JP5523372B2 - Multicast flow monitoring system and multicast flow acquisition analysis method - Google Patents

Description

  The present invention relates to a technique for collecting flow information of multicast traffic flowing through a network and notifying other devices of the flow information.

  For example, NetFlow and IPFIX are techniques for collecting information on the flow of traffic that has passed in a packet communication device such as a router constituting a network and notifying other devices. A device having a function of generating flow information and notifying other devices in this way is called an exporter, and a device that receives flow information and performs various analyzes is called a collector (a flow monitoring device or the like) Patent Document 1, Non-Patent Document 2).

  An outline of the operation of a packet communication apparatus as a conventional exporter related to multicast traffic will be described with reference to FIG. FIG. 1 shows a router as an example of the packet communication apparatus. In FIG. 1, IF1 is shown as an interface on the input side in the router, and IF2, IF3, IF4, and IF5 are shown as interfaces on the output side.

  As shown in FIG. 1, a packet related to multicast flow 1 (source address: A, destination address: B) is input from the input side IF1 to the router, and the input packet is copied and output as a plurality of identical packets. Output from each interface. On the other hand, flow information (data / flow set) is generated based on the header information of the input packet and stored in a flow information storage unit (buffer memory or the like) in the router. The data flow set stored in the flow information storage unit is sequentially read out, packetized in a predetermined format, and transmitted to the collector.

B. Claise "Cisco Systems NetFlow Services Export Version 9," RFC3954, Oct 2004. B. Claise, G. Dhandapani, P. Aitken, S. Yates, "Export of Structured Data in IPFIX," draft-ietf-ipfix-structured-data-03.txt, Oct 2010.

  As shown in FIG. 1, the data flow set fields include a source address (SRC_ADDR), a destination address (DST_ADDR), input side interface identification information (INPUT_IF), packet count information (PKTS), and output side interface identification. Information (OUTPUT_IF) etc. are included. However, in the technique described in Non-Patent Document 1, since there is only one field of the output side interface identification information, when a plurality of multicast packets are copied, it is possible to determine which output interface the multicast packets flow to. There is a problem that cannot be grasped from the set.

  On the other hand, as a conventional method for solving the above problem, there is a technique of dynamically changing the number of fields in accordance with the number of packet copies as shown in FIG. 2 (Non-patent Document 2).

  However, in the above-described conventional method, the number of copies increases / decreases due to the user joining / leaving the multicast group, so that the field (memory) management of the OUTPUT_IF becomes complicated. Even if the number of fields is statically secured, field setting that assumes the maximum number of copies is required, so that there is a problem that a division loss occurs in a multicast flow with a small number of copies.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique that enables efficient grasping to which output interface a multicast flow is flowing in a packet communication device. .

In order to solve the above problems, the present invention is a multicast flow monitoring system for monitoring a multicast flow in a communication network,
The multicast flow monitoring system has a packet communication device on the communication network and a flow monitoring device connected to the packet communication device,
The packet communication device is:
First flow information generating means for generating first flow information including identification information of the input interface based on the multicast flow input from the input interface, and storing the first flow information in the flow information storage means;
A second group that includes, for each output interface, monitoring the participation and leaving of the multicast group related to the multicast flow, and when a certain output interface is detected to join or leave the multicast group, Second flow information generation means for generating flow information and storing the second flow information in the flow information storage means;
Flow information transmission means for transmitting the first flow information and the second flow information stored in the flow information storage means to the flow monitoring device;
The flow monitoring device includes:
Receiving the first flow information and the second flow information from the packet communication apparatus, and based on the first flow information and the second flow information, the input interface and the output interface through which the multicast flow passes. It is configured as a multicast flow monitoring system characterized by having an analysis means for linking.

  The second flow information generation means may detect participation or withdrawal from the multicast group based on multicast routing information managed by the packet communication device.

  The first flow information and the second flow information each include a source address and a destination address related to the multicast flow, and further, the first flow information includes packet count information related to the multicast flow, and the flow The analysis unit of the monitoring device may associate the input interface, the output interface, and the packet count information based on the transmission source address and the destination address.

  The second flow information includes event identification information for identifying participation or withdrawal, and an event time that is a time at which participation or withdrawal is detected, and the analysis means of the flow monitoring device is configured to analyze the event in the second flow information. Based on the identification information and the event time, a communication time from joining to leaving of the multicast flow may be calculated.

