JP3441196B2 - Network failure prediction device - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network failure predicting apparatus for predicting failure occurrence in a network system.

[0002]

2. Description of the Related Art In recent years, network technology has been introduced as an important infrastructure, and it is required to be able to provide services to users at all times. In the network system, in addition to the error caused by the abnormality of the network system itself, for example, an error naturally occurs at a certain probability in the transmission path. In the error detection method by detecting an FCS (frame check sequence) error frame, it is not possible to determine whether the cause of the error is connected to the abnormality of the network system itself, so it is necessary to make a determination by some means.

Further, the amount of information transmitted in each time zone, that is, the traffic in each time zone is monitored in advance, and this is compared with the normal traffic in each time zone (standard traffic) to be monitored. It is convenient to manage the network system if it is judged that the traffic is abnormal if the existing traffic is more than a certain distance from the standard traffic (the threshold is often used instead of the traffic itself). is there.

Further, it is also necessary for normal operation of the network system to predict whether a station, which is an example of a node in the network system, will cause a reception buffer overflow.

In order to cope with such a problem and to prevent the service from being stopped due to a failure of the network system or the like, a network management tool is increasingly introduced.

This network management tool uses a management application that uses a management protocol, which is a procedure for checking an abnormal state, and an analyzer that is connected to the transmission path of the network system and monitors data transmitted through the transmission path. It is roughly divided into what it was.

The management application using the management protocol detects a failure or a warning from the value of the management object to be managed, or detects a failure by the user giving a threshold to the management object. On the other hand, the analyzer detects a failure occurrence or a warning state or an error related to a communication protocol based on the threshold value set by the user.

[0008]

As described above, in network management, it is indispensable to set a failure detection means or a threshold value corresponding to the traffic abnormality detection means of a management tool for the occurrence of FCS error frames and abnormal traffic. Is.

However, it is difficult to set the corresponding threshold values in the fault detecting means or the traffic abnormality detecting means provided by the conventional network management tool, and moreover, the threshold values set by the supplier are not set. The initial value was not always appropriate.

Therefore, it is necessary for the administrator of the network system to set the threshold value. In this case, whether or not an appropriate threshold value can be set depends on the experience and knowledge of the administrator.

On the other hand, in order to predict and detect a fault inside a station such as a reception buffer overflow in a network system, it has been conventionally necessary to implement a management protocol, but the management protocol is not implemented. For existing network products, it is necessary to introduce products that newly implement the management protocol.

The present invention has been made in consideration of such a situation. A first object of the present invention is to detect an FCS error frame and to judge the occurrence of a network failure based on the FCS error occurrence interval. Another object of the present invention is to provide a network failure prediction device capable of calculating a threshold value for determining the failure occurrence.

A second object is to monitor traffic in the network system, judge whether the traffic is an abnormal amount, and calculate a threshold value for judging the traffic abnormality. It is to provide a network failure prediction device.

A third object of the present invention is to provide a network failure predicting apparatus capable of predicting a reception buffer overflow or the like at a certain station regardless of the management protocol.

[0015]

In order to solve the above problems, the invention according to claim 1 provides a network failure prediction apparatus capable of detecting a FCS error frame by monitoring a frame on a transmission line in a network system, FCS error frame and F that occurs next
An FCS error inter-frame bit number calculation means for calculating the FCS error inter-frame bit number, which is the total number of bits of the frame transmitted on the transmission path between the CS error frame and the CS error frame, and statistically natural even if the network system is normal. The threshold value calculated based on the bit number between transmission path bit errors corresponding to the occurrence rate of the transmission path bit error that occurs in the above and the FCS error inter-frame bit number calculated by the FCS error inter-frame bit number calculation means. Compared to,
A network failure prediction device comprising a failure determination means for determining that a failure has occurred on the network system when the number of bits between FCS error frames is smaller than a threshold value.

The invention according to claim 2 is the invention according to claim 1, wherein the threshold value is calculated from a plurality of FCS error inter-frame bit numbers calculated by the FCS error inter-frame bit number calculation means. FCS error The normal distribution regarding the number of bits between frames is calculated, the number of bits between transmission path bit errors and the average value of the normal distribution are compared, and when both are within a certain range, the normal distribution shows the FCS error when the network system is normal. In a network failure prediction device, which is calculated by a threshold value calculation unit that has a normal distribution of the number of bits between frames and uses the normal distribution as a probability distribution and sets the number of FCS error interframe bits corresponding to a preset probability as a threshold value. is there.

