JP4429758B2 - Communication apparatus and network system - Google Patents

Description

  The present invention relates to a communication apparatus having a function of notifying using an ICMP (Internet Control Message Protocol) packet or an ICMPv6 packet, and a network system including the communication apparatus.

  In an IP (Internet Protocol) network, it is known to use ICMP as a means for transmitting / receiving various information accompanying data communication and for notifying error information. This ICMP is also used in IPv4 and IPv6. ICMP is used in IPv4, and ICMPv6 (Internet Control Message Protocol for IPv6) is used in IPv6. ICMP / ICMPv6 corresponds to an upper layer protocol of the IP layer for error notification and communication state diagnosis, ICMP applied to IPv4 is RFC (Request For Comments) 792, and ICMPv6 applied to IPv6 is RFC 2463, respectively. Is defined. ICMP / ICMPv6 has a role of notification of destination response confirmation, destination unreachability, route change, time excess, packet size excess, and the like.

  For example, in the case of an IPv4 network, when a communication device such as a router has a fragment function, an excessive packet size packet is relayed and transmitted by fragment processing in an IPv4 network, so this problem may not occur. However, it is also known that the fragment processing is not performed by setting the fragment to off. In the IPv6 network, fragment processing is not permitted for communication devices such as routers. Therefore, depending on the link, when the packet size is excessive, the packet is discarded.

Also, a communication device such as a router that transmits an ICMP / ICMPv6 packet adds, for example, all or a part of the original data packet when notifying an excessive packet size. In the case of ICMPv6 for IP header + 64 bits, an original data packet corresponding to the minimum MTU (Maximum Transmission Unit) value (generally, 1280 bytes) is added.

  In the case of such an excessive packet size (Packet Too Big), the route of the minimum value of the MTU to the destination is searched by the route MTU discovery protocol (IPv4 is defined by RFC1191 and IPv6 is defined by RFC1981). Thus, retransmission processing can be performed.

A server failure recovery notification device is provided in the router to detect a client that could not be accessed based on an ICMP destination unreachable message, and when there is no response IP packet from the client to the server, Means for determining and detecting a client that could not access the server is known (see, for example, Patent Document 1).
JP 2003-50752 A

  General bridge devices and layer 2 switches do not perform IP layer processing in data transfer, and also do not have ICMP / ICMPv6 processing because the device itself does not have a network address such as an IP address. . For this reason, even if a packet is discarded due to a parameter change such as MTU size or a filtering operation by the layer 2 switch, there is no means for recognizing this state at the transmission source of the packet, and therefore it is determined that there is no communication partner. Will do.

  As shown in FIG. 15, in the network system in which the IP terminals 211 and 215 are connected via the tunneling termination device 212, the relay device 213, and the tunneling termination device 214, the tunneling termination devices 212 and 214 are Packets from the IP terminals 211 and 215 are encapsulated and transferred to the partner tunneling terminating device via the relay device 213, and the capsules are removed and transferred to the IP terminals 211 and 215.

  In this case, the relay device 213 relays and forwards the tunneled packet, and when it detects an abnormality, the relay device 213 discards the packet and notifies the transmission source. And is not transferred to the source IP terminal. That is, the communication by ICMP / ICMPv6 is based on the lower IP layer of the tunneling protocol, and the abnormality notification by ICMP / ICMPv6 reaches the tunneling termination device. Therefore, there is a problem that retransmission processing cannot be performed and communication may not be performed normally.

  As shown in FIG. 16, when an address translation device 222 is provided between the networks 225 and 226 to perform communication between the IP terminals 221 and 224, for example, the packet is relayed by the relay device 223 in the network 226. When the packet is discarded due to anomaly detection during transmission, the packet is sent to the IP terminal 221 that is the transmission source of the packet in accordance with ICMP / ICMPv6. Since this is not possible, there is a case where the data is not transferred to the IP terminal 221 that is the source. In particular, when referring to the upper layer protocol information of the IP layer and the TCP / UDP port number for address conversion, it is not possible to perform accurate address conversion of the ICMP / ICMPv6 packet. There is a problem that cannot be notified.

