JP5405265B2 - Topology estimation device and topology estimation method - Google Patents

Description

  The present invention relates to a technique for estimating a connection relationship between communication devices constituting a network.

  In order to properly operate a business system for network operation, it is necessary to construct a high-quality network database. In recent years, networks have become large-scale and complicated, and it has become difficult to grasp and manage physical and logical connection configurations (hereinafter referred to as topologies) between devices constituting the networks. Therefore, it is necessary to minimize the time, cost, and complexity of maintenance and maintenance required for network maintenance and maintenance.

  Thus, as a means for automatically creating a network topology, there is a method of using a combination relationship of MAC addresses in a MAC (Media Access Control) learning table collected from a network device (Patent Document 1, etc.).

  In the conventional method, first, the most registered ports are obtained from the ports learned from the MAC learning table collected from the network device. And it confirms that the some MAC address of the obtained port corresponds with the combination of the MAC address registered into the some port of the MAC address of a 2nd switch. In addition, a combination of MAC addresses registered in a plurality of ports other than the obtained port in the MAC learning table of the first switch is a plurality of MAC addresses registered in one port in the MAC learning table of the second switch. Make sure it matches. Then, the conventional method considers that the first switch and the second switch are connected when these two requirements are satisfied.

  FIG. 1 shows an example of the above conventional method. In FIG. 1, “m1, m2,...” Indicates the MAC address of the subscriber device, and “SW-1, SW-2” indicates the Layer 2 switch that is a topology creation target. Each switch holds a MAC learning table. In FIG. 1, “IF1, IF2,...” Indicates a Layer 2 switch port, and “m1, m2,...” In a square box described adjacent to the port indicates a MAC learned at each port. Indicates an address.

  As shown in FIG. 1, the above method is based on the combination of the MAC addresses of the ports IF1, IF2, and IF3 (m1, m2, Confirm that it matches m3, m4). Furthermore, in addition to this requirement, the above method confirms that the MAC address combination (m5, m6) of ports IF2 and IF3 other than IF-1 of SW-1 matches the MAC address of IF4 of SW-2. SW-1 and SW-2 are considered to be connected.

Japanese Patent No. 4008432

  However, in the case of the above conventional method, in a large-scale network such as a communication carrier, (1) the learned MAC address is deleted due to an aging timeout. (2) In a large SW used in a large-scale network, a hash table may be used for speeding up MAC learning, but the learned MAC address is overwritten due to duplication of hashes (duplication of hashes). Old MAC address is deleted). If part of the MAC address in the MAC learning table held by the switch is lost due to aging processing, etc., the combination of MAC addresses will not match. Not considered. Accordingly, there is a problem that this method cannot be used practically even though it is originally intended to automatically extract the network configuration only in a large-scale network. Here, the number of MAC addresses learned in a large-scale network such as a communication carrier increases according to the number of subscribers, and as a result of duplication in the aging process and hash table, missing MAC addresses occur. In such a case, the occurrence of the above problem becomes significant.

  FIG. 2 shows an example when the MAC address m3 of the port IF1 of SW-1 in FIG. 1 is lost due to the aging process. In this case, since the port IF1 of SW-1 in which the most MAC addresses are registered does not match the combination of the plurality of ports of SW-2, according to the conventional method, SW-1 and SW-2 Is not considered connected.

  Also, for example, in the case of a network intended for connection to the Internet, it is standard to use a tree topology with the connection point to the Internet as a vertex. However, there is a problem that the conventional method cannot be applied to the topology estimation of a network having a one-to-many tree structure.

  FIG. 3 shows an example of a network having a tree topology with the connection point to the Internet as a vertex. In FIG. 3, it is assumed that all the subscriber devices that are leaf nodes are performing Internet communication via an authentication switch. In this case, the combination of the MAC address of IF-1 of SW-1 matches the combination of IF1, IF2, and IF3 of SW-2, but the ports other than IF1 of SW-1 match only the port IF3, and there are a plurality of combinations. Does not match the port. Therefore, according to the conventional method, SW-1 and SW-2 are not considered to be connected.

  Therefore, in the present invention, in view of the above problems, even when a part of the MAC learning table held by the device to be analyzed for topology is missing, the missing MAC address is excluded from the analysis target. An object of the present invention is to provide a topology estimation apparatus and a topology estimation method capable of improving accuracy and estimating a network topology even when the network topology has a one-to-many tree structure.

