JP5587256B2 - Route monitoring apparatus, route monitoring method, and route monitoring program - Google Patents

Description

  The present invention relates to a route monitoring device, a route monitoring method, and a route monitoring program.

  Generally, an IP (Internet Protocol) network is divided into AS (Autonomous System) which is a set of networks operated under the management of a single organization such as a provider. Such routing between ASs is performed by a routing protocol called EGP (Exterior Gateway Protocol) as one aspect. As such EGP, for example, there is BGP (Border Gateway Protocol) that performs path control between ASs.

  In an IP network to which BGP is applied, a BGP message is transmitted and received between ASs, whereby a route of a packet flowing between ASs is determined, and communication between ASs becomes possible. That is, in the communication between ASs, there is a possibility that stable network communication cannot be realized unless the BGP message is normally propagated. For the purpose of realizing stable network communication, in order to monitor whether advertisement of route information such as a BGP message transmitted and received between ASs is normally propagated, conventionally, an agent is installed in each AS to provide route information. There is a technology to observe.

JP-A-11-243422

  However, the conventional technology has a problem that it is not possible to detect a change in the advertised route information, and it is not possible to detect an advertisement of route information other than a route that is properly assigned. Specifically, there is a case where the route information cannot be disclosed depending on the provider or the like holding the AS. In such a case, the route information observed by an agent in another AS different from the own AS is used. The agent cannot use it. In addition, it is difficult to detect when other AS different from its own AS advertises the route information that is not yet advertised although it has its own AS.

  Therefore, the present invention has been made in view of the above, and is capable of detecting a change in advertised route information and detecting an advertisement of route information other than a normally assigned route. It is an object of the present invention to provide a path monitoring apparatus, a path monitoring method, and a path monitoring program that can be used.

  In order to solve the above-described problems and achieve the object, a path monitoring apparatus according to the present invention is a path monitoring apparatus that monitors path information indicating a communication path between autonomous systems connected to a network, and The route information receiving unit that receives the route information from the connected network device, and the route information received by the route information receiving unit are collected. When the collected route information is an update target, the route information is connected to the network. Route information collection that updates all route information indicating all communication routes between the autonomous systems, and adds a deletion flag to the all route information to indicate deletion when the collected route information is to be deleted And the IP address prefix included in the collected route information when the route information collected by the route information collecting unit is an update target. A path fluctuation detection unit that extracts existing path information that matches the path information from the entire path information, compares the extracted existing path information with the collected path information, and detects a fluctuation in path information; and A route that matches the prefix of the IP address included in the route information of the autonomous system in which the change is detected, when the change detection unit detects that the route information of the autonomous system that is the source of the route information has changed. In order to identify the autonomous system from which the fluctuation | variation was detected, and the identification number for identifying the said autonomous system contained in the extracted regular route information which extracts information from the regular route information which shows the normally allocated route information And a path information verification unit that determines that the identification number is abnormal if they do not match.

  According to one aspect of the route monitoring device, the route monitoring method, and the route monitoring program according to the present invention, it is possible to detect a change in the advertised route information, and other than a route that is normally assigned. There is an effect that it is possible to detect advertisement of route information.

FIG. 1 is a diagram illustrating a configuration example of a network to which the route monitoring apparatus according to the first embodiment is applied. FIG. 2 is a diagram illustrating a configuration example of the path monitoring apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of attributes of route information. FIG. 4 is a diagram illustrating an example of all route information. FIG. 5 is a diagram illustrating an example of the route information matching process. FIG. 6 is a diagram illustrating an example of route information matching processing. FIG. 7 is a flowchart illustrating an example of a flow of route monitoring processing according to the first embodiment. FIG. 8 is a diagram showing that the route monitoring program according to the present invention is specifically realized using a computer.

  Embodiments of a route monitoring apparatus, a route monitoring method, and a route monitoring program according to the present invention will be described below with reference to the accompanying drawings. In addition, this invention is not limited by the following examples.

[Network configuration]
A configuration of a network to which the route monitoring apparatus according to the first embodiment is applied will be described with reference to FIG. FIG. 1 is a diagram illustrating a configuration example of a network to which the route monitoring apparatus according to the first embodiment is applied.