  In addition, when the means for providing the server failure recovery notification device described above in the router includes relay transmission for performing tunneling processing, address conversion processing, etc., as described above, the notification at the time of occurrence of an abnormality in the relay route is used as the transmission source. It cannot be notified.

An object of the present invention is to solve the above-described conventional problems, and to enable notification of communication abnormality occurrence event information to a transmission source device when a communication abnormality occurrence is detected in various communication environments. is there.

  A communication apparatus according to the present invention is a communication apparatus that performs data transfer processing between apparatuses, a layer 2 transfer processing unit that performs data transfer processing between the apparatuses using a layer 2 protocol, and information on occurrence of a communication abnormality as ICMP / And an ICMP / ICMPv6 processing unit for notifying the data transmission source device by an ICMPv6 packet.

  Also, an MTU information holding unit holding an MTU value indicating the maximum transferable size corresponding to each link, an ICMP / ICMPv6 processing unit for sending an ICMP / ICMPv6 packet, and the size of the data are held in the MTU information holding unit A layer 2 transfer processing unit for sending an ICMP / ICMPv6 packet including the maximum size excess information as information on occurrence of communication abnormality from the ICMP / ICMPv6 processing unit to the data transmission source device when the MTU value is exceeded It has the composition which includes.

  Also, a filtering information holding unit that holds information for performing filtering processing on the data to be transferred, an ICMP / ICMPv6 processing unit that sends out an ICMP / ICMPv6 packet, and the data is discarded according to the information held in the filtering information holding unit And a layer 2 transfer processing unit for sending an ICMP / ICMPv6 packet including data discard information from the ICMP / ICMPv6 processing unit to the data transmission source.

  Further, a tunneling termination unit that transfers data between devices using a tunneling protocol, and a transmission source device are determined based on information in the header of an encapsulated ICMP / ICMPv6 packet that transfers information on the occurrence of communication abnormality. And an ICMP / ICMPv6 conversion unit that performs conversion processing so that it can be transferred to the network.

  An MTU information holding unit holding an MTU value indicating a maximum transferable size corresponding to each link, and an ICMP / ICMPv6 processing unit for notifying information on occurrence of communication abnormality to an apparatus that is a data transmission source by an ICMP / ICMPv6 packet; When the size of the ICMP / ICMPv6 packet exceeds the MTU value of the link to the data transmission source device, the ICMP / ICMPv6 packet is fragmented and sent so as not to exceed the MTU value. And a processing unit.

  An encryption processing unit that encrypts and decrypts data between devices, a tunneling termination unit that encapsulates and sends the encrypted data, and decapsulates the received data; Fragment processing unit that performs fragment processing when the size of the ICMP / ICMPv6 packet for notification to the link exceeds the maximum transferable size of the link, sends the fragmented packet, and merges it with the original packet And an ICMP / ICMPv6 conversion unit that analyzes the packet decrypted by the encryption processing unit, determines the device that is the source of the data, and sends an ICMP / ICMPv6 packet to the device. is there.

  An address conversion unit for converting a network address, an ICMP / ICMPv6 data analysis unit for analyzing data in an ICMP / ICMPv6 packet for notifying information on occurrence of a communication abnormality and determining a transfer destination device of the packet; And an ICMP / ICMPv6 conversion unit that performs conversion for sending the ICMP / ICMPv6 packet to the transfer destination apparatus.

  The network system of the present invention also includes a communication device that performs data transfer processing between devices. This communication device includes a layer 2 transfer processing unit that performs data transfer processing between the devices, and an occurrence of communication abnormality in ICMP / ICMPv6. And an ICMP / ICMPv6 processing unit for notifying the data transmission source device by a packet.

  Also, the communication device in the network system analyzes the data in the packet and transfers the tunneling termination unit for encapsulating and decapsulating the data and the ICMP / ICMPv6 packet for notifying the information of the occurrence of the communication abnormality. It has a configuration including an ICMP / ICMPv6 conversion unit that determines an earlier device and performs an address conversion process for sending to the device.