In one form of the disclosed topology estimation device, the topology estimation device estimates a connection relationship between a plurality of communication devices included in a communication network, and each of the communication devices includes a transmission / reception port and a transmission / reception port of each communication device. The communication device corresponding to the leaf node of the topology connected via the network or the destination information associated with the address of the communication device corresponding to the root node of the topology, the transmission destination information held by each of the plurality of communication devices is acquired. A destination information list generating means for generating a destination information list for associating the destination information with a communication device from which the destination information is acquired, and the leaf node and the root node based on the destination information list Grouping based on the combination of the communication devices existing on the path from the leaf node to the root node. Group selection means for selecting one or more groups that meet a predetermined rule regarding a mapping means, the number of leaf nodes and root nodes corresponding to each group, and the number of communication devices corresponding to each group And topology estimation means for estimating a connection relation of the communication device based on the destination information list excluding data on the leaf node and root node corresponding to the selected group. .

  The disclosed topology estimation apparatus can improve the accuracy of the analysis by excluding the missing part from the analysis target even when a part of the MAC learning table held by the apparatus to be analyzed for topology is missing. . Even when the network topology has a one-to-many tree structure, the network topology can be estimated.

It is a figure explaining a prior art. It is FIG. (1) explaining the problem of a prior art. It is FIG. (2) explaining the problem of a prior art. It is a functional block diagram of the topology estimation apparatus according to the present embodiment. It is a figure explaining the flow of a process by the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the structural example of the analysis MAC learning table which concerns on this Embodiment. It is a figure which shows the structural example of the pattern table for every MAC which concerns on this Embodiment. It is a figure which shows the structural example of the pattern reliability table which concerns on this Embodiment. It is a figure which shows the structural example of the pattern summary table for every apparatus which concerns on this Embodiment. It is a figure which shows the structural example of the pattern table for every port which concerns on this Embodiment. It is a figure which shows the structural example of the connection destination table which concerns on this Embodiment. It is a flowchart which shows the flow of a process by the MAC learning table analysis process part which concerns on this Embodiment. It is a flowchart which shows the flow of a process by the MAC learning table correction | amendment process part which concerns on this Embodiment. It is a flowchart which shows the flow of a process by the topology creation process part which concerns on this Embodiment. It is a figure explaining the structure of the network made into analysis object in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the analysis MAC learning table (the 1) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern table for every MAC in the processing example of the topology estimation apparatus which concerns on this Embodiment (the 1). It is a figure which shows the pattern reliability table (the 1) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern reliability table (the 2) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern table for every MAC in the process example of the topology estimation apparatus which concerns on this Embodiment (the 2). It is a figure which shows the analysis MAC learning table (the 2) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern reliability table (the 3) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern table for every MAC in the process example of the topology estimation apparatus which concerns on this Embodiment (the 3). It is a figure which shows the analysis MAC learning table (the 3) in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern table for every port in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the pattern total table for every apparatus in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a flowchart of the connection topology creation process in the example of a process of the topology estimation apparatus which concerns on this Embodiment. It is a figure explaining the connection topology creation process in the process example of the topology estimation apparatus which concerns on this Embodiment. It is a figure which shows the connection destination table in the process example of the topology estimation apparatus which concerns on this Embodiment.

The best mode for carrying out the present invention will be described with reference to the drawings.
(Operational principle of topology estimation device according to this embodiment)
The operation principle of topology estimation apparatus 100 according to the present embodiment will be described with reference to FIGS. FIG. 4 is a functional block diagram of topology estimation apparatus 100 according to the present embodiment. As illustrated in FIG. 4, the topology estimation apparatus 100 includes a MAC learning table analysis processing unit 110, a MAC learning table correction processing unit 120, and a topology creation processing unit 130. Further, the topology estimation apparatus 100 includes an analysis MAC learning table 140, a per-MAC pattern table 150, a pattern reliability table 160, a per-device pattern aggregation table 170, a per-port pattern table 180, and a connection destination table 190.

  In addition, the transmission destination information list generation means in the claims is included in the MAC learning table analysis processing unit 110, and the grouping means in the claims is included in the MAC learning table analysis processing unit 110. The group selection means in the claims is included in the MAC learning table correction processing unit 120, and the topology estimation means in the claims is included in the topology creation processing unit 130. The second group selection means in the claims is included in the topology creation processing unit 130.