  For example, as shown in FIG. 1, the network in the first embodiment includes AS10 to AS30. The AS 10 includes the path monitoring apparatus 100 according to the first embodiment, the router 11, the router 12, and the terminal 13. The AS 20 includes a router 21. The AS 30 includes a router 31 and a Web server 32.

  The router 11 is connected to the router 12, the router 31, and the route monitoring device 100, and transmits / receives route information indicating a communication route between ASs. Such route information is, for example, a BGP message. The router 12 is connected to the router 11, the router 21, the terminal 13, and the route monitoring device 100, and transmits / receives route information to / from the router 11, the router 21, or the route monitoring device 100. In this way, the ASs are connected to each other by connection between routers arranged in each AS. Specifically, in FIG. 1, AS 10 is connected to AS 20 and AS 30, AS 20 is connected to AS 10, and AS 30 is connected to AS 10. Note that the number of ASs and routers is not limited to that illustrated.

  The terminal 13 is arranged in the local network N1 formed in the AS 10. Such a terminal 13 sends and receives packets to and from other terminals and servers via the router 12. The Web server 32 is arranged in the AS 30 and, for example, transmits an HTML (HyperText Markup Language) document or the like to the terminal 13 when accessed from the terminal 13. The route monitoring device 100 monitors route information between ASs connected to the network. Processing performed by the route monitoring apparatus 100 will be described later.

[Configuration of route monitoring device]
Next, the configuration of the route monitoring apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a configuration example of the route monitoring apparatus 100 according to the first embodiment.

  For example, as illustrated in FIG. 2, the route monitoring apparatus 100 includes a storage unit 110 and a control unit 120 and monitors route information between ASs connected to the network. The storage unit 110 stores, for example, data required for various processes by the control unit 120 and various processing results by the control unit 120. The storage unit 110 includes a regular route information storage unit 111. The storage unit 110 is, for example, a semiconductor memory device such as a random access memory (RAM), a read only memory (ROM), and a flash memory, or a storage device such as a hard disk or an optical disk.

  The regular route information storage unit 111 stores route information that is normally assigned by the Internet, routing, registry, or the like. The route information stored by the regular route information storage unit 111 is received and registered by the route monitoring apparatus 100 at an arbitrary timing as one aspect.

  The control unit 120 includes, for example, a control program, a program defining various processing procedures, and an internal memory for storing required data. The control unit 120 includes a route information reception unit 121, a route information collection unit 122, a route fluctuation detection unit 123, a route information collation unit 124, a route information display unit 125, and a route information notification unit 126. It is. The control unit 120 is an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), or an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit).

  The route information receiving unit 121 receives route information from a network device such as a router connected to the network, for example. Here, the route information will be described with reference to FIG. FIG. 3 is a diagram illustrating an example of attributes of route information. For example, as shown in FIG. 3, the route information includes message generation date and time, message type (update, delete), opposite router, own AS number, prefix, AS path, source AS number, The adjacent AS number, the next hop address, and the community are included.

  The message occurrence date and time is information indicating the date and time when a message of route information transmitted and received on the network is generated. The message type (update, delete) is information indicating update (addition) or deletion of route information. The opposite router is information for identifying the router that transmitted the route information. The own AS number is information for identifying an AS including its own route monitoring device. A prefix is information indicating a transmission destination IP address of route information.

  The AS path is information indicating an AS route through which route information is sent and received. The generation source AS number is information that can be extracted from the AS path, and is information indicating an identification number for identifying the AS that is the generation source of the route information. The adjacent AS number is information that can be extracted from the AS path, and is information indicating an identification number for identifying an AS adjacent to the AS including the route monitoring device 100. The next hop address is information indicating an IP address of a router to be relayed next when route information is transmitted to a transmission destination. The community is information indicating a policy when handling route information such as “Do not advertise route information to external AS or other routers”.