  A communication device in a network system includes: an encryption processing unit that encrypts and decrypts data between devices; a tunneling termination unit that encapsulates and transmits encrypted data; and decapsulates received data; Fragment processing is performed when the size of the ICMP / ICMPv6 packet for notifying the transmission source device of the information on the occurrence of communication abnormality exceeds the maximum transferable size of the link to the transmission source device. A fragment processing unit that receives the received packet and merges it with the original packet, and analyzes the packet decrypted by the encryption processing unit to determine the device that is the source of the data and sends an ICMP / ICMPv6 packet to the device And an ICMP / ICMPv6 conversion unit for sending the message.

  Even if tunneling processing or protocol conversion is performed in the communication path, it is possible to reliably notify the data transmission source when a communication abnormality occurs, and data can be transmitted with accurate parameters at the time of retransmission. A highly reliable network can be provided.

  Referring to FIG. 1, the communication device of the present invention is a communication device 33 that performs data transfer processing between devices such as communication terminals 31 and 32, and performs data transfer processing between devices using a layer 2 protocol. Includes a layer 2 transfer processing unit 35 and an ICMP / ICMPv6 processing unit 34 for notifying information of occurrence of communication abnormality to the data transmission source device by an ICMP / ICMPv6 packet. Is sent to a device that performs data transmission / reception, such as a communication terminal of the transmission source.

  The network system of the present invention includes a communication device 33 that performs data transfer processing between devices such as the communication terminals 31 and 32. The communication device 33 is a communication device that performs data transfer processing between devices. A layer 2 transfer processing unit 35 that performs data transfer processing between devices using a layer 2 protocol, and an ICMP / ICMPv6 processing unit 34 for notifying information on the occurrence of communication abnormality to the device that has transmitted the data using an ICMP / ICMPv6 packet And information on the occurrence of communication abnormality such as packet failure is notified to a device that performs data transmission / reception such as a communication terminal of the transmission source.

  FIG. 1 is an explanatory diagram of Embodiment 1 of the present invention, showing a network system in which communication terminals 31 and 32 are connected via a communication device 33 that processes a layer 2 protocol including a network. The case where the ICMP / ICMPv6 processing unit 34 is provided in the communication device 33 having the unit 35 is shown. That is, the function of the ICMP / ICMPv6 processing unit 34 is provided for the communication apparatus having the function of the conventional layer 2 protocol processing apparatus.

  Between the communication terminals 31 and 32 as devices for transmitting and receiving data, a packet transfer process is performed by the function of the layer 2 transfer processing unit 35 as in the conventional example. When a communication abnormality event such as packet discard occurs in the packet transfer process, the ICMP / ICMPv6 processing unit 34 sends an ICMP / ICMPv6 packet to the communication terminal that has transmitted the discarded packet. Send and notify event information. As a result, the transmission source communication terminal can recognize the point that the packet does not arrive at the transmission destination communication terminal and the reason thereof, and can perform retransmission processing or the like. A plurality of communication devices 33 are provided between devices that transmit and receive data according to the scale of the network system.

  FIG. 2 is an explanatory diagram of Embodiment 2 of the present invention, in which a network system in which communication terminals 41 and 42 as devices for transmitting and receiving data are connected via a communication device 43 that processes using a layer 2 protocol including a network. In the communication apparatus 43 having the layer 2 transfer processing unit 45, an ICMP / ICMPv6 processing unit 44 and an MTU information holding unit 46 are provided. In this case, the MTU value indicating the maximum transferable size of the link on the communication terminal 41 side is different from the MTU value indicating the maximum transferable size of the link on the communication terminal 42 side. For example, the MTU of the link on the communication terminal 41 side is different. When the value is 1500 bytes and the MTU value of the link on the communication terminal 42 side is 1450 bytes, the MTU information holding unit 46 holds MTU information corresponding to each link.