  As shown in FIG. 5, the topology estimation device 100 first collects MAC learning tables held by each communication device (for example, Layer 2 switch) that constitutes a network that is a target of topology estimation processing, and collects all the collected MAC learnings. Analyze the table. This corresponds to processing by the MAC learning table analysis processing unit 110.

  Next, the topology estimation apparatus 100 extracts MAC addresses with low reliability based on the analysis result by the MAC learning table analysis processing unit 110, and excludes the extracted MAC addresses from the topology estimation processing. This corresponds to processing by the MAC learning table correction processing unit 120.

  Furthermore, the topology estimation apparatus 100 estimates the connection relationship between communication apparatuses using data from which data with low reliability is excluded by the MAC learning table correction processing unit 120. This corresponds to processing by the topology creation processing unit 130. Here, it is assumed that the network to be subjected to the topology estimation processing by the topology estimation apparatus 100 is a communication network having a one-to-many tree structure.

  Here, the configuration of each table provided in the topology estimation apparatus 100 will be described with reference to FIGS. 6 to 11. As shown in FIG. 6, the analysis MAC learning table 140 includes “learning group”, “device”, “port”, “learning MAC address”, and “IF classification” as items. The “learning group” is information for further grouping the learning units of the ports included in the communication device to be processed by the topology estimation device 100, and corresponds to a VLAN (Virtual Local Area Network) ID. “Apparatus” is each communication apparatus to be processed by the topology estimation apparatus 100, and each communication apparatus holds a MAC learning table. The “port” is a port included in a communication device to be processed by the topology estimation device 100. The “learning MAC address” is a MAC address learned for each communication device and each port. “IF classification” is information for identifying a port (for a higher-level device) in the direction of the root node of the network.

  As shown in FIG. 7, the per-MAC pattern table 150 includes “learning group”, “learned MAC address”, “routed switch pattern”, “pattern number”, “analysis presence / absence”, and “MAC classification” as items. The “learning group” is information for further grouping learning units of ports included in a communication device (for example, a Layer 2 switch) to be processed by the topology estimation device 100. The “learning MAC address” is a learning MAC address held in the analysis MAC learning table 140. The “routed switch pattern” is a communication device group through which the learning MAC address passes. The “pattern number” is a learning MAC address and a serial number assigned to the relay switch. “Analysis presence / absence” is information for identifying whether or not the MAC address is to be processed by the topology estimation apparatus 100. “MAC classification” is information for identifying a MAC address (for a higher-level device) in the direction of the root node of the network.

  As shown in FIG. 8, the pattern reliability table 160 includes “pattern number”, “number of owned MACs”, “number of connected via switches”, “analysis presence / absence”, and “pattern classification” as items. The “pattern number” is a learning MAC address and a serial number assigned to the relay switch. The “number of owned MACs” is the number of MACs for each pattern number in the pattern table for each MAC. The “number of via connection switches” is the number of switches in the via switch pattern corresponding to the pattern number. “Analysis presence / absence” is information for identifying whether or not the pattern is to be processed by the topology estimation apparatus 100. “Pattern classification” is information for identifying a pattern related to the root node direction of the network (for a higher-level device).

  As shown in FIG. 9, the device-by-device pattern totaling table 170 includes “device” and “number of patterns” as items. “Apparatus” is each communication apparatus to be processed by the topology estimation apparatus 100. The “number of patterns” is the number of patterns for each device included in the per-MAC pattern table 150.

  As shown in FIG. 10, the port-by-port pattern table 180 includes “learning group”, “routed port pattern”, “pattern number”, and “pattern type” as items. The “learning group” is information for further grouping the learning units of the ports included in the communication device to be processed by the topology estimation device 100. The “route port pattern” is a communication device through which the learning MAC address passes and a port of the communication device. The “pattern number” is a serial number assigned to the learning MAC address and the transit switch. The “pattern type” is information for identifying whether the “pattern number” is a pattern related to the root node direction of the network.

  As illustrated in FIG. 11, the connection destination table 190 includes “connection source device”, “connection source port”, “connection destination device”, and “connection destination port” as items. The “connection source device” is a communication device that is a connection source. The “connection source port” is a port that is provided in the connection source device and is the connection source. The “connection destination device” is a communication device that is a connection destination. The “connection destination port” is a port that is provided in the connection destination device and is a connection destination.