  Among these, the route information receiving unit 121 acquires, for example, a prefix, an AS path, a community, and a next hop address, and a route information storage unit (not shown) included in the storage unit 110 for each opposing router and for each time series. ). In the example of FIG. 1, the route information receiving unit 121 acquires a prefix, an AS path, a community, and a next hop address for the route information received from the router 11, and assigns information for identifying the router 11 and a time stamp. And registered in the route information storage unit. The route information receiving unit 121 processes the route information received from the router 12 in the same manner.

  To give a specific example, the route information receiving unit 121 has a prefix “192.168.1.1”, an AS path “2”, a community “2: 65000”, and a next hop address “192.168.”. .1.1 ”and when the route information to be updated generated by the router 31 is received from the router 11,“ Router 11, Time Stamp, 192.168.0.0/24, 2, 2: 65000 ”. , 192.168.1.1, Update ”is registered in the route information storage unit. On the other hand, in the case of the route information to be deleted, the route information receiving unit 121 registers information of “router 11, time stamp, 192.168.0.0/24, Withdraw” in the route information storage unit.

  Further, the route information receiving unit 121 also includes, for example, an all route information storage unit (not shown) included in the storage unit 110 for all route information indicating all communication routes between ASs based on the received route information. To accumulate. As one aspect, the route information receiving unit 121 registers in the all route information storage unit at regular intervals such as one hour.

  Here, the entire route information will be described with reference to FIG. FIG. 4 is a diagram illustrating an example of all route information. For example, as shown in FIG. 4, the entire route information includes a router name, a time stamp, a prefix, an AS path, a community, a next hop address, and an Update / Withdraw. Examples of these data include a router name “Router 11”, a time stamp “2011-03-28 12:34:56”, a prefix “192.168.0.0/24”, an AS path “2”, a community “ 2: 65000 ”, next hop address“ 192.168.1.1 ”, and Update / Withdraw“ Update ”.

  Among these, the route information receiving unit 121, for example, after the “router 11, time stamp”, the route information “192.168.0.0/24, 2, 2: 65000, 192.168.1.1”. And information such as “192.168.1.0/24, 2: 65001, 192.168.1.1” is registered in the all-route information storage unit.

The route information collection unit 122, for example, collects route information received by the route information reception unit 121, and updates the prefix, generation AS number, adjacent AS number, AS path, community, and next hop address route information. If it is, a time stamp is given and the all-route information storage unit is updated for each opposing router. In addition, for example, when the collected route information is a deletion target, the route information collection unit 122 adds a time stamp and sets a deletion flag indicating that it is a deletion target in all the route information storage units for each opposing router. Give.

  For example, the route information collection unit 122 receives the route information to be deleted from the route information receiving unit 121 as “router 11, time stamp, 192.168.0.0/24, Withdraw”. When collected, the route information holding the prefix “192.168.0.0/24” is searched from the entire route information storage unit, and “router 11, time stamp, 192.168.0.0/24,2 , 2: 65000, 192.168.1.1, Withdraw].

  Here, when searching for route information, the route information collection unit 122 uses the existing route information with overlapping IP address spaces as a search result. Specifically, when the route information collection unit 122 collects route information having a prefix of “192.168.0.0/24”, “192.168.0.0/22” or the like “192” .168.0.0 / 24 "as a search result. As a result, the path information comparing the path information such as the source AS number of “192.168.0.0/24” and the path information such as the source AS number of “192.168.0.0/22” is compared. Can be used to detect discrepancies.

  Similarly, when the route information collection unit 122 collects route information having a prefix of “192.168.0.0/20”, “192.168.168 / 22” or the like “192.168. .0.0 / 20 "as a search result. Accordingly, the route information such as the generation AS number of “192.168.0.0/22” and the route information such as the generation AS number of “192.168.0.0/20” are compared. It can be used to detect information mismatch.

  In one aspect, the route information may be stored with priority given to the route information according to the route protocol using a data structure that forms a tree such as Patrice Trie. The route information collection unit 122 reconfigures the all route information storage unit when all route information is collected from the route information reception unit 121.