  For example, when data is transferred from the communication terminal 41 to the communication terminal 42, the layer 2 transfer processing unit 45 of the communication device 43 determines the transfer destination and refers to the MTU information holding unit 46 to obtain the MTU information of the transfer destination. Extract. Then, it is determined whether or not the packet size exceeds the transfer destination MTU value. For example, when a packet of 1500 bytes is transmitted from the communication terminal 41, the MTU value of the link on the communication terminal 42 side is 1450 bytes. Therefore, the ICMP / ICMPv6 processing unit 44 notifies the ICMP / ICMPv6 processing unit 44, and the ICMP / ICMPv6 processing unit 44 creates an ICMP / ICMPv6 packet to the communication terminal 41 of the transmission source. And send it out.

  In this case, notification of an excessive packet size includes, for example, “Fragment Needed and DF Set” (Code 4) or ICMPv6 Packet Too Big (Type 2) of ICMP Destination Unreachable (Type 3). As a result, the communication terminal 41 of the transmission source can recognize the cause of the communication abnormality, and retransmits the packet with a reduced packet size.

  FIG. 3 is an explanatory diagram of Embodiment 3 of the present invention, in which communication terminals 51 and 52 as devices for transmitting and receiving data are connected via a communication device 53 that processes using a layer 2 protocol including a network. In the communication apparatus 53 having the layer 2 transfer processing unit 55, an ICMP / ICMPv6 processing unit 54 and a filtering information holding unit 56 are provided. In this case, the communication device 53 performs filtering processing, and the filtering information holding unit 56 holds information for filtering.

  When receiving the packet, the communication device 53 determines the transfer destination by the layer 2 transfer processing unit 55 and compares the filtering information held in the filtering information holding unit 56 with the received packet. When an event such as discarding of this packet occurs, the ICMP / ICMPv6 processing unit 54 is notified, and the ICMP / ICMPv6 processing unit 54 sends out an ICMP / ICMPv6 packet to the transmission source communication terminal.

  The packet discard occurrence notification by the filtering process is performed by, for example, “Communication Administratively Prohibited” (Code 13) of ICMP Destination Unreachable (Type 3), or “Date of Destination Unatable” (IC 13) of ICMPv6 Destination Unreachable (Type 1). . As a result, the transmission source communication terminal can recognize the destination unreachable and the reason thereof as information on the occurrence of the communication abnormality, and thus avoid unnecessary repetition of retransmission processing.

  FIG. 4 is an explanatory diagram of a fourth embodiment of the present invention, in which tunneling termination devices 62 and 64 including a function as a communication device and a relay device 63 are connected between IP terminals 61 and 65 as devices for transmitting and receiving data. A tunneling termination device 62 corresponding to a communication device has a configuration including a tunneling termination unit 67 and an ICMP / ICMPv6 conversion unit 66. Similarly to the tunneling termination device 62, the tunneling termination device 64 is provided with an ICMP / ICMPv6 conversion unit 66.

  IP or IPv6 communication is performed between the IP terminals 61 and 65, and the tunneling termination devices 62 and 64 encapsulate the original data by adding an encapsulation header or the like to the IP / IPv6 communication data. For example, a layer 3 tunneling protocol is configured between devices such as the IP terminals 61 and 65 to perform communication. For this tunneled packet, the IP / IPv6 protocol is used as the transport of the lower layer. The relay device 63 corresponds to, for example, a router device that processes the IP layer.

  For example, when data is transferred from the IP terminal 61 to the IP terminal 65, the data is encapsulated by the tunneling termination unit 67 of the tunneling termination device 62 and transmitted. The relay device 63 relays and transmits the encapsulated packet, decapsulates it by the tunneling termination device 64, and transmits it to the IP terminal 65. At this time, when an event such as packet discard occurs in the relay device 63, the relay device 63 sends an ICMP / ICMPv6 packet to the tunneling termination device 62 to notify the event information.

  Since the ICMP / ICMPv6 packet is based on the lower IP layer of the tunneling layer, it cannot reach the actual IP terminal 61 as it is. Therefore, the tunneling termination device 62 that has received the ICMP / ICMPv6 packet converts it so that it can be transferred to the IP terminal 61 by the ICMP / ICMPv6 converter 66 and sends it out. Thereby, the source IP terminal 61 can recognize the destination unreachable and the reason.