  Next, processing performed by the MAC learning table analysis processing unit 110 will be described with reference to FIG. In S1200, the MAC learning table analysis processing unit 110 reads the MAC learning table from each communication device in the network to be processed, associates the read identification information of each communication device with the read MAC learning table, and performs analysis MAC learning. Save in table 140.

  In S1202, the MAC learning table analysis processing unit 110 refers to the analysis MAC learning table 140, extracts communication devices existing on the path from the leaf node to the root node for each MAC address corresponding to the leaf node, A pattern table 150 for each MAC is created. Further, the MAC learning table analysis processing unit 110 assigns the same pattern number to the same combination of communication devices included in the “routed switch pattern” column in the per-MAC pattern table 150, and the per-MAC pattern table 150. Fill in the “Pattern Number” field.

  In S1204, the MAC learning table analysis processing unit 110 refers to the pattern table 150 for each MAC, and for each “pattern number”, the number of corresponding learning MAC addresses and the number of communication devices included in the “via switch pattern” column. And calculate. Then, the MAC learning table analysis processing unit 110 stores the calculated “pattern number”, the number of learning MAC addresses, and the number of communication devices in the pattern reliability table 160 in association with each other.

  Further, in S1206, the MAC learning table analysis processing unit 110 displays the pattern reliability table 160 on a display device included in the topology estimation apparatus 100.

  Next, processing performed by the MAC learning table correction processing unit 120 will be described with reference to FIG. In S1300, the MAC learning table correction processing unit 120 receives a lower limit number n of the number of owned MACs and an upper limit number o of the number of relay switches from the user.

  In S1302, the MAC learning table correction processing unit 120 refers to the pattern reliability table 160, and extracts and extracts patterns in which the number of owned MACs is “n” or less and the number of connected switches is “o” or less. The “analysis presence / absence” column corresponding to the pattern is excluded from the analysis target. It is estimated that there is a possibility that data loss due to aging processing etc. has occurred for patterns with a small number of owned MACs, and that data related to the root node for patterns with a large number of transit connection switches By being estimated. That is, the MAC learning table correction processing unit 120 determines that a pattern that satisfies these two requirements at the same time is data with low reliability and excludes the data from the analysis target.

  In step S <b> 1302, the MAC learning table correction processing unit 120 refers to the pattern table 150 for each MAC, and deletes the learning MAC address corresponding to the pattern determined not to be analyzed from the analysis MAC learning table 140. In this way, the topology estimation apparatus 100 enables the analysis MAC learning table 140 to be corrected, and improves the accuracy of topology estimation when a MAC address is lost due to aging processing or the like.

  Next, processing by the topology creation processing unit 130 will be described with reference to FIG. The topology creation processing unit 130 estimates a network configuration having a tree structure topology. In S1400, the topology creation processing unit 130 receives the lower limit number p of the number of owned MACs and the lower limit number q of the number of transit switches from the user. Then, the topology creation processing unit 130 refers to the pattern reliability table 160 and extracts a pattern in which the number of owned MACs is “p” or less and the number of transit connection switches is “q” or more. Then, topology creation processing unit 130 stores the identifier of the port for the higher-level device in the “pattern classification” column corresponding to the extracted pattern. Here, the host device port is a port included in each communication device, and is a port connected to another communication device in the root node direction.

  In step S <b> 1400, the topology creation processing unit 130 refers to the pattern reliability table 160, and sets the upper port in the “MAC classification” column of the per-MAC pattern table 150 and the “IF classification” column of the analysis MAC learning table 140. Stores an identifier.

  In S 1402, the topology creation processing unit 130 refers to the analysis MAC learning table 140, and sets a combination of a communication device on a path from each leaf node to the root node and a port used by the communication device in the “per port pattern table 180”. Stored in the “via port pattern” column. The topology creation processing unit 130 assigns the same pattern number to the same combination in the “routed port pattern” and stores it in the “pattern number” column of the per-port pattern table 180.

  In step S <b> 1404, the topology creation processing unit 130 refers to the per-MAC pattern table 150, totals the number of pattern numbers corresponding to each communication device, and stores the total result in the per-device pattern total table 170. Here, since the analysis target of the topology estimation apparatus 100 is a tree structure, it indicates that a communication apparatus having a larger “number of patterns” in the pattern totalization table 170 for each apparatus exists in a hierarchy closer to the root node in the network. .