Further, the invention according to claim 3 is, in a network failure prediction apparatus for capturing and monitoring a frame on a transmission path in a network system together with a detection time of this frame, in a frame transmitted on the transmission path per unit time. Traffic calculation means that calculates the number of bits as traffic, and divide a certain period into several time zones, find the normal distribution of the traffic in each time zone, and use this normal distribution as a probability distribution to correspond to the preset probability. A threshold value calculating means for setting the upper limit threshold value and the lower limit threshold value of traffic in each time zone, and the traffic calculated by the traffic calculating means is the upper limit threshold value calculated by the threshold value calculating means. When the value is out of the range of the lower limit threshold, on the network system concerned It is a network failure prediction apparatus and a and determining a traffic abnormality determining means Rahikku abnormality has occurred.

[0018]

[0019]

Therefore, first, in the network failure prediction apparatus of the invention according to claim 1, the FCS error frame inter-bit number calculation means transmits between a certain FCS error frame and the next FCS error frame. The number of FCS error inter-frame bits, which is the total number of bits of the frame transmitted on the road, is calculated.

Next, the failure determining means calculates the error based on the number of bits between transmission path bit errors corresponding to the occurrence rate of transmission path bit errors that statistically naturally occur even if the network system is normal. The threshold value is compared with the number of bits between FCS error frames, and when the number of bits between FCS error frames is smaller than the threshold value, it is determined that a failure has occurred on the network system.

Therefore, for example, the bit error occurrence rate that naturally occurs with a certain probability due to the transmission line standard or the like, that is, the transmission line bit error occurrence rate that is not an abnormality of the network system itself is used as a basis. And FCS
When an error frame is detected, it can be easily determined whether it occurred with an abnormal frequency.

Next, in the network fault predicting apparatus of the invention according to claim 2, the network system is in a normal state by the threshold calculating means in addition to the same operation as the invention according to claim 1. Also, the threshold value is automatically calculated from the rate of occurrence of transmission line bit errors that naturally occur statistically.

First, the threshold value calculating means calculates an average value and a standard deviation of the plurality of FCS error inter-frame bit numbers calculated by the FCS error inter-frame bit number calculating means to obtain a normal distribution. .

Next, when the average value is within a predetermined range of the number of bits between transmission path bit errors, the threshold calculation means regards the above normal distribution as a normal distribution when the network system is normal, and further , The normal distribution is regarded as a probability distribution, and the number of bits between FCS error frames corresponding to a predetermined probability is obtained.

At this time, two values are obtained for the number of bits between FCS error frames with the average value sandwiched between them. However, since the failure of the network system is a case where FCS errors occur frequently, the smaller value is set as the threshold value. .

Therefore, when the number of FCS error inter-frame bits is smaller than the threshold value, that is, when FCS errors occur more frequently than expected in advance,
It can be determined that a failure has occurred in the network system.

For this reason, the network administrator has a value (probability) indicating which range of the probability distribution is abnormal, and a permissible range for determining the normal distribution, in addition to the value predetermined in the standard. The threshold value is automatically calculated by the threshold value calculation means.

Further, in the network failure prediction apparatus of the invention according to claim 3, first, the traffic calculation means calculates the traffic. Next, the threshold value calculating means calculates the normal distribution of the traffic in each time zone. Further, the values corresponding to the preset probabilities when the normal distribution is regarded as the probability distribution are calculated as the upper limit threshold and the lower limit threshold of traffic in each time zone.

At this time, since the normal distribution of the traffic in a certain time zone is known, the abnormal traffic may be defined as the traffic that deviates from a certain range around the average value. The preset probability is a value for determining this range, that is, the upper limit threshold and the lower limit threshold.

Therefore, when the traffic abnormality determining means detects traffic that falls outside the range of the upper threshold value and the lower threshold value centered on the average value of the traffic in the above normal distribution, on the network system concerned. It is determined that a traffic abnormality has occurred.

[0031]

[0032]

[0033]

[0034]

[0035]

[0036]

[0037]

EXAMPLES Examples of the present invention will be described below. (First Embodiment) FIG. 1 is a block diagram showing the first embodiment of the network failure prediction apparatus according to the present invention.

This network fault predicting device is provided in a station on the network including an analyzer or a workstation for monitoring data transmitted on the transmission path of the network system, a personal computer, etc., and the receiving circuit 1 and the received frame detecting circuit. 2, frame analyzer CPU 3, data storage 4, memory 5, data storage 6, network analysis / display system 7
And a connection device 8 and a bus 9.

In FIG. 1, first, the reception circuit 1 reproduces the signal level of the signal on the transmission path, and the reception frame detection circuit 2 detects the frame reception. The reception frame detection circuit 2 is connected to the frame analyzer CPU 3 and the data storage 4, and the frame analyzer CPU 3 and the data storage 4 are connected to the bus 9.

Further, a memory 5, a data storage 6, and a network analysis / display system 7 are connected to the bus 9 via a connection device 8. The frame analyzer CPU 3 operates according to a program stored in the memory 5 and receives a command from the network analysis / display system 7.