The flow information transmitting unit is configured to detect the first flow information and the second flow information stored in the flow information storage unit every time when participation or withdrawal from the multicast group is detected or for each preset number of events. Flow information may be transmitted to the flow monitoring device.

  The present invention can also be configured as a multicast flow information acquisition and analysis method executed by the multicast flow monitoring system.

  According to the present invention, it is possible to efficiently grasp to which output interface the multicast flow is flowing in the packet communication apparatus. Further, by using the participation / leaving information and the time information in the second flow information, it is possible to grasp when the multicast flow is flowing to which output interface.

It is a figure for demonstrating the operation | movement outline | summary of the packet communication apparatus as a conventional exporter. It is a figure which shows the conventional method of changing the number of fields dynamically according to the number of copies. 1 is an overall configuration diagram of a system in an embodiment of the present invention. 2 is a functional configuration diagram of a packet communication device 10. FIG. 2 is a functional configuration diagram of a flow monitoring device 20. FIG. It is a flowchart for demonstrating operation | movement of a system. It is a figure which shows the example of the data flow set stored in the flow information storage part. It is a figure which shows the example of the template flow set only for a multicast event. 3 is a diagram illustrating an example of a data flow set received by the flow monitoring apparatus 20 from the packet communication apparatus 10. FIG. It is a figure which shows the example of the analysis result obtained by the flow information analysis part 22. 4 is a diagram illustrating an example of information displayed on a flow monitoring device 20. FIG.

  Embodiments of the present invention will be described below with reference to the drawings.

(System configuration)
FIG. 3 shows the overall configuration of the system according to the embodiment of the present invention. As shown in FIG. 3, the system according to the present embodiment has a configuration in which a flow monitoring device 20 is connected to a packet communication device 10 (assuming a router in the present embodiment) that performs packet transfer in a communication network such as the Internet. Have FIG. 3 also shows a plurality of packet communication devices that connect user terminals. In this embodiment, the packet communication device 10 is a multicast flow measurement point, the packet communication device 10 has an exporter function in a flow technology such as NetFlow or IPFIX, and the flow monitoring device 20 has a collector function. .

  FIG. 4 shows a functional configuration diagram of the packet communication apparatus 10. FIG. 4 mainly shows functions related to the embodiment of the present invention, among the functions of the packet communication device 10 as a router. As shown in FIG. 4, the packet communication device 10 includes an IF1 that is an interface on the input side, IFs 2 to 6 that are interfaces on the output side, a packet transfer control unit 11, a routing function unit 12, a flow information generation unit 13, and flow information. A storage unit 14 and a flow information transmission unit 15 are provided.

  Each interface IF is the same as the interface shown in FIG. In the present embodiment, the flow information (packetized flow information) is transmitted from the output side IF 6 to the flow monitoring apparatus. The “flow information” in the present embodiment is a data flow set.

  The packet transfer control unit 11 is a functional unit that transfers an input packet to an output-side interface corresponding to a transmission destination based on routing information.

  The routing function unit 12 monitors and detects whether a user joins or leaves the multicast group, and reflects the join / leave in the multicast routing information (including the multicast packet source address, destination address, and output side interface identification information). It has a function to do. The multicast routing information is stored in storage means such as a memory.

  For example, when participation is detected from a certain output-side interface, multicast routing information for transferring a multicast packet to the output-side interface is added, and then separation (no participation user terminal) is detected. The multicast routing information is deleted.

  The flow information generation unit 13 has a function of generating flow information (data / flow set) based on the header information of the input packet and the like and storing it in the flow information storage unit 14. The flow information storage unit 14 is a buffer memory or the like that stores flow information. The flow information transmission unit 15 is a functional unit that reads flow information from the flow information storage unit 14, packetizes it, and transmits it to the flow monitoring device 20.

  The function unit including the flow information generation unit 13, the flow information storage unit 14, and the flow information transmission unit 15 has a flow information generation / notification function based on the existing flow technology, as well as flow information (data A function of generating and notifying a flow set). Details of this function will be described later in the explanation of the operation.

  The functional unit including the flow information generation unit 13, the flow information storage unit 14, and the flow information transmission unit 15 in the packet communication device 10 describes the processing contents described in the present embodiment in a router or the like as the packet communication device 10. This can be realized by executing the program. In addition, the functional unit can be realized by a hardware circuit.