  FIG. 5 is an explanatory diagram of the ICMP / ICMPv6 packet sent from the relay device 63 in FIG. 4. The ICMP / ICMPv6 packet 71 sent back has a configuration in which the packet 72 received from the tunneling termination device 62 is added. The packet 72 has a configuration in which a tunnel header 74 for tunneling is added to the original IP packet 73. The tunneling termination device refers to information such as the tunneling session ID in the tunnel header 74, IPv4 / IPv6 address information in the original IP packet, TCP / UDP port number, etc. Conversion processing is performed and the data is sent to the source IP terminal 61.

  In general encryption protocol, after negotiation of key exchange is completed, the data encrypted according to the common key encryption method is transferred at the time of actual data transfer. Generally, a device that can perform a decryption process for returning encrypted data performed by the device itself to the original data. When the tunneling protocol described above is a protocol involving encryption, when the tunneling termination device 62 receives an ICMP / ICMPv6 packet 71 including encrypted data performed by the device itself, the tunneling termination device 62 decrypts the original IP packet 73 that has been encrypted. It is possible to convert the ICMP / ICMPv6 packet by referring to the internal data.

  Also, when returning an ICMP / ICMPv6 packet including the original data from the relay device 63 (see FIG. 4), the maximum transferable size is exceeded, so as shown in FIG. May be returned with some missing. Note that the encrypted packet 82 has a configuration in which the original IP packet 83 is encrypted and a tunnel header is added, and the ICMP / ICMPv6 packet includes a part of the ICMP / ICMPv6 packet as described above due to restrictions due to the MTU value or the like. Missing packets are added. In this case, all data cannot be restored, and the missing portion 84 may include information such as authentication information that guarantees the safety of the packet. It becomes difficult to perform processing normally. At this time, the tunneling termination device 62 omits a part of the decoding process that should be originally performed, refers to only necessary information such as address information in the restored data, and converts the ICMP / ICMPv6 packet. As a result, the cause of the communication abnormality can be notified to the transmission source device.

  FIG. 7 is an explanatory diagram of the fifth embodiment of the present invention, in which an ICMP / ICMPv6 processing unit 94, a fragment processing unit 95, and MTU information are added to the relay device 93 between the communication terminals 91 and 92 as devices for transmitting and receiving data. For example, an event such as a transfer error occurs when data is transferred from the communication terminal 91 to the communication terminal 92, and the ICMP / ICMPv6 processing unit 94 sends an ICMP / ICMPv6 packet to the transmission source communication terminal 91. When the size of the ICMP / ICMPv6 packet to be returned exceeds the MTU value of the link on the communication terminal 91 side with reference to the MTU information holding unit 96, the fragment processing unit 95 causes the MTU value to be transmitted. Perform fragment processing to a size that does not exceed, and send it back. As a result, the transmission source communication terminal 91 receives and merges the fragmented ICMP / ICMPv6 packet, restores the previously transmitted packet, identifies the packet with the communication abnormality, and identifies the cause. be able to.

  FIG. 8 is an explanatory diagram of Embodiment 6 of the present invention, in which IP terminals 101 and 105 as devices for transmitting and receiving data are connected by a network including tunneling termination devices 102 and 104 and a relay device 103. , Which shows a network system for performing data communication, and the inside of the tunneling termination device 104 is omitted, but, like the tunneling termination device 102, a fragment processing unit 106, a tunneling termination unit 107, an encryption processing unit 108, An ICMP / ICMPv6 conversion unit 109 is provided.