  For example, when the route information collected by the route information collection unit 122 is an update target, the route variation detection unit 123 stores the existing route information that overlaps the IP address space included in the collected route information. Extract from the part. Then, the route fluctuation detection unit 123 compares the adjacent AS number, the generation AS number, the AS path, the community, and the next hop address between the extracted existing route information and the route information to be updated. At this time, the route fluctuation detection unit 123 notifies the route information notification unit 126 of the corresponding existing route information and the update target route information as alert information when both pieces of route information are different. In addition, when there is no existing route information, the route fluctuation detection unit 123 also notifies the route information matching unit 124 when the cause of the alert is a change in the generation AS number.

  For example, the route fluctuation detection unit 123 has the prefix of the update target route information “192.168.0.0/24”, the generation AS number “AS20”, and the existing route information prefix is When “192.168.0.0/22” and the source AS number is “AS30”, the prefix of the route information to be updated is included in the prefix of the existing route information. Alert target.

  The alert content at this time is, for example, “alert type: source AS number fluctuation, update target route prefix: 192.168.0.0/24, update target route source AS number: AS20, existing route Prefix: 192.168.0.0/22, existing route generation source AS number: AS30, receiving router: router 12, time stamp: 2011-03-11 ". In this example, since the prefix length of the route information to be updated is longer than the prefix length of the existing route information, the IP packet addressed to “192.168.0.0/24” is the AS30 of the existing route information. Instead, it is transmitted toward the AS 20 of the route information to be updated. This is because a prefix having a long prefix length is preferentially selected in route routing.

  As another example, the route fluctuation detection unit 123 has the prefix of the update target route information “192.168.0.0/22”, the generation source AS number “AS20”, and the existing route information When the prefixes are “192.168.0.0/24” and “192.168.1.0/24” and the source AS number is “AS30”, the prefix of the route information to be updated is an existing one. Since it is included in the prefix of the route information, it is set as an alert target as a change in the generation AS number.

  The alert content at this time is, for example, “alert type: source AS number fluctuation, update target route prefix: 192.168.0.0/22, update target route source AS number: AS20, existing route Prefix 1: 192.168.0.0/24, existing route generation source AS number 1: AS30, existing route prefix 2: 192.168.1.0/24, existing route generation source AS number: AS30, "Receiving router: router 12, time stamp: 2011-03-11". In this example, since the prefix length of the route information to be updated is shorter than the prefix length of the existing route information, “192.168.0.0/24” and “192.168.1.0/24” The destination IP packet is transmitted toward the AS 30 of the existing route information, and there is no influence on the existing route. However, the route “192.168.2.0/23” becomes valid, and the IP packet addressed to “192.168.2.0/23” is transmitted toward the AS 20 of the route information to be updated. .

  Further, for example, even if the route information is deleted for the route information (prefix, source AS number) that is the alert target of the source AS number change, the route change detection unit 123 deletes the route of the source AS number change. As the alert, the prefix of the deleted route and the route information of the generation source AS number are transmitted to the route information matching unit 124 and the route information notification unit 126. Further, as alerts other than the generation AS number change, for example, adjacent AS number change, AS path change, community change, next hop address change, and the like are generated. As a result, the route fluctuation detection unit 123 detects a change in the route information that has been advertised and received.

  For example, when the alert information of the source AS number variation is received from the route variation detection unit 123, the route information collation unit 124 partially adds the update target route prefix or the existing route prefix included in the received alert information. However, route information (prefix and AS number) with overlapping IP address spaces is extracted from the regular route information storage unit 111. Then, the route information matching unit 124, among the extracted regular route information (prefix, AS number), the AS number of the regular route information having the longest prefix length, and the generation source AS of the route information to be updated included in the alert information. Match numbers. At this time, the route information collation unit 124, as a result of the collation, as an alert of the abnormality generation source AS number, as the alert of the abnormality generation source AS number, the update target route information (prefix, generation source AS number) and regular route information (prefix, AS Number) to the route information notification unit 126.

  FIG. 5 is a diagram illustrating an example of the route information matching process. In FIG. 5, as regular route information, the prefix is “192.168.0.0/22”, the AS number is “2”, the prefix is “192.168.0.0/20”, and the AS number is “ 3 ”, the reception path information is a prefix“ 192.168.0.0/24 ”, and the generation source AS number is“ 5 ”. Note that the reception path information in FIG. 5 refers to the path information included in the received alert information.