The frame analyzer CPU 3 stores the received frame 41 in the data storage 4 each time there is an output of the received frame detection from the received frame detection circuit 2 and can detect the FCS error frame. . When a threshold calculation command is received from the network analysis / display system 7, the received frame 4
The FCS error frame occurrence distribution is calculated and the threshold value 61 is determined based on 1 and the program and information in the memory 5, and the processing result is stored in the data storage 6.

Further, the frame analyzer CPU3 is
When the FCS error frame monitor command is received from the network analysis / display system 7, the network failure occurrence detection is started based on the program in the memory 5. That is, it is detected whether or not the received frame is an FCS error frame, and if it is an FCS error frame, the number of bits from the previous FCS error frame to the current FCS error frame, that is, the number of bits between FCS error frames. If Tb is calculated and compared with a threshold value 61, and if a failure occurs, the failure occurrence result 62 is stored in the data storage 6, and the fact that an abnormality has occurred is analyzed by a network.
Notify the display system 7.

The memory 5 includes a threshold calculation algorithm 51 and a network failure occurrence detection algorithm 52.
In addition, the program memory is provided with a program for operating the frame analyzer CPU3 such as FCS error frame detection 53, FCS error inter-frame bit number Tb calculation, various counters such as counter Cfcs, and a work area during program operation. Also plays a role.

Further, the memory 5 is used for determining information for statistical processing and threshold value determination, a prescribed transmission path bit error occurrence rate Ep as the number of bits between transmission path bit errors, and appropriateness of statistical values. The value R, the probability P for calculating the threshold value 61 and the like are stored.

The network analysis / display system 7 is connected to the bus 9 via the connection device 8 and can access the frame analyzer CPU 3, the memory 5 and the data storage 6.

The network analysis / display system 7
Is a threshold calculation command unit 71 and an FCS monitor command unit 72.
And a failure information output unit 73. The threshold value calculation command unit 71 issues an instruction to calculate a threshold value for determining a network fault, that is, a threshold value calculation command according to a predetermined flow or an external input by a network administrator or the like. CPU3
Give to.

The FCS monitor command unit 72 monitors the received frame according to a predetermined flow or by an external input by the network administrator or the like, and when an FCS error occurs, the FCS error inter-frame bit number T
An instruction for calculating b to detect the occurrence of a network failure, that is, an FCS error frame monitor instruction is given to the frame analyzer CPU 3.

The fault information output unit 73 stores the fault occurrence result 62 in the data storage according to a predetermined flow when the occurrence of the network fault is known by the notification from the frame analyzer CPU 3 or based on the external input by the network administrator or the like. 6 is read out and the content of the network failure is notified to the administrator.

Next, the operation of the network fault predicting apparatus of this embodiment constructed as described above will be explained. First, on a transmission line in a network system, a natural bit error (natural transmission line error) occurs with a certain probability. This value is known in advance as the specification value of the transmission path, and the transmission path bit error occurrence rate E specified in the memory 5 is specified.
p (in this case, represented by the number of bits between naturally occurring transmission path bit errors).

Therefore, the smaller the number of bits between FCS error frames, that is, the number of bits between FCS error frames Tb, the higher the possibility that the network system is abnormal rather than a natural bit error. A threshold value 61 for automatically determining how small this value is to consider the network system to be abnormal is automatically calculated. Further, the apparatus of the present embodiment continues to monitor the FCS error inter-frame bit number Tb and sets this as the threshold value 61.
A network failure is detected by comparing with, and the failure occurrence result 62 is saved in the data storage 6, and the result content is notified to the administrator.

Now, the procedure for calculating the threshold 61 will be described. First, when there is an instruction from the network analysis / display system 7 to the frame analyzer CPU 3,
The FCS error frame occurrence distribution is calculated, and the threshold 61 is determined based on the calculated statistical value.

The threshold value 61 is determined along the threshold value determination flow chart shown in FIG. First, the FCS error frame occurrence distribution is calculated by the frame analyzer CPU 3, and the average value of the total number of bits between FCS error frame occurrences, that is, the average value E and the standard deviation σ of the FCS error frame inter-bit number Tb are calculated ( ST1).

Next, the calculated average value E is Ep using the value R (0 <R <1) for judging the appropriateness of the statistical value.
It is confirmed whether it is between * (1-R) and Ep * (1 + R), that is, whether the FCS error frame occurrence distribution is significantly deviated from the prescribed transmission path bit error occurrence rate Ep. For example, when the average value E of the number of bits between FCS error frame occurrences is within ± 5% from the prescribed transmission path bit error occurrence rate Ep, when deviation is allowed, R
= 0.05 (ST2).