  FIG. 5 shows a functional configuration diagram of the flow monitoring apparatus 20. As shown in FIG. 5, the flow monitoring apparatus 20 includes a flow information receiving unit 21, a flow information analyzing unit 22, and an analysis result display unit 23. The flow information receiving unit 21 has a function of receiving flow information and the like from the packet communication device 10 and passing them to the flow information analyzing unit 22. The flow information analysis unit 22 has a function of analyzing the flow information received from the flow information reception unit 21 and holding the analysis result in a memory or the like. The analysis result display unit 23 displays the analysis result. Details of the analysis will be described later in the explanation of the operation.

  The flow monitoring apparatus 20 can be realized, for example, by causing a general computer to execute a program describing the processing content described in the present embodiment. Further, the function of the flow monitoring apparatus 20 can be provided as one function in the network monitoring apparatus.

(System operation)
Hereinafter, the operation of the system according to the present embodiment will be described with reference to the flowchart of FIG.
In the following example, the same multicast flow 1 as described in FIG. 1 is input to the input-side IF 1, copied according to the multicast routing information, and output from the output-side IFs 2 to 5 (all or a part thereof). To do.

  Further, the routing function unit 12 constantly monitors and detects the user joining and leaving the multicast group according to a predetermined protocol, and the detection result is sent to the multicast routing information (source address, destination address, output side interface). Information).

  Further, the flow information generation unit 13 generates normal flow information (data flow set) related to the multicast flow 1 and stores the flow information in the flow information storage unit 14 as in FIG.

  Based on the above assumption, the flow information generation unit 13 of the packet communication device 10 sequentially acquires multicast routing information from the routing function unit 12 (step 1 in FIG. 6). For example, the flow information generation unit 13 acquires multicast routing information from the routing function unit 12 at predetermined time intervals.

  The flow information generation unit 13 monitors participation or withdrawal from the multicast group based on the multicast routing information sequentially acquired from the routing function unit 12 (step 2). For example, regarding the multicast flow of interest (identified by the source address and destination address), it can be determined that “participation” has occurred when multicast routing information including new output side interface identification information is detected. Also, it can be determined that there has been a “detachment” when multicast routing information including the output side interface identification information that has been used so far is no longer detected.

  Using the detection of participation or departure in step 2 as a trigger, the flow information generation unit 13 generates flow information (data flow set) dedicated to multicast events and stores it in the flow information storage unit 14 (step 3). .

  FIG. 7 shows an example of the data flow set stored in the flow information storage unit 14 at this time. As shown in FIG. 7, the flow information storage unit 14 stores a normal data set (similar to that shown in FIG. 1) and a data flow set dedicated to multicast events.

  The data flow set dedicated to multicast events in this embodiment includes a source address (SRC_ADDR), a destination address (DST_ADDR), output side interface identification information (OUTPUT_IF), multicast event identification information (MUL_EVENT), multicast event time ( MUL_EVENT_TIME) field.

  The multicast event identification information (MUL_EVENT) is information indicating whether to join or leave the multicast group corresponding to the corresponding multicast flow. The multicast event time (MUL_EVENT_TIME) is the time when the corresponding event is detected.

  For example, when participation in a multicast group of SRC_ADDR: A and DST_ADDR: B is detected for OUTPUT_IF: 2 at time X, SRC_ADDR: A, DST_ADDR: B, OUTPUT_IF: 2, MUL_EVENT: participation, MUL_EVENT_TIME: A data flow set consisting of X is stored in the flow information storage unit 14. Also, for example, after the above-mentioned participation detection, when the departure from OUTPUT_IF: 2 is detected at time X + Y for the multicast group, SRC_ADDR: A, DST_ADDR: B, OUTPUT_IF: 2, MUL_EVENT: departure, MUL_EVENT_TIME : A data flow set of X + Y is stored in the flow information storage unit 14.

  In step 4 of FIG. 6, the flow information transmission unit 15 transmits a multicast event-dedicated template / flow set to the flow monitoring apparatus 20. The timing for transmitting the multicast event-dedicated template / flow set to the flow monitoring apparatus 20 may be any timing before the multicast event-dedicated data / flow set is transmitted to the flow monitoring apparatus 20.