  At this time, the route information matching unit 124 includes the prefix having the longest prefix length among the regular route information including the IP address space of the received route information, in which the IP address space of the received route information is included in the IP address space of the received route information. The AS number “2” of “192.168.0.0/22” is compared with the generation source AS number “5” of the prefix “192.168.0.0/24” of the reception path information. Then, the route information matching unit 124 determines that there is an abnormality because of the mismatch as a result of the matching, and sets it as an alert target.

  Further, the route information matching unit 124 checks the AS numbers of all the extracted regular route information (prefix, AS number) and the generation source AS number of the update target route information included in the alert information. At this time, the route information matching unit 124 uses the updated route information (prefix, source AS number) and all the regular route information (prefix) as an alert of the abnormality generation source AS number when there is a mismatch as a result of the comparison. , AS number) to the route information notification unit 126.

  FIG. 6 is a diagram illustrating an example of route information matching processing. In FIG. 6, as regular route information, the prefix is “192.168.0.0/22”, the AS number is “2”, the prefix is “192.168.0.0/20”, and the AS number is “ 3 ”, the reception path information is a prefix“ 192.168.0.0/18 ”, and the generation source AS number is“ 6 ”. Note that the reception route information in FIG. 6 refers to route information included in the received alert information.

  At this time, the route information matching unit 124 uses the IP address space of the received route information as the AS number “2” of the prefix “192.168.0.0/22” of the regular route information, and the prefix “192.168.8.0”. .0 / 20 ”and the generation source AS number“ 6 ”of the prefix“ 192.168.0.0/18 ”of the reception path information are collated. Then, the route information matching unit 124 determines that there is an abnormality because of the mismatch as a result of the matching, and sets it as an alert target.

  Further, the route information matching unit 124 generates, for example, the AS number of the regular route information having the longest prefix length among the extracted regular route information (prefix and AS number) and the update target route information included in the alert information. Among the regular route information having the IP address space that matches the original AS number and includes the prefix of the existing route information, the AS number of the regular route information having the longest prefix length and the generation source AS of the existing route information When the number is different, as an alert of abnormal generation source AS termination, update target route information (prefix, generation source AS number), existing route information (prefix, generation source AS number), and regular route information (prefix) , AS number) to the route information notification unit 126.

  Further, when the route information matching unit 124 receives, for example, a deletion alert due to the route variation of the generation AS number from the route variation detection unit 123, the prefix among the regular route information having the IP address space including the alert prefix is included. The AS number of the regular route information having the longest length is checked against the alert generation AS number. At this time, the route information matching unit 124, as a result of the matching, if there is a mismatch, the route information (prefix, source AS number) of the deletion alert due to the route change of the source AS number is used as the end alert of the abnormality source AS number. And the normal route information (prefix, AS number) are notified to the route information notification unit 126.

  The route information display unit 125 is stored in the route information collection unit 122, the route fluctuation detection unit 123, the route information matching unit 124, and the route information notification unit 126, for example, when a predetermined operation is performed by the user of the route monitoring apparatus 100. Information is acquired and displayed on a display device such as a display or a monitor.

  For example, the route information notification unit 126 notifies the route information display unit 125 of the alert received from the route fluctuation detection unit 123 and the route information collation unit 124, and among the alerts, the user of the route monitoring device 100 sends it to an external device. The alert information that is permitted to be transmitted is transmitted to a preset external device. The route information notification unit 126 notifies the route information display unit 125 when an alert is received from an external device. As a result, it is possible to recognize an alert for AS route information including the own route monitoring device 100 propagating in another AS.

[Route Monitoring Processing According to Embodiment 1]
Next, the flow of the route monitoring process according to the first embodiment will be described with reference to FIG. FIG. 7 is a flowchart illustrating an example of a flow of route monitoring processing according to the first embodiment.