The average value E of the number of bits calculated in step ST1 is smaller than Ep * (1-R) or Ep * (1+
If it is greater than R), the process returns to step ST1 and FCS
The average value E of the number of bits between error frames and the standard deviation σ are recalculated.

On the other hand, when the average value E calculated in step ST1 is Ep * (1-R) or more and Ep * (1 + R) or less, the distribution determined by the average value E of the FCS error inter-frame bit number and the standard deviation σ is obtained. It is determined that the distribution is the FCS error frame occurrence distribution, and the threshold value 61 is a value representing the probability P using this distribution as a probability density function. Where probability P
Is a probability (0 <P <1) for calculating the threshold value 61 stored in the memory 5.

For example, when the probability P is 0.99, the threshold value 61 is E ± 3σ, and in this case, the probability of a corresponding natural transmission path error in detecting an FCS error frame is 0.01 (1 %). That is, it means that a failure other than a natural bit error occurs with a probability of 0.99 (ST3). The threshold value calculation result is stored in the data storage 6 together with the average value E and the standard deviation σ. In the present embodiment, the threshold value 61 need only be considered on the side having a smaller number of bits than the average value E of the number of FCS error inter-frame bits, that is, the side having a high frequency of FCS error occurrence.

Next, the FCS error frame occurrence distribution calculation in step ST1 of the threshold value determination flow chart of FIG. 2 will be described with reference to the flow chart of FIG. First, the frame received by the reception circuit 1 and detected by the reception frame detection circuit 2 is stored in the data storage 4 and the FCS.
It is possible to check whether it is an error frame (ST1
1).

At this time, if the received frame is not an FCS error frame, a counter Cfcs for counting FCS error frame detection (initial value 0, 0≤Cfc
s ≦ Cp; Cp is a check as to whether or not the unit of the number of FCS error frame detections for calculating the statistical value) is 1 or more (ST12), that is, whether or not the FCS error frame detection is the first time. . When the counter Cfcs is 1 or more, the FCS error inter-frame bit number Tb
The frame length of the current reception frame is added to (initial value 0) (ST13), and the process proceeds to step ST111. Step S
T111 determines whether or not the average value E and the standard deviation σ of the number of FCS error inter-frame bits have been calculated, and if so, the process ends, that is, the process proceeds to step ST2 in FIG. 2, otherwise step ST11. Return to.

In step ST12, the counter Cfc
If s is less than 1, do nothing at step ST11.
Go to 1, which means to truncate the original fractional bit number.

On the other hand, when the FCS error frame is received in step ST11, it is checked whether the counter Cfcs is 0, that is, the FCS error frame is detected for the first time after the threshold value calculation procedure is started (S).
T14).

If the counter Cfcs is 0, the counter is incremented and Cfcs = 1 (ST15), and the process proceeds to step ST111. On the other hand, when the counter Cfcs is not 0, the Cfcs-th inter-FCS error frame bit number Tb [Cfcs] is set between the FCS-error-frame bit number Tb, that is, between the previous FCS error frame detection and the current FCS error frame detection. The total sum Tb of the detected frame lengths is set (ST16).

Next, it is checked whether or not the counter Cfcs has reached the unit Cp of the number of FCS error frame detections for calculating the statistical value (ST17). If Cfcs ≠ Cp, the number of bits FCS between FCS error frames Tb. Is initialized to 0, 1 is added to the counter Cfcs (ST18), and the process proceeds to step 111.

On the other hand, when Cfcs = Cp, the average value E and the standard deviation of the Cp FCS error frame bit number from the FCS error frame bit number Tb [1] to the FCS error frame bit number Tb [Cp]. σ is calculated (ST19), the FCS error inter-frame bit number Tb,
The counter Cfcs is initialized (ST110) and the process proceeds to step 111.

In step ST111, if the average value E and the standard deviation σ of the number of FCS error inter-frame bits have been calculated, this flow is ended, and step ST2 in FIG.
Will proceed to.

As described above, the network failure prediction apparatus according to this embodiment uses the program in the memory 5 including the FCS error frame detection algorithm 53 to perform F
The number of bits between CS error frames is calculated, monitored, and compared with the threshold value calculated by the prescribed transmission path bit error occurrence rate Ep, and when the number of bits between FCS error frames is smaller than the threshold value, the network Since it is determined that the failure has occurred, it is possible to determine the failure occurrence on the network in consideration of the spontaneous bit error.

Further, the prescribed transmission line bit error occurrence rate E
Since p is used, the threshold value can be easily set, and even an administrator who is not familiar with the network system can easily and effectively set the threshold value.