  Data communication by IPv4 or IPv6 is performed between the IP terminals 101 and 105, and tunneling processing of encrypted packets is performed in the tunneling termination devices 102 and 104. When this packet is discarded due to an event such as an MTU excess size in the relay apparatus 103, the relay apparatus 103 transmits an ICMP / ICMPv6 packet to the tunneling termination apparatus 102 in the transmission source direction to notify the event information. I do. In this case, when the size of the ICMP / ICMPv6 packet exceeds the MTU value of the link, the relay apparatus 103 performs fragment processing and sends it out. The tunneling termination device 102 combines the divided ICMP / ICMPv6 packets by the fragment processing unit 106 to restore the original packets, performs the termination processing in the tunneling termination unit 107, and decrypts it in the encryption processing unit 108. The destination of the ICMP / ICMPv6 packet is determined, the ICMP / ICMPv6 conversion unit 109 creates the ICMP / ICMPv6 packet of the destination address, and the source IP terminal 101. Therefore, the source IP terminal 101 can recognize the cause of the communication abnormality.

  FIG. 9 is an explanatory diagram of Embodiment 7 of the present invention, and shows a network system in which communication terminals 111 and 112 as devices for transmitting and receiving data are connected via a communication device 113. The communication device 113 is an ICMP. / ICMPv6 conversion unit 114 and address conversion processing unit 115, and when performing data communication between the communication terminal 111 and the communication terminal 112, the address conversion processing unit 115 including an address learning table, for example, For the address A of the communication terminal 111, the address C of the communication device 113, and the address B of the communication terminal 112, the destination address C from the communication terminal 111 is converted into the address B of the communication terminal 112 and relayed and transmitted. The source address B from the terminal 112 is converted into the address C of the communication device 113 and transferred. When an ICMP / ICMPv6 packet is transmitted from the communication terminal 111 to the communication terminal 112 in accordance with the event of occurrence of communication abnormality, the ICMP / ICMPv6 conversion unit 114 performs ICMP / ICMPv6 conversion and sends the ICMP / ICMPv6 to the communication terminal 112. An ICMPv6 packet is transmitted. Thereby, information on the occurrence of communication abnormality can be notified to the transmission source device.

  FIG. 10 is an explanatory diagram of Embodiment 8 of the present invention, showing a network system in which communication terminals 121 and 122 as devices for transmitting and receiving data are connected via a communication device 123. The communication device 123 is an ICMP. / ICMPv6 conversion unit 124, ICMP / ICMPv6 data analysis unit 125, and address conversion processing unit 126, and performs address conversion and data communication between communication terminals 121 and 122 as in the embodiment shown in FIG. The case where is performed is shown.

  For example, when an ICMP / ICMPv6 packet is transmitted from the communication terminal 121 to the communication terminal 122, the ICMP / ICMPv6 data analysis unit 125 analyzes the data in the ICMP / ICMPv6 packet and forwards the ICMP / ICMPv6 packet. To decide. Then, the ICMP / ICMPv6 conversion unit 124 performs ICMP / ICMPv6 conversion and transmits an ICMP / ICMPv6 packet to the communication terminal 122. Thereby, information on the occurrence of communication abnormality can be notified to the transmission source device.

  FIG. 11 is an explanatory diagram of Embodiment 9 of the present invention, showing a network system in which communication terminals 131 and 132 as devices for transmitting and receiving data are connected via a communication device 133. The communication device 133 is an ICMP. / ICMPv6 conversion unit 134, address conversion processing unit 135, and address / port information holding unit 136, and the address conversion processing unit 135 of the communication device 133 converts the address in the data communication between the communication devices 131 and 132. To do.

  For example, when data is transmitted from the communication terminal 131 to the communication terminal 132, when the communication terminal 132 detects a communication abnormality or the like, the communication terminal 132 adds the received original data to the packet in an ICMP / ICMPv6 packet. Is transmitted to the communication terminal 131 of the transmission source. The communication device 133 refers to the address / port information holding unit 136 based on the network address, port number, etc. of the original data added to the ICMP / ICMPv6 packet, and communicates with the communication terminal 131 to which the ICMP / ICMPv6 packet is transferred. The ICMP / ICMPv6 conversion unit 134 converts the ICMP / ICMPv6 packet, and transmits the converted ICMP / ICMPv6 packet to the communication terminal 131. Thereby, information on the occurrence of communication abnormality can be notified to the transmission source device.