  In S1406, the topology creation processing unit 130 estimates the connection relationship between the communication devices. The topology creation processing unit 130 determines that communication devices are connected to the communication devices included in the “route port pattern” column of the port-by-port pattern table 180 in descending order of the “number of patterns” in the device-by-device pattern aggregation table 170. presume. Then, topology creation processing unit 130 estimates that the port for the lower device of the upper device is connected to the port of the device included in the pattern that is not the “upper port” port in port-by-port pattern table 180. Further, the topology creation processing unit 130 estimates that the port for the higher-level device of the lower-level device is connected by the port for the higher-level device in the port-by-port pattern table 180. Then, topology creation processing unit 130 stores the estimated connection relationship of the communication devices in connection destination table 190.

  Based on the operation principle described above, the topology estimation apparatus 100 numerically calculates the reliability of each MAC address learned in the MAC learning table, and excludes MAC addresses with low reliability to obtain a highly accurate network topology. Can be estimated.

(Example of processing by topology estimation device according to this embodiment)
A processing example by the topology estimation apparatus 100 will be described with reference to FIGS. 15 to 29. As shown in FIG. 15, in this processing example, topology estimation apparatus 100 estimates the configuration of a communication network having a one-to-many tree structure. Here, the configuration of the communication network is a connection relationship of communication devices (Layer 2 switches) included in the communication network.

  In FIG. 15, the leaf node of the communication network is a subscriber device, and m1, m2, m3, m4, m5, m6 and m7 described at the bottom of each subscriber device are the MAC addresses of each subscriber device. The root node of the communication network is an authentication router, and the MAC address of the authentication router is mr. Further, SW-1, SW-2, SW-3, SW-4, and SW-5 are Layer2 switches, and each switch holds a MAC learning table. IF1, IF2, and IF3 are transmission / reception ports of each switch, and m1, m2, m3, m4, m5, m6, m7, and mr described in the vicinity of IF1, IF2, and IF3 are set on the MAC learning table. The MAC address learned in association with the port.

  Further, as shown in FIG. 15, it is assumed that the MAC address of m4 is missing due to the aging process in the MAC learning table of the switch SW-2.

(1) Processing by MAC Learning Table Analysis Processing Unit 110 Here, this processing example will be described again using the flowchart shown in FIG. In S1200, the MAC learning table analysis processing unit 110 reads the MAC learning table held by each of the switches SW-1, SW-2, SW-3, SW-4, and SW-5, which are the topology analysis targets, and the analysis MAC learning table. Stored in 140. As shown in FIG. 16, in the analysis MAC learning table 140, the switch from which the MAC learning table is read and the contents of the MAC learning table held by the switch are held in association with each other.

  In step S <b> 1202, the MAC learning table analysis processing unit 110 stores each item of the per-MAC pattern table 150 based on the analysis MAC learning table 140. That is, in the per-MAC pattern table 150, all the switches held in association with each MAC address on the analysis MAC learning table 140 are extracted, and the extracted switches are listed for each MAC address. In step S <b> 1202, the MAC learning table analysis processing unit 110 assigns a pattern number to each combination in the “routed switch pattern” in the per-MAC pattern table 150 and stores it in the “pattern number” field. Then, as shown in FIG. 17, the MAC learning table analysis processing unit 110 assigns five pattern numbers.

  Further, in S1204, the MAC learning table analysis processing unit 110 stores each item of the pattern reliability table 160 based on the pattern table 150 for each MAC. For example, since the pattern 1 corresponds to the learning MAC addresses m1 and m2, the number of owned MACs is 2, and the transit switch pattern stores SW-1, SW-2, and SW-3. The number of switches is 3. On the other hand, since the pattern 3 corresponds to only the learning MAC address m3, the number of possessed MACs is 1, and since the SW-1 and SW-4 are stored in the via switch pattern, the number of via connection switches is 2. Become. FIG. 18 shows the pattern reliability table 160 generated in S1204.

  In step S1206, the MAC learning table analysis processing unit 110 displays the pattern reliability table 160 illustrated in FIG. 18 on the display device, and the processing by the MAC learning table analysis processing unit 110 ends.

(2) Processing by MAC Learning Table Correction Processing Unit 120 Here, this processing example will be described again using the flowchart shown in FIG. In S1300, the MAC learning table correction processing unit 120 receives correction conditions “n” and “o” of the analysis MAC learning table 140 from the user. In this processing example, “n = 2” and “o = 5” are set.