Further, as described above, the network failure prediction apparatus according to the present embodiment monitors the frames on the transmission path according to the program in the memory 5 including the threshold calculation algorithm in addition to the above-mentioned configuration, and detects the FCS error. A normal distribution relating to the number of bits between frames is created, compared with a prescribed transmission line bit error occurrence rate Ep, and a threshold value is automatically calculated by regarding a normal distribution whose average value falls within a certain range as a probability distribution. Since this is done, the same effect as in the above embodiment can be obtained, and the threshold value can be set more easily, effectively, and automatically.

The threshold value calculated at this time is F
The accuracy of CS error frame detection is guaranteed by the probability P. (Second Embodiment) FIG. 4 is a block diagram showing a second embodiment of the network failure prediction apparatus according to the present invention. The same parts as those in FIG. Now, only different parts will be described.

In FIG. 4, a time measuring circuit 10 is added to the network failure prediction device so that the reception time of the reception frame 41 can be taken out from the frame analyzer CPU 3.

The network analysis / display system 7
The unit b includes a threshold value calculation command unit 71b, a traffic monitor command unit 72b, and a traffic abnormality output unit 73b. The threshold value calculation command unit 71b issues an instruction to calculate a threshold value 63 for determining a traffic abnormality according to a predetermined flow or according to an external input from the administrator, that is, a threshold value calculation command to the frame analyzer. CPU3
Give to. Further, the time zone setting, the setting of the counter value and the like are also performed from here, and the contents thereof are saved in the data storage 6.

The traffic monitor command unit 72b monitors the frame 41b with a reception time, calculates traffic Tu per unit time Tt for traffic calculation, and gives an instruction for judging a traffic abnormality, that is, a traffic monitor instruction to the frame analyzer CPU3. give.

When the traffic abnormality output unit 73 recognizes the occurrence of a network failure from the notification from the frame analyzer CPU 3, it outputs the traffic abnormality result 64 to the data storage 6 according to a predetermined flow or based on an external input by an administrator or the like. Read from the network and notify the administrator of the contents of the network failure.

The frame analyzer CPU 3 has a memory 5
It operates according to a program stored in the computer, and receives a command from the network analysis / display system 7.

Further, the frame analyzer CPU 3 stores the received frame in the data storage 4 together with the time data from the time measuring circuit 10 every time the received frame detection circuit 2 outputs the received frame detection signal. Then, upon receiving a threshold value calculation command from the network analysis / display system 7b, traffic distribution calculation and threshold value determination are performed based on the reception time frame 41b stored in the data storage 4 and the program and information in the memory 5. At the same time, the determined threshold value 63 is stored in the data storage 6.

Further, the frame analyzer CPU3 is
When the FCS error frame monitor command is received from the network analysis / display system 7b, the traffic Tu per unit time Tt for traffic calculation is calculated from the received frame based on the program of the memory 5, and the traffic abnormality is determined to determine the traffic abnormality. If it is abnormal, the fact is notified to the network analysis / display system 7b, and the traffic abnormality result 64 is sent to the data storage 6
To store.

The memory 5 is a frame analyzer CPU such as a threshold calculation algorithm 54, a traffic abnormality determination algorithm 55, a traffic calculation algorithm 56, and a traffic distribution calculation algorithm.
It is used as a program memory having a program for three operations.

Further, the memory 5 stores information for statistical processing and threshold value determination, for example, probability P for calculating a threshold value for traffic abnormality, default values such as time zone and counter value, Counters C, Ct, S for calculating the threshold value are provided. Also, the memory 5
Is also used as a work area for operating the frame analyzer CPU3.

Next, the operation of the network fault predicting apparatus of this embodiment constructed as described above will be explained. For example, when a day is divided into time zones every 30 minutes and the traffic in each time zone is examined, in many cases, the traffic differs depending on the time zone, and the traffic depends on the time zone.

In this way, when the traffic depends on the time zone, a width is set for the average traffic in each time zone, and if it deviates from this width, the traffic is abnormal. It is convenient to manage. For example, the administrator can examine the cause of a traffic abnormality and take necessary measures depending on the case.

In this embodiment, the upper limit value and the lower limit value of the traffic obtained by considering the average width of the traffic in each time zone are set as the threshold 63. The apparatus of this embodiment automatically calculates the threshold value 63 according to the threshold value calculation command from the network analysis / display system 7b. After the threshold is set, the traffic monitoring command from the system continues to monitor the traffic, and the traffic abnormality is detected by comparing this with the threshold, and the traffic abnormality result 64 is displayed in the data storage 6
It is saved in and the result is notified to the administrator.

Next, the procedure for calculating the threshold value 63 will be described. First, when the frame analyzer CPU 3 receives a threshold value calculation command, it calculates a traffic average value Et and a standard deviation σt according to a flow described later, and saves it in the data storage 6.

Next, the calculated traffic average value Et
And the distribution determined by the standard deviation σt is regarded as a distribution regarding traffic, and the probability P (0 <P
The threshold value 63 is calculated so as to have a value representing <1).