  For example, as shown in FIG. 7, the route monitoring apparatus 100 receives route information from a network device such as a router connected to the network (step S101). Then, the route monitoring apparatus 100 gives an update or delete flag to the all route information storage unit based on the received route information (step S102).

  Subsequently, the route monitoring apparatus 100 determines whether or not the received route information is an update target (step S103). At this time, when the route information is to be updated (Yes at Step S103), the route monitoring apparatus 100 compares the existing route information with the received route information and detects a change in the route information (Step S104). . On the other hand, when the route information is not an update target (No at Step S103), the route monitoring apparatus 100 ends the process.

  Thereafter, the route monitoring apparatus 100 determines whether or not alert information indicating that the generation source AS number has changed has been detected (step S105). At this time, the route monitoring device 100 collates the target AS number with the AS number of the regular route information when the alert information of the generation source AS number variation is detected (Yes at Step S105), It is determined that there is an abnormality (step S106). On the other hand, the route monitoring device 100 ends the process when the alert information of the generation source AS number variation is not detected (No at Step S105).

[Effects of Example 1]
As described above, for example, the route monitoring apparatus 100 assigns a deletion flag to all route information without deleting even if the received route information is a deletion target, and the prefix of the IP address included in the update target route information. The existing route information that matches is extracted from all the route information, the route information to be updated is compared with the extracted existing route information to detect the change in route information, and the route in which the change in route information is detected Route information that matches the IP address of the information is extracted from the normal route information, and it is abnormal when the AS number of the route information in which the fluctuation is detected does not match the AS number of the extracted normal route information. judge. As a result, the route monitoring apparatus 100 can detect a change in the advertised route information, and can detect an advertisement of route information other than the route that is normally assigned.

  Although the embodiments of the route monitoring apparatus according to the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above. Therefore, different embodiments in (1) configuration and (2) program will be described.

(1) Configuration In addition, information including processing procedures, control procedures, specific names, various data, parameters, and the like shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. . For example, in the above-described embodiment, the route monitoring apparatus 100 including the route information receiving unit 121 to the route information notifying unit 126 has been described. However, the route information including the route information receiving unit 121 to the route change detecting unit 123 is changed. A path monitoring device for detection may be used.

  Each component of the illustrated route monitoring apparatus 100 is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various burdens or usage conditions. Can be integrated. For example, the route information receiving unit 121 and the route information collecting unit 122 may be integrated as a “route information processing unit” that accumulates received route information and accumulates and updates all route information.

  In addition, each or all of the processing functions performed in the route monitoring apparatus 100 are realized by a CPU and a program that is analyzed and executed by the CPU, or is realized as hardware by wired logic. obtain.

(2) Program FIG. 8 is a diagram showing that the route monitoring program according to the present invention is specifically realized using a computer. As illustrated in FIG. 8, the computer 1000 includes, for example, a memory 1001, a CPU 1002, a hard disk drive interface 1003, a disk drive interface 1004, a serial port interface 1005, a video adapter 1006, and a network interface 1007. These units are connected by a bus 1008.

  As illustrated in FIG. 8, the memory 1001 includes a ROM 1001a and a RAM 1001b. The ROM 1001a stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1003 is connected to the hard disk drive 1009 as illustrated in FIG. The disk drive interface 1004 is connected to the disk drive 1010 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1010. The serial port interface 1005 is connected to, for example, a mouse 1011 and a keyboard 1012 as illustrated in FIG. The video adapter 1006 is connected to a display 1013, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 8, the hard disk drive 1009 stores, for example, an OS (Operating System) 1009a, an application program 1009b, a program module 1009c, and program data 1009d. That is, the route monitoring program according to the present invention is stored in, for example, the hard disk drive 1009 as a program module 1009c in which a command executed by the computer 1000 is described. Specifically, a route information reception procedure for executing processing similar to that of the route information reception unit 121 described in the above embodiment, a route information collection procedure for executing processing similar to that of the route information collection unit 122, and route fluctuation detection The hard disk drive 1009 stores a program module 1009c in which a route fluctuation detection procedure for executing the same processing as that of the unit 123 and a route information verification procedure for executing the same processing as that of the route information matching unit 124 are described. Further, like the data stored in the regular path information storage unit 111 described in the above embodiment, data used for processing by the path monitoring program is stored as, for example, the hard disk drive 1009 as program data 1009d. The CPU 1002 reads the program module 1009c and program data 1009d stored in the hard disk drive 1009 to the RAM 1001b as necessary, and executes a route information reception procedure, a route information collection procedure, a route variation detection procedure, and a route information collation procedure. .