  The multicast event-dedicated template flow set is data structure definition information that defines the format of the multicast event-dedicated data flow set. With this information, the flow monitoring apparatus 20 can analyze the data flow set. it can. FIG. 8 shows an example of a template flow set corresponding to the multicast event-dedicated data flow set shown in FIG. It is assumed that a template flow set for a normal data flow set has already been sent.

  In step 5 of FIG. 6, the flow information transmission unit 15 performs processing for transmitting the data flow set to the flow monitoring device 20.

  For example, each time a participation or withdrawal event is detected, the flow information transmission unit 15 collects a corresponding normal data flow set and a multicast event dedicated data flow set corresponding to the event, and performs flow monitoring. Transmit to device 20.

  Further, the flow information transmission unit 15 performs a corresponding normal data flow set and a multicast corresponding to the event set each time a set of join and leave events for the same multicast flow / same output interface is detected. These event-dedicated data and flow sets may be collectively transmitted to the flow monitoring apparatus 20.

  Further, the flow information transmission unit 15 generates a corresponding normal data flow set and the above-mentioned number of times each time a set of joining and leaving events for the same multicast flow / same output interface is detected a predetermined number of times. Multicast event-dedicated data flow sets corresponding to minutes may be collectively transmitted to the flow monitoring apparatus 20.

  In addition, the flow information transmitting unit 15 transmits a normal data flow set related to the same multicast flow and a multicast event-dedicated data flow set to the flow monitoring device 20 at a predetermined time interval. Also good.

  The flow information transmission unit 15 transmits the data flow set to the flow monitoring apparatus 20 and then deletes the transmitted data flow set from the flow information storage unit 14. After deletion, a normal data flow set and a multicast event-only data flow set are generated again according to the multicast traffic.

  Note that the transmission of the data flow set as described above is merely an example. The unit and timing at which the data flow set is transmitted may be appropriately changed by setting. Regardless of the unit in which the data flow set is transmitted, the flow monitoring apparatus 20 side uses the information of the transmission source address and the destination address of the data flow set, the input side interface, the output side interface, and the packet count information. Further, it is possible to calculate the multicast communication time based on the information on the multicast join / leave time.

  The protocol used for transmitting the data flow set is not limited to a specific protocol, but for example, SNMP Trap, NetFlow, and IPFIX can be used.

  The flow monitoring device 20 that has received the data / flow set transmitted from the packet communication device 10 as described above analyzes the data / flow set by the flow information analysis unit 22 and the analysis result by the analysis result display unit 23. Is displayed (step 6 in FIG. 6).

  For example, it is assumed that the flow monitoring apparatus 20 receives the data flow set shown in FIG. 9 from the packet communication apparatus 10. At this time, the flow information analysis unit 22 inputs a multicast flow corresponding to the source address / destination address from a normal data flow set and a multicast event dedicated data flow set having a common source address and destination address. The side interface and the output side interface are extracted, and the packet count information of the multicast flow is extracted from the normal data flow set.

  The flow information analysis unit 22 is a data flow set dedicated to multicast events including the source address / destination address, and is a multicast data flow set dedicated to multicast events corresponding to “participation” and multicast corresponding to “leave”. The communication time of the corresponding multicast flow is calculated from the event dedicated data flow set. In the example of FIG. 9, since the time of “participation” is X and the time of “leave” is X + Y, the communication time from participation to departure can be calculated as (X + Y) −X = Y.

  In the example illustrated in FIG. 9, the flow information analysis unit 22 obtains the analysis result illustrated in FIG. The analysis result is stored in a storage unit such as a memory in the flow monitoring apparatus 20. The analysis result display unit 23 can display, for example, the information shown in FIG. 11 from the analysis result (FIG. 10) obtained by the flow information analysis unit 22. This display makes it possible to grasp that multicast traffic (source address: A, destination address: B) with a flow rate H flows from the input IF1 to the output IF2 from the participation time X to the departure time X + Y.