At this time, the probability P is a value stored in the memory 5. For example, if P = 0.99, the traffic judged to be abnormal is the normal traffic, that is, the traffic within the threshold in this case. Compared with, it is in a state where it occurs only with a probability of 1%.

Next, the calculation of the traffic average value Et and the standard deviation σt will be described with reference to the flowchart of FIG. Here, the start time of the time period for which the threshold is calculated is T
s, end time is Te, traffic calculation unit time is Tt
And Here, considering a case where the storage capacity for work such as the memory 5 is not sufficiently large, the statistical value, the average value Et, and the standard deviation σ are calculated for each sample unit number Stu for calculating the statistical value.
t is calculated, and the sample unit for this statistical value calculation is repeated Tus times between times Ts and Te. That is, Te-Ts = Tts * (Stu * Tt). The traffic Tu per unit time is the array Tu [C] provided for each counter C (initial value 1, 1 ≦ C ≦ Stu) corresponding to the sample unit number Stu for statistical value calculation.
Stored in each. In addition, a counter Ct (initial value 0, 0 ≦ Ct ≦ Tu is added to the count number of the sample unit number Stu.
s) corresponds to the number of traffic distribution calculation times at time [Ts, Te), and the counter S (initial value 0, 0 ≦ S
≦ Smax) corresponds. That is, time zones Ts to T
The traffic distribution will be calculated S times for e.

Consider, for example, the calculation of statistics for a certain time zone. First, the frame analyzer CPU3
When the threshold calculation command is received from the network analysis / display system 7b, the counters C, Ct, S are initialized (S
T21, ST22).

Next, the time [Ts + Ct * Stu * Tt +
(C-1) * Tt, Ts + Ct * Stu * Tt + C * T
The traffic of t) is calculated from the frame data stored in the data storage 4, and the calculated traffic Tu [C]
(ST23).

Further, the counter C is incremented (ST24), and it is checked whether or not the result C has reached (Stu + 1) (ST25). If not, step S
Returning to T22, the traffic Tu [1] ,. ． Tu [St
u] is calculated.

If the counter C has reached (Stu + 1), the traffic Tu [1] ,. ． Tu [Stu]
The average value Etu and the standard deviation σtu of are calculated and stored in the memory 5 (ST26). Further, the average value Etus and the standard deviation σtus for Ct times with respect to the counter Ct are calculated and stored in the memory 5. That is, this is (Ct * St
u) The same as the average value Etus and standard deviation σtus of the data samples for the number of u (ST27).

Next, the counter Ct is incremented (ST28), and it is checked whether the counter Ct has reached Tus (ST29). If not, step ST22.
The subsequent steps are repeated until the average value Etus and the standard deviation σtus of (Tus * Stu) data samples can be calculated. The reason why the counter C is provided as described above is because it corresponds to the case where the storage capacity for work is not sufficiently large. Therefore, when the counter Ct corresponds to the maximum value Tus, that is, ( Tus * Stu) average value Etus of data samples, standard deviation σtu
s is a statistical value in the S-th traffic distribution at time [Ts, Te).

When the counter Ct reaches Tus,
Average value Etus and standard deviation σtu of the S-th traffic
Calculated by adding s, and the average value Et of traffic for S times
u and the standard deviation σtu are calculated (ST210).

Then, the counter S is incremented (ST211), and if the counter S has reached the specified number of times, that is, if S = Smax, the processing ends, and if it has not reached the specified number of times, the process returns to step ST21 (ST21).
2).

As described above, the network failure prediction apparatus according to the present embodiment has the threshold calculation algorithm 54.
The threshold for the traffic anomaly in each time zone is obtained using a program including, and the traffic is monitored in accordance with the program including the traffic anomaly judgment algorithm 55, and when the traffic anomaly occurs, this is notified. The abnormal traffic in a certain time zone can be detected, and the administrator or the like can investigate the cause and take necessary measures.

Furthermore, these threshold values can be calculated automatically, and the burden on the administrator can be reduced. Further, the statistical data collected to calculate the threshold value can be used as various examination data such as examination of expansion of the network scale.

In this embodiment, as an example of dividing the time zone, one day is divided into 30 minutes. However, the present invention is not limited to this, and the time zone is characterized by a characteristic time (eg, By dividing into morning, afternoon, lunchtime, nighttime) or day (for example, weekdays, holidays), it is possible to change various ways of capturing the characteristics of traffic. It is also possible to set the threshold value 63 by changing the value of the probability P for each time zone.

Further, after setting a temporary threshold value,
It is also possible to monitor the traffic and calculate the statistic amount, the average value Et and the standard deviation σt to correct the threshold value. At this time, even if there is a possibility that the traffic tendency changes daily, it is possible to grasp the traffic change tendency and deal with a true traffic abnormality. (Third Embodiment) FIG. 6 is a block diagram showing a third embodiment of the network failure prediction apparatus according to the present invention. The same parts as those in FIG. Now, only different parts will be described.