  In S1302, the MAC learning table correction processing unit 120 extracts a pattern in which the number of owned MACs is “n = 2” or less and the number of connected switches is “o = 5” or less in the pattern reliability table 160. . Then, as illustrated in FIG. 19, the MAC learning table correction processing unit 120 extracts the pattern 3 and stores an identifier that is not to be analyzed by the topology estimation apparatus 100 in the “analysis presence / absence” column of the pattern 3. In the pattern reliability table 160, the MAC learning table correction processing unit 120 estimates that the smaller the number of retained MACs is, the more the pattern is related to data loss, and the larger the number of relay connection switches is, the more the pattern is related to the authentication router. Presume that there is.

  In S <b> 1302, the MAC learning table correction processing unit 120 stores an identifier that is not subject to analysis in the “analysis presence / absence” column of pattern 3 in the per-MAC pattern table 150 as shown in FIG. 20. Next, since the pattern 3 corresponds to the MAC address m4 in the per-MAC pattern table 150, the MAC learning table correction processing unit 120 deletes the MAC address m4 from the analysis MAC learning table 140 as shown in FIG. 21 in S1302. That is, the MAC learning table correction processing unit 120 determines that the reliability of the pattern 3 is low, and thus the topology estimation apparatus 100 can exclude the missing MAC address m4 from the processing target data by the aging process.

(3) Processing by Topology Creation Processing Unit 130 Here, this processing example will be described again using the flowchart shown in FIG. In step S1400, the topology creation processing unit 130 accepts the determination conditions “p” and “q” for the host device port from the user. In this processing example, “p = 1” and “q = 5”. In the case of a tree topology, the port for the host device has a characteristic that the pattern (the number of owned MACs) is small and the number of connection switches is close to the total number of switches in the network.

  In S1400, the topology creation processing unit 130 extracts a pattern in which the number of owned MACs is “p = 1” or less and the number of connected switches is “q = 5” or more in the pattern reliability table 160. . Then, as illustrated in FIG. 22, the topology creation processing unit 130 extracts the pattern 5 and stores an identifier indicating that the port is for the higher-level device in the “pattern classification” column of the pattern 5. In the pattern reliability table 160, the topology creation processing unit 130 estimates that the smaller the number of owned MACs, the more the pattern is related to the port for the higher-level device, and the higher the number of relay connection switches (the number of hops), Presume that the pattern is related to the port.

  Next, in S1400, the topology creation processing unit 130 stores an identifier for the upper device port in the “MAC classification” column of the pattern 5 in the per-MAC pattern table 150 as shown in FIG. Furthermore, since the pattern 5 corresponds to the MAC address mr, in S1400, the topology creation processing unit 130 sets the port for the upper apparatus in the “IF classification” column corresponding to the MAC address mr of the analysis MAC learning table 140 as shown in FIG. Is stored.

  In S1402, the topology creation processing unit 130 stores each item of the per-port pattern table 180 based on the analysis MAC learning table 140 shown in FIG. For example, since the MAC address m1 corresponds to “SW-1 IF1”, “SW-2 IF1”, and “SW-3 IF1”, the “route port pattern” column includes “SW-1 IF1, SW-2 IF1”. , SW-3 IF1 ”. Further, since the MAC address m6 corresponds to “SW-1 IF2” and “SW-5 IF1”, the “route port pattern” column is “SW-1 IF2, SW-5 IF1”. FIG. 25 shows the port-by-port pattern table 180 generated in S1402.

  In step S <b> 1404, the topology creation processing unit 130 stores each item of the per-device pattern tabulation table 170 based on the per-MAC pattern table 150 shown in FIG. 23. At this time, the topology creation processing unit 130, except for the data corresponding to the pattern 3 with the identifier not to be analyzed and the data corresponding to the pattern 5 with the identifier indicating that the port is a host device, Each item of the pattern totaling table 170 is stored. For example, since the switch SW-1 has three patterns, pattern 1, pattern 2, and pattern 4, 3 is stored in the “number of patterns” column of the pattern totaling table 170 for each device. Further, since the switch SW-4 is only the pattern 2, 1 is stored in the “number of patterns” column of the pattern totaling table 170 for each device. FIG. 26 shows the per-device pattern tabulation table 170 generated in S1404.

  Next, in S1406, the topology creation processing unit 130 estimates the connection relationship between the Layer2 switches based on the per-device pattern totaling table 170 and the per-port pattern table 180. Here, the details of the connection topology creation processing by the topology creation processing unit 130 in S1406 will be described using the flowchart shown in FIG.