  Note that the program module 1009c and program data 1009d related to the path monitoring program are not limited to being stored in the hard disk drive 1009, but are stored in, for example, a removable storage medium and read out by the CPU 1002 via the disk drive 1010 or the like. May be. Alternatively, the program module 1009c and the program data 1009d related to the route monitoring program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the network interface 1007 is stored. Via the CPU 1002.

DESCRIPTION OF SYMBOLS 100 Path | route monitoring apparatus 110 Memory | storage part 111 Regular path | route information memory | storage part 120 Control part 121 Path | route information receiving part 122 Path | route information collection part 123 Path | route fluctuation | variation detection part 124 Path | route information collation part 125 Path | route information display part 126 Path | route information notification part

Claims (5)

A route monitoring device that monitors route information indicating a communication route between autonomous systems connected to a network,
The route information is received from the network device connected to the network, and all route information indicating all the communication routes between the autonomous systems connected to the network based on the received route information A route information receiver that accumulates in
The collected routing information received by the route information receiving unit, when the collected route information is updated, if prior Symbol Updated all routing information, the collected routing information is deleted, the total A route information collection unit that adds a deletion flag indicating that the route information is to be deleted;
When the route information collected by the route information collection unit is an update target, the existing route information that matches the prefix of the IP address included in the collected route information is replaced with the route information with the deletion flag. A path fluctuation detecting unit that extracts a change in path information by extracting from the entire path information including, comparing the extracted existing path information with the collected path information,
If the route information of the autonomous system is a generator of the route information by said path change detector is detected that fluctuates one IP address prefix included in the route information of the autonomous system is detected variation Also extracts the route information with overlapping IP address space from the normal route information indicating the normally assigned route information , and identifies the autonomous system included in the normal route information with the longest prefix length among the extracted normal route information A path information collating unit that collates an identification number for identifying an autonomous system in which a change is detected, and determines that it is abnormal if they do not match apparatus.   The route information receiving unit generates the route information for each network device and for each time series based on the route information received from the network device, and generates the entire route information. The route monitoring device described in 1.   The route fluctuation detection unit extracts existing route information that overlaps even part of the IP address space included in the collected route information from the entire route information, and extracts the existing route information and the collected route information, The route monitoring apparatus according to claim 1, wherein a change in route information is detected by comparing the two. A route monitoring method executed by a route monitoring device that monitors route information indicating a communication route between autonomous systems connected to a network,
The route information is received from the network device connected to the network, and all route information indicating all the communication routes between the autonomous systems connected to the network based on the received route information Route information receiving process stored in the
The collected routing information received by the route information receiving step, when the collected route information is updated, if prior Symbol Updated all routing information, the collected routing information is deleted, the total A route information collecting step for adding a deletion flag indicating that the route information is to be deleted;
When the route information collected by the route information collection step is an update target, the existing route information that matches the prefix of the IP address included in the collected route information is replaced with the route information with the deletion flag. A path fluctuation detection step for extracting fluctuations of path information by extracting from the entire path information including, comparing the extracted existing path information with the collected path information, and
If the route information of the autonomous system is a generator of the route information by said path change detection step is detected that fluctuates one IP address prefix included in the route information of the autonomous system is detected variation Also extracts the route information with overlapping IP address space from the normal route information indicating the normally assigned route information , and identifies the autonomous system included in the normal route information with the longest prefix length among the extracted normal route information And a path information matching step that compares the identification number for identifying the autonomous system in which the fluctuation is detected and determines that it is abnormal if there is a mismatch. Monitoring method.   A route monitoring program for causing a computer to function as the route monitoring device according to claim 1.

Images