In FIG. 6, the network analysis / display system 7c includes a destination address monitor command unit 72c and a prediction result output unit 73c. The destination address monitor command unit 72c monitors the frame 41b with the reception time and gives the frame analyzer CPU3 an instruction to predict the occurrence of the reception buffer overflow.

When the reception buffer overflow occurrence is predicted by the notification from the frame analyzer CPU 3, the prediction result output unit 73c follows the predetermined flow or the overflow occurrence prediction result 65 based on the external input by the administrator or the like. Is read from the data storage 6 and the content of the network failure is notified to the administrator.

The frame analyzer CPU 3 stores the received frame in the data storage 4 together with the time data from the time measuring circuit 10 each time the received frame detection circuit 2 outputs the received frame detection signal. Further, when receiving a command from the destination address monitor command unit 72c, the reception buffer overflow occurrence prediction is performed based on the program of the memory 5 by using the information of the frame with reception time 41b stored in the data storage 4. When it is predicted that the reception buffer overflow will occur, the fact is notified to the network analysis / display system 7c, and the overflow occurrence prediction result 65 is stored in the data storage 6.

The memory 5 is used as a program memory including a program for operating the frame analyzer CPU 3 such as the buffer overflow prediction algorithm 57.

Further, the memory 5 stores the information for predicting the occurrence of the reception buffer overflow, for example, the frame reception processing required time Tp and the maximum number of stations Sn in the stations connected to the network. The frame reception processing required time Tp is a value calculated by station specifications, tests, simulations, and the like. The frame reception processing required time Tp is Tp [1] ,. ． It may be given as Tp [Sn]. Such a frame reception processing required time Tp becomes a relatively long time, for example, when the reception buffer of the reception destination station has only one frame, and is an important factor for stable operation of the network system.

The memory 5 is also used as a work area for operating the frame analyzer CPU 3 including an array of frame detection times Tf [i] destined for the station.

Next, the operation of the network failure prediction device of this embodiment having the above configuration will be described. The reception buffer overflow occurrence prediction is performed by the latest two consecutive frames 4 among the frames 41b transmitted to the same station from the data of the frame with reception time 41b monitored by the network failure prediction device.
This is done by examining the time interval of 1b.

Therefore, the latest detection time of the frame addressed to each station is arranged in the working area of the memory, that is, the frame detection time Tf addressed to the station.
[1] ,. ． Tf [i] ,. ． Tf [Sn] (1 ≦ i ≦
Sn). If the array argument corresponds to the station address, the latest detection time is stored as it is. If not, conversion data is created to associate the array argument with the station address, that is, Tf [i ] And Tp [i] are associated with each other.

Next, the procedure for predicting the occurrence of a reception buffer overflow will be described with reference to the flow chart of FIG. First, the frame analyzer CPU3 monitors the received frame from the destination address monitor command unit 72c, and when receiving the command to perform the reception buffer overflow occurrence prediction process, the frame analyzer CPU3 receives the frame data 41b with the reception time from the frame data 41b stored in the data storage 4. The destination station address DA of the frame and the reception time Tr of the frame are checked (S
T31). Next, the frame analyzer CPU3
It is checked whether or not the previous detection time is stored in the frame detection time Tf [i] addressed to the station corresponding to the destination station address DA of the received frame (ST3).
2).

In step ST32, if there is no data at the station-destined frame detection time Tf [i] and the content is 0, after storing the station reception time Tr at the station-destined frame detection time Tf [i] (ST33). If the reception buffer overflow occurrence prediction is continued, the process returns to step ST31, and if not, the process ends (ST37).

On the other hand, when the previous detection time is stored in the station-destined frame detection time Tf [i] in step ST32, the present frame reception time Tr and the previous station-destined frame detection time Tf [i] are compared. The difference is compared with the frame reception processing required time Tp of the frame transmission destination (ST34), and if (Tr-Tf [i])> Tp, it is determined that the reception buffer overflow does not occur, and the process proceeds to step 33.

At step ST34 (Tr-Tf [i])
If ≦ Tp, there is a high possibility that two consecutive frames will arrive within the time required for the frame reception process of the station, and it can be predicted that a reception buffer overflow will occur at the station. Therefore, the frame analyzer CPU3 notifies the network analysis / display system 7c of the prediction that the reception buffer overflow will occur, and stores the overflow occurrence prediction result 65 in the data storage 6 (ST3).
5).

The prediction result output unit 73c of the network analysis / display system 7c takes out the overflow occurrence prediction result 65 that the reception buffer overflows from the data storage 6 and outputs the contents of the prediction result to the administrator (ST36).