  The topology creation processing unit 130 repeats the process starting at S2700-1 and ending at S2700-2 for each pattern number in the per-port pattern table 180. Here, if the pattern number being processed by the topology creation processing unit 130 is i, i = 1 to 7 (i is a natural number) in this processing example. The topology creation processing unit 130 repeats the process starting at S2702-1 and ending at S2702-2 for each switch included in each pattern in the per-port pattern table 180. Here, assuming that the switch on which the processing is performed by the topology creation processing unit 130 is j, in this processing example, when i = 1, the switches j = SW−1, SW−2 and SW−3, i = 5 In this case, the switches j = SW-1 and SW-5.

  In S2704, the topology creation processing unit 130 refers to the device-by-device pattern totaling table 170, and extracts the switches X that are included in the pattern i and that are larger than the number of patterns of the switch j and the minimum number of patterns. . If the switch X can be extracted in S2704, the process proceeds to S2706. If the switch X cannot be extracted in S2704, the process proceeds to S2702-2.

  In S2706, the topology creation processing unit 130 proceeds to S2708 when the switch j and the switch X are included in the higher-level device pattern of the per-port pattern table 180. On the other hand, if the switch j and the switch X are not included in the pattern for the higher-level device in the port-by-port pattern table 180 in S2706, the topology creation processing unit 130 proceeds to S2702-2.

  In step S <b> 2708, the topology creation processing unit 130 stores the items of the connection destination table 190 by executing the following processing from <1> to <4>. <1> The topology creation processing unit 130 stores the switch j in the “connection source device” column. <2> The topology creation processing unit 130 stores the port of the switch j included in the higher-level device pattern in the “connection source port” column. <3> The topology creation processing unit 130 stores the switch X in the “connection destination device” column. <4> The topology creation processing unit 130 stores the port of the switch X included in the pattern i in the “connection destination port” column.

  Here, a part of the connection topology creation processing (S1406) in this processing example will be described with reference to FIG. Here, the processing when the pattern number i = 1 is specifically described, but the processing when the pattern number i = 2 to 7 is performed in the same manner.

  For SW-1 of per-port pattern 1 (i = 1), referring to per-device pattern tabulation table 170, the number of patterns among SW-1, SW-2, and SW-3 included in per-port pattern 1 is as follows. Maximum. Therefore, there is no upper connection target for SW-1 (corresponding to the case where “cannot be extracted” in S2704).

  For SW-2 of the port-by-port pattern 1 (i = 1), referring to the device-by-device pattern tabulation table 170, SW-1 is extracted as the switch X because SW-1 matches the condition of S2704. Next, referring to the port-specific pattern table 180, the switches SW-2 and SW-1 (switch X) are included in the higher-level device pattern (corresponding to “when included” in S2706), and thus the process proceeds to S2708. . In S2708, referring to the port-specific pattern table 180, SW-2 is stored in the “connection source device” column, IF3 is stored in the “connection source port” column, and “connection destination device” column is stored. SW-1 is stored, and IF1 is stored in the “connection port” column.

  For SW-3 of port-by-port pattern 1 (i = 1), referring to the device-by-device pattern tabulation table 170, SW-2 is extracted as the switch X because SW-2 matches the condition of S2704. Next, referring to the port-specific pattern table 180, the switches SW-3 and SW-2 (switch X) are included in the higher-level device pattern (corresponding to “when included” in S2706), and thus the process proceeds to S2708. . In S2708, referring to the port-specific pattern table 180, SW-3 is stored in the “connection source device” column, IF3 is stored in the “connection source port” column, and “connection destination device” column is stored. SW-2 is stored, and IF1 is stored in the “connection port” column.

  FIG. 29 shows the result of executing the connection topology creation processing (S1406) described above for all the pattern numbers i (= 1 to 7) for each port. That is, the topology creation processing unit 130 indicates the connection relationship of the switches SW-1, SW-2, SW-3, SW-4, and SW-5 that configure the network shown in FIG. Estimate as follows.

  As described above, the topology estimation apparatus 100 is missing a part of the MAC learning table of the communication apparatus to be analyzed for topology by performing the processing described in (1), (2), and (3) above. Even in this case, it is possible to estimate the topology of the network having a one-to-many tree structure.

  Although the embodiment of the present invention has been described in detail above, the present invention is not limited to the specific embodiment, and various modifications are possible within the scope of the gist of the present invention described in the claims.・ Change is possible.