  FIG. 12 is an explanatory diagram of the tenth embodiment of the present invention. A VPN (Virtual Path Network) 143 including VPN edge devices 144 and 145 is provided between the communication terminals 141 and 142 as devices for transmitting and receiving data. The network system connected via is shown. The VPN 143 is a service provided by a communication carrier and realizes a layer 2 network between the communication terminals 141 and 142. The VPN edge devices 144 and 145 are devices that perform transfer processing on the communication terminals 141 and 142 side of the VPN 143, and perform transfer processing using the VPN protocol. The VPN 143 performs data transfer by using a protocol such as VLAN (Virtual Local Area Network) or EoMPLS (Ethernet over Multi Protocol Label Switching).

  A label or a tag is added to a frame (packet) transferred in the VPN 143 by the VPN protocol, whereby the length of the frame (packet) is increased. For this reason, there is a case where the maximum length permitted to transfer the VPN 143 may be exceeded, and when the maximum length is exceeded, the transfer cannot be performed. Therefore, the communication terminal 141 of the transmission source is notified of the excess size by an ICMP packet. As a result, the communication terminal 141 as the transmission source transmits data with a length that does not exceed the size.

  For security reasons, the VPN edge device may perform a filtering process using a MAC (Media Access Control) address or the like. In this case, for example, when the packet transferred from the communication terminal 141 to the communication terminal 142 is discarded in the VPN edge device 145, the VPN edge device 145 sends an ICMP / ICMPv6 packet to the communication terminal 141 of the transmission source. , Notify packet discard. Thereby, the communication terminal 141 of the transmission source can know the packet non-arrival and the reason.

  FIG. 13 is an explanatory diagram of Embodiment 11 of the present invention, showing a network system in which communication terminals 151 and 152 as devices for transmitting and receiving data are connected via a layer 3 VPN 153, 154 is a tunnel relay device, 155 , 156 denote tunnel edge devices. Layer 3 VPN 153 encapsulates an IPv4 or IPv6 packet from a communication terminal according to a tunneling protocol and performs a transfer process. As a tunneling protocol, MPLS (Multi Protocol Label Switching), L2TP (Layer2 Tunneling Protocol), IPsec (IP Secur) ) Etc. can be used.

  The tunnel edge devices 155 and 156 are located between the communication terminals 151 and 152 and the layer 3 VPN 153, encapsulate IP / IPv6 packets from the communication terminals 151 and 152 by the tunneling protocol, and transfer them by the layer 3 VPN 153. The tunnel relay device 154 relays and transfers the encapsulated packet, and does not touch the data in the packet at all.

  For example, when a packet is transferred from the communication terminal 151 to the communication terminal 152, if the MTU excess is detected in the tunnel relay device 154, the tunnel relay device 154 transmits an ICMP / ICMPv6 packet with the destination address being the tunnel edge device 155. To do. The tunnel edge device 155 cancels the encapsulation, and determines the communication terminal to notify the MTU excess based on the session ID of the tunnel, the MPLS label value, or the IP / IPv6 address of the original data inside the encapsulated packet. . At this time, when IPsec is used as the tunneling protocol, the ciphertext is decrypted (plain culture) at the end of the tunneling protocol. The tunnel edge device 155 that has determined the transfer destination transmits an ICMP / ICMPv6 packet again using the transfer destination as an address. As a result, the communication terminal 151 of the transmission source can recognize the cause of the communication abnormality.

  FIG. 14 is an explanatory diagram of Embodiment 12 of the present invention, and shows a network system in which an IPv6 terminal 161 of an IPv6 network 167 and an IPv6 terminal 162 of an IPv6 network 168 are connected via an IPv4 Internet 163. IPv4 routers 165 and 166 denote IPv4-IPv6 translators.