  As described above, by using the technology according to the present embodiment, a new data flow set dedicated to multicast events can be set without changing the existing data flow set management method. Easy management. In addition, the maintenance operator can quickly confirm when the multicast traffic is flowing to which output side interface, and can grasp the usage status of the multicast service (video distribution, etc.) for each user.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

1-6 IF
DESCRIPTION OF SYMBOLS 10 Packet communication apparatus 11 Packet transfer control part 12 Routing function part 13 Flow information generation part 14 Flow information storage part 15 Flow information transmission part 20 Flow monitoring apparatus 21 Flow information reception part 22 Flow information analysis part 23 Analysis result display part

Claims (10)

A multicast flow monitoring system for monitoring a multicast flow in a communication network,
The multicast flow monitoring system has a packet communication device on the communication network and a flow monitoring device connected to the packet communication device,
The packet communication device is:
First flow information generating means for generating first flow information including identification information of the input interface based on the multicast flow input from the input interface, and storing the first flow information in the flow information storage means;
A second group that includes, for each output interface, monitoring the participation and leaving of the multicast group related to the multicast flow, and when a certain output interface is detected to join or leave the multicast group, Second flow information generation means for generating flow information and storing the second flow information in the flow information storage means;
Flow information transmission means for transmitting the first flow information and the second flow information stored in the flow information storage means to the flow monitoring device;
The flow monitoring device includes:
Receiving the first flow information and the second flow information from the packet communication apparatus, and based on the first flow information and the second flow information, the input interface and the output interface through which the multicast flow passes. A multicast flow monitoring system comprising an analysis means for linking. 2. The multicast flow monitoring system according to claim 1, wherein the second flow information generation unit detects participation or withdrawal from the multicast group based on multicast routing information managed by the packet communication device. . The first flow information and the second flow information each include a source address and a destination address related to the multicast flow, and further, the first flow information includes packet count information related to the multicast flow,
The multicast flow according to claim 1 or 2, wherein the analysis unit of the flow monitoring device associates the input interface, the output interface, and the packet count information based on the transmission source address and the destination address. Monitoring system. The second flow information includes event identification information for identifying participation or withdrawal, and an event time that is a time at which participation or withdrawal is detected,
The analysis unit of the flow monitoring device calculates a communication time from joining to leaving of the multicast flow based on the event identification information and the event time in the second flow information. 4. The multicast flow monitoring system according to claim 1. The flow information transmitting unit is configured to detect the first flow information and the second flow information stored in the flow information storage unit every time when participation or withdrawal from the multicast group is detected or for each preset number of events. The multicast flow monitoring system according to any one of claims 1 to 4, wherein flow information is transmitted to the flow monitoring device. A multicast flow information acquisition and analysis method executed by a multicast flow monitoring system for monitoring a multicast flow in a communication network,
The multicast flow monitoring system includes a packet communication device on the communication network and a flow monitoring device connected to the packet communication device, and the multicast flow information acquisition analysis method includes:
First flow information in which the packet communication device generates first flow information including identification information of the input interface based on a multicast flow input from the input interface, and stores the first flow information in a flow information storage unit. Generation step;
The packet communication device monitors the participation and leaving of the multicast group related to the multicast flow for each output interface, and when a certain output interface is detected to join or leave the multicast group, A second flow information generating step of generating second flow information including identification information and storing the second flow information in the flow information storage means;
A flow information transmitting step in which the packet communication device transmits the first flow information and the second flow information stored in the flow information storage means to the flow monitoring device;
The input interface through which the flow monitoring device receives the first flow information and the second flow information from the packet communication device and through which the multicast flow passes based on the first flow information and the second flow information And an analysis step for connecting the output interface to the output interface. The said 2nd flow information generation step WHEREIN: The said packet communication apparatus detects joining or leaving | separation to the said multicast group based on the multicast routing information managed by the said packet communication apparatus. The multicast flow information acquisition and analysis method described. The first flow information and the second flow information each include a source address and a destination address related to the multicast flow, and further, the first flow information includes packet count information related to the multicast flow,
The analysis step according to claim 6 or 7, wherein the flow monitoring device associates the input interface, the output interface, and the packet count information based on the transmission source address and the destination address. Multicast flow information acquisition analysis method. The second flow information includes event identification information for identifying participation or withdrawal, and an event time that is a time at which participation or withdrawal is detected,
In the analyzing step, the flow monitoring device calculates a communication time from joining to leaving of the multicast flow based on the event identification information and the event time in the second flow information. Item 9. The multicast flow information acquisition and analysis method according to any one of Items 6 to 8. In the flow information transmission step, the packet communication device stores the first information stored in the flow information storage unit every time when participation or withdrawal from the multicast group is detected or for each preset number of events. The multicast flow information acquisition and analysis method according to any one of claims 6 to 9, wherein the flow information and the second flow information are transmitted to the flow monitoring device.

Images