100 topology estimation device 110 MAC learning table analysis processing unit 120 MAC learning table correction processing unit 130 topology creation processing unit 140 analysis MAC learning table 150 pattern table for each MAC 160 pattern reliability table 170 pattern totaling table for each device 180 pattern table for each port 190 Destination table

Claims (8)

A topology estimation device for estimating a connection relationship of a plurality of communication devices included in a communication network,
Each of the communication devices holds transmission destination information that associates a transmission / reception port of each communication device with a communication device corresponding to a leaf node of a topology connected via the transmission / reception port or an address of a communication device corresponding to a root node of the topology. If
A transmission destination information list generation unit configured to acquire the transmission destination information held by each of the plurality of communication apparatuses and generate a transmission destination information list that associates the transmission destination information with the communication apparatus that is the acquisition source of the transmission destination information; ,
Grouping means for grouping the leaf node and the root node based on the combination of the communication devices existing on the path from the leaf node to the root node based on the destination information list;
Group selection means for selecting one or more groups that match a predetermined rule regarding the number of leaf nodes and root nodes corresponding to each group and the number of communication devices corresponding to each group;
Topology estimation means for estimating a connection relation of the communication device based on the destination information list excluding data on the leaf node and root node corresponding to the selected group. apparatus.   The predetermined rule is a rule in which the number of leaf nodes and root nodes is equal to or less than a predetermined number of nodes, and the number of communication devices is equal to or less than a predetermined number of communication devices. The topology estimation apparatus described in 1.   The topology estimation means, when estimating a network topology in which a connection relation of a plurality of communication devices included in a communication network is a one-to-many tree structure, for each communication device, in the combination of the communication devices, The number of the groups including each communication device as an element is calculated, and the connection relationship of the communication devices is estimated based on the calculated number of the groups for each communication device. Topology estimation device. When estimating a network topology in which a connection relationship of a plurality of communication devices included in a communication network has a one-to-many tree structure, the number of leaf nodes and root nodes is equal to or less than a predetermined number of nodes, and the communication Second group selection means for selecting the group in which the number of devices is equal to or greater than a predetermined number of communication devices;
The topology estimation unit estimates the transmission / reception port corresponding to the group selected by the second group selection unit as a transmission / reception port in the root node direction in each communication device. 4. The topology estimation apparatus according to any one of 3. A topology estimation method for estimating a connection relation of a plurality of communication devices included in a communication network,
Each of the communication devices holds transmission destination information that associates a transmission / reception port of each communication device with a communication device corresponding to a leaf node of a topology connected via the transmission / reception port or an address of a communication device corresponding to a root node of the topology. If
A transmission destination information list generation unit acquires the transmission destination information held by each of the plurality of communication devices, and generates a transmission destination information list that associates the transmission destination information with the communication device from which the transmission destination information is acquired. And steps to
Grouping means grouping the leaf node and the root node on the basis of the combination of the communication devices existing on the route from the leaf node to the root node based on the destination information list; ,
A group selecting means selecting one or more groups that match a predetermined rule regarding the number of leaf nodes and root nodes corresponding to each group and the number of communication devices corresponding to each group; ,
Topology estimating means, comprising: estimating a connection relation of the communication device based on the destination information list excluding data on the leaf node and root node corresponding to the selected group, Topology estimation method.   6. The predetermined rule is a rule in which the number of leaf nodes and root nodes is equal to or less than a predetermined number of nodes, and the number of communication devices is equal to or less than a predetermined number of communication devices. The topology estimation method described in 1.   The topology estimation means, when estimating a network topology in which a connection relation of a plurality of communication devices included in a communication network is a one-to-many tree structure, for each communication device, in the combination of the communication devices, The number of the groups including each communication device as an element is calculated, and the connection relation of the communication devices is estimated based on the calculated number of the groups for each communication device. Topology estimation method. When estimating a network topology in which a connection relationship of a plurality of communication devices included in a communication network is a one-to-many tree structure, the second group selection unit has the number of leaf nodes and root nodes equal to or less than a predetermined number of nodes. And selecting the group in which the number of communication devices is equal to or greater than a predetermined number of communication devices,
The topology estimation unit estimates the transmission / reception port corresponding to the group selected by the second group selection unit as a transmission / reception port in the root node direction in each communication device. 8. The topology estimation method according to any one of 7.