementary notes 14, wherein the method is performed when the communication failure occurs.

(Appendix 16)
There are two first communication devices between the pair of the transmission source device and the transmission destination device, and the packet passing through the first communication device connected to the transmission source device is transmitted to the transmission destination device. The communication according to any one of Supplementary Notes 11 to 15, wherein the estimation is performed that the first range is the failure occurrence point when the vehicle does not pass through the first communication device to be connected. Failure analysis method.

(Appendix 17)
The packet information is at least one of a time, a protocol, a sequence number, a source IP address, a destination IP address, a source MAC address, a destination MAC address, a source port number, and a destination port number of the packet. Including
Determining whether the packets passing through the two first communication devices existing between the pair of the transmission source device and the transmission destination device are the same based on the packet information. 17. The communication failure analysis method according to 16.

(Appendix 18)
The patterns of the failure occurrence locations estimated during a predetermined period are totaled, and the pattern estimated most during the predetermined period is used as the estimation result. Communication failure analysis method described in 1.

(Appendix 19)
The first communication device is a virtual switch,
19. The communication failure analysis method according to any one of supplementary notes 11 to 18, wherein the second communication device is a virtual server.

(Appendix 20)
On the computer,
A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. A packet information acquisition function of acquiring packet information including information of a transmission source and a transmission destination of the packet, and storing the packet information in a packet information storage unit;
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication failure analysis program for realizing an analysis function of estimating the range and outputting an estimation result.

(Appendix 21)
21. The communication failure analysis according to claim 20, wherein the packet acquired by the packet information acquisition function is a packet that includes a tenant identifier that specifies the second range in a source or destination MAC address. program.

(Appendix 22)
The analysis function exists between the pair of the transmission source device and the transmission destination device, and sets the first communication device connected to the transmission source device to the transmission source device for a predetermined period of time. 22. The communication failure analysis program according to Supplementary Note 20 or 21, wherein when the packet does not pass, the transmission source device estimates the failure occurrence location.

(Appendix 23)
The analysis function exists between the pair of the transmission source device and the transmission destination device, and the packet having the transmission destination device as a transmission destination passes through the first communication device connected to the transmission destination device. 23. The communication failure analysis program according to any one of supplementary notes 20 to 22, wherein the communication device performs the estimation that the destination device is the location where the failure has occurred.

(Appendix 24)
The analysis function may be configured to perform the estimation that the destination device is the location where the failure has occurred, and to determine whether the ACK packet corresponding to the packet having the destination device as a destination is the first communication that is connected to the destination device. 24. The communication failure analysis program according to any one of supplementary notes 23, which is performed when the communication failure has not passed through the device.

(Appendix 25)
The analysis function includes two first communication devices between the pair of the transmission source device and the transmission destination device, and the packet passing through the first communication device connected to the transmission source device is When not passing through the first communication device connected to the transmission destination device, the estimation that the first range is the failure occurrence location is performed. Communication failure analysis program described in Crab.

(Supplementary Note 26)
The packet information is at least one of a time, a protocol, a sequence number, a source IP address, a destination IP address, a source MAC address, a destination MAC address, a source port number, and a destination port number of the packet. Including
The analysis function determines whether the packets passing through the two first communication devices existing between the pair of the transmission source device and the transmission destination device are the same based on the packet information. 25. The communication failure analysis program according to supplementary note 25, wherein

(Appendix 27)
The analysis function sums up the patterns of the failure occurrence locations estimated during a predetermined period, and sets the pattern estimated most during the predetermined period as the estimation result. 27. The communication failure analysis program according to any one of supplementary notes 26.

(Appendix 28)
The first communication device is a virtual switch,
The communication failure analysis program according to any one of supplementary notes 20 to 27, wherein the second communication device is a virtual server.

10, 20 Communication failure analyzer 11 packet information acquisition unit 12 packet information storage unit 13 analysis unit 24 definition information registration unit 25 definition information storage unit 26 setting unit 27 estimation result storage unit 28 output unit 50 network device group 60 host server 70 One communication device 71 Virtual switch 80 Second communication device 81 Virtual server 90 Information processing device 91 Communication interface 92 Input / output interface 93 Computing device 94 Storage device 95 Nonvolatile storage device 96 Drive device 97 Recording medium

Claims (10)

A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. A packet information acquisition unit that acquires packet information including information on a transmission source and a transmission destination of the packet, and stores the packet information in a packet information storage unit;
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication unit for estimating the range and outputting an estimation result. The said packet which the said packet information acquisition part acquires is the said packet which contains the tenant identifier which specifies the said 2nd range in the MAC (Media Access Control) address of a transmission source or a transmission destination. The said packet. A communication failure analysis device according to item 1. The analysis unit exists between the pair of the transmission source device and the transmission destination device, and sets the first communication device connected to the transmission source device to the transmission source device for a predetermined period of time. The communication failure analysis device according to claim 1, wherein when the packet does not pass, the transmission source device performs the estimation that the transmission source device is the failure occurrence location. The analysis unit exists between the pair of the transmission source device and the transmission destination device, and the packet having the transmission destination device as a transmission destination passes through the first communication device connected to the transmission destination device. 4. The communication failure analysis device according to claim 1, wherein when performing the estimation, the estimation is performed that the destination device is the failure occurrence location. 5. The analysis unit may be configured to determine that the destination device is the location where the failure has occurred by determining that the ACK (acknowledgment) packet for the packet destined to the destination device is connected to the destination device. The communication failure analysis apparatus according to claim 4, wherein the processing is performed when the communication failure does not pass through one communication apparatus. The analysis unit has two first communication devices between the pair of the transmission source device and the transmission destination device, the packet passing through the first communication device connected to the transmission source device is The method according to claim 1, wherein when the signal does not pass through the first communication device connected to the destination device, the estimation that the first range is the failure occurrence point is performed. The communication failure analysis device according to any one of the above. The first communication device is a virtual switch,
The communication failure analysis device according to any one of claims 1 to 6, wherein the second communication device is a virtual server. A communication failure analysis device according to any one of claims 1 to 7,
The first communication device,
A communication failure analysis system, comprising: the second communication device. A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. Obtaining packet information including information on the source and destination of the packet,
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication failure analysis method characterized by estimating the range of the second and outputting the estimation result. On the computer,
A packet that is connected to the second communication device that exists in the second range, and that passes through the first communication device from the first communication device that exists in the first range different from the second range. A packet information acquisition function of acquiring packet information including information of a transmission source and a transmission destination of the packet, and storing the packet information in a packet information storage unit;
For each of the pair of the source device that is the second communication device of the transmission source and the destination device that is the second communication device of the destination, the existence exists between the pair of the source device and the destination device. The first communication device, based on whether the packet having the source device as the transmission source and the transmission destination device as the transmission destination has passed, based on whether the failure location is the first range or the second A communication failure analysis program for realizing an analysis function of estimating the range and outputting an estimation result.

Images