  When the IPv6 router 161 detects an MTU excess when the IPv6 terminal 161 transfers an IPv6 packet to the IPv6 terminal 162, the IPv4 router 164 sends an ICMP packet indicating that the destination address is addressed to the IPv4-IPv6 translator 165. To do. The IPv4-IPv6 translator 165 refers to the IP address of the packet, the TCP / UDP port number, or the like to determine a communication terminal to be notified of MTU excess. The IPv4-IPv6 translator 165 that has determined the transfer destination transmits an ICMPv6 packet to the source IPv6 terminal 161 with the transfer destination as an address. As a result, the source IPv6 terminal 161 can recognize the cause of the communication abnormality.

It is explanatory drawing of Example 1 of this invention. It is explanatory drawing of Example 2 of this invention. It is explanatory drawing of Example 3 of this invention. It is explanatory drawing of Example 4 of this invention. It is explanatory drawing of an ICMP / ICMPv6 packet. It is explanatory drawing of the packet to which some missing data was added. It is explanatory drawing of Example 5 of this invention. It is explanatory drawing of Example 6 of this invention. It is explanatory drawing of Example 7 of this invention. It is explanatory drawing of Example 8 of this invention. It is explanatory drawing of Example 9 of this invention. It is explanatory drawing of Example 10 of this invention. It is explanatory drawing of Example 11 of this invention. It is explanatory drawing of Example 12 of this invention. It is explanatory drawing of the network system of tunneling transfer. It is explanatory drawing of the conventional network system.

Explanation of symbols

31, 41, 51, 32, 42, 52 Communication terminal 33, 43, 53 Communication device 34, 44, 54 ICMP / ICMPv6 processing unit 35, 45, 55 Layer 2 transfer processing unit 46 MTU information holding unit 56 Filtering information holding unit

Claims (4)

In a communication device that performs data transfer processing between devices,
A tunneling termination unit that performs transfer control processing by encapsulating and decapsulating data between the devices by a tunneling protocol;
The header information of the encapsulated transfer information of the communication abnormality event occurrence ICMP / ICMPv6 packets to determine device source based, for transferring the information of the communication abnormality event occurrence to the transmission source unit A communication apparatus comprising: an ICMP / ICMPv6 conversion unit that performs conversion processing. In a communication device that performs data transfer processing between devices,
An encryption processing unit for encrypting and decrypting data between the devices;
A tunneling termination unit that encapsulates and transmits the data encrypted by the cryptographic processing unit using a tunneling protocol, decapsulates the received data, and transfers the data to the cryptographic processing unit;
When the ICMP / ICMPv6 packet size for notifying the transmission source event information to the transmission source device exceeds the maximum transferable size of the link, fragment processing is performed and the fragment processed packet is received. A fragment processing unit that merges into the original packet,
A configuration including an ICMP / ICMPv6 conversion unit that analyzes a packet decrypted by the encryption processing unit to determine a device that is a transmission source of the data, and that sends an ICMP / ICMPv6 packet to the determined transmission source device. A communication device comprising: In a network system including a plurality of communication devices that perform data transfer processing between devices,
The communication apparatus analyzes the data in the packet and transfers the ICMP / ICMPv6 packet for notifying the information of the occurrence of the communication abnormal event, and the tunneling termination unit that encapsulates and decapsulates the data by the tunneling protocol. An ICMP / ICMPv6 conversion unit that performs address conversion processing for determining the destination device and sending the determined device to the destination device
A network system characterized by this. In a network system including a plurality of communication devices that perform data transfer processing between devices,
The communication device includes an encryption processing unit that encrypts and decrypts data between the devices, a tunneling termination unit that encapsulates and transmits the encrypted data using a tunnel protocol, and decapsulates the received data; When the size of the ICMP / ICMPv6 packet for notifying the information on the occurrence of the communication abnormal event to the transmission source device exceeds the maximum transferable size of the link to the transmission source device, the fragment processing is performed and transmitted. Fragment processing unit that receives the fragmented packet and merges it with the original packet, and analyzes the packet decrypted by the encryption processing unit to determine the device that is the source of the data, ICMP / ICMPv6 conversion that sends ICMP / ICMPv6 packet with device as destination device It has a configuration that includes a door
A network system characterized by this.

Images