Thereafter, if the prediction of the occurrence of the reception buffer overflow is continued, the process returns to step ST31, and if not, the process ends (ST37). As described above, the network failure prediction apparatus according to the present exemplary embodiment uses the program including the buffer overflow prediction algorithm 57 based on the frame reception processing required time of the transmission destination station and the time intervals of consecutive same destination frames to receive Since the buffer overflow occurrence can be predicted, the reception buffer overflow occurring at a certain station can be known in advance, and the administrator can take necessary measures.

In particular, when the reception buffer has a capacity of, for example, only one frame, it is possible to effectively predict the occurrence of a reception buffer overflow that may occur due to continuous frame reception, and to operate the network system in a stable manner.

Therefore, even in a network system in which the management protocol is not implemented, it is possible to predict the occurrence of the reception buffer overflow at the frame receiving station.

The network failure prediction apparatus of this embodiment is not limited to the failure occurrence prediction for the receive buffer,
Depending on how the frame reception processing required time is set, it is possible to include any failure occurrence prediction related to reception of the frame at the receiving station. Further, the present invention can be variously modified without departing from the gist thereof.

[0113]

As described above, the present invention has the following effects. The invention of claim 1 can provide a network failure prediction device capable of detecting an FCS error frame and determining the occurrence of a failure in the network based on the FCS error occurrence interval.

The invention of claim 2 can provide the network failure prediction device according to the invention of claim 1, which can calculate a threshold value for judging failure occurrence. Claim 3
The invention provides a network failure prediction device capable of monitoring traffic in a network system, determining whether or not the traffic is an abnormal amount, and calculating a threshold value for determining the traffic abnormality. be able to.

[0115]

[Brief description of drawings]

FIG. 1 is a first block diagram of a network failure prediction apparatus according to the present invention.
FIG.

FIG. 2 is a flow chart of threshold value determination in the embodiment.

FIG. 3 is a flow chart of FCS error frame occurrence distribution calculation in the embodiment.

FIG. 4 is a second network failure prediction device according to the present invention.
FIG.

FIG. 5 is a flow chart of traffic distribution calculation in the embodiment.

FIG. 6 is a third network fault prediction device according to the present invention.
FIG.

FIG. 7 is a flowchart of a reception buffer overflow occurrence prediction process in the embodiment.

[Explanation of symbols]

1 ... Receiving circuit, 2 ... Reception frame detecting circuit, 3 ... Frame analyzer CPU, 4 ... Data storage, 5 ... Memory, 6 ... Data storage, 7 ... Network analysis / display system, 8 ... Connection device, 9 ... Bus, 10 … Time measurement circuit.

Claims (3)

(57) [Claims] 1. A network failure prediction device capable of monitoring a frame on a transmission line in a network system and detecting an FCS error frame, wherein a certain FCS error frame and an FCS occurring next to the FCS error frame
FCS error inter-frame bit number calculation means for calculating the FCS error inter-frame bit number, which is the total number of bits of the frame transmitted on the transmission path between the error frame, and statistically natural even if the network system is normal. And a threshold value calculated based on the number of bits between transmission path bit errors corresponding to the occurrence rate of transmission path bit errors that occur in the above, and the number of bits between FCS error frames calculated by the FCS error frame between bits calculation means. Compare
A network failure prediction device comprising: a failure determination unit that determines that a failure has occurred on the network system when the number of bits between FCS error frames is smaller than the threshold value. 2. The threshold value is obtained by calculating a normal distribution of the FCS error interframe bit number from the plurality of FCS error interframe bit numbers calculated by the FCS error interframe bit number calculating means, The number of bits between bit errors is compared with the average value of the normal distribution, and when both are within a certain range, the normal distribution is set to FC when the network system is normal.
S is the normal distribution of the number of bits between error frames, and this normal distribution is the probability distribution and F corresponding to the preset probability
2. The network failure prediction device according to claim 1, wherein the network error prediction device is calculated by a threshold value calculation means having a threshold value of the number of bits between CS error frames. 3. A network failure prediction apparatus for capturing and monitoring a frame on a transmission path in a network system together with the detection time of this frame, wherein the traffic for calculating the number of transmission bits per unit time in the frame transmitted on the transmission path as traffic. The calculation method and a certain period are divided into several time zones, the normal distribution of traffic in each time zone is obtained, and the value corresponding to the preset probability is used as the probability distribution. Threshold value lower limit threshold value and the traffic value calculated by the traffic calculation unit, the upper limit threshold value and the lower limit threshold value calculated by the threshold value calculation unit Traffic error occurs on the network system when the value is out of the range. A network failure prediction device, comprising: a traffic abnormality determination means for determining that the network failure prediction is performed.