JP5723307B2 - Packet monitoring system - Google Patents

Description

  The present invention relates to a packet monitoring apparatus, a packet monitoring method, and a packet monitoring system that monitor TCP (Transmission Control Protocol) packets transmitted and received on an IP (Internet Protocol) network.

  The TCP protocol widely used in the Internet or the like is a highly reliable protocol that retransmits a packet when a packet loss occurs during communication. In the TCP protocol, congestion control is performed to avoid network congestion, and the window size is controlled so that packet loss does not occur end-to-end between the server and the client terminal. In the TCP congestion control method that is implemented as standard in many operation systems (OS), if a timeout occurs due to reception of three or more duplicate ACK packets or a timeout due to round trip time (RTT), congestion occurs. Judgment and greatly reduce the window size. When the window size is reduced as described above, the data transfer rate is significantly reduced.

  In recent years, the bandwidth of IP networks has increased, and the network access environment of users has diversified. Since conventional user networks are mainly wired, the quality of IP networks is dominant in end-to-end network quality. Broadband and high quality IP networks greatly improve the communication quality experienced by users. Contributed.

  On the other hand, in recent user networks, wireless such as wireless LAN is becoming widespread. Wireless has a higher bit error rate than wired, and data packets and ACK packets are likely to be lost. Therefore, even if the IP network is high quality, if the user network is wireless and bit errors occur frequently, the data transfer rate is reduced by TCP congestion control. As a result, there is a problem in that the user's communication comfort is reduced and the traffic on the end-to-end communication path and the apparatus load are increased due to packet retransmission.

  As an example of a technique for improving the problem of TCP performance in such a wireless network, when a packet loss occurs in a wireless base station, the passing data packet is cached until the corresponding ACK packet passes. A technique (snoop) of retransmitting a lost packet from a radio base station is known (for example, see Non-Patent Document 1).

H. Balakrishnan, et al., “Improving TCP / IP Performance over Wireless Networks,” Proc. ACM MOBICOM, pp.2-11, Nov. 1995.

  However, in the above-described conventional technology, packet caching is performed for all TCP flows in the snoop at the radio base station. For this reason, there is a problem that it is necessary to provide a large amount of memory in the radio base station. On the other hand, wired and wireless packet flows are mixed in a user network in an IP network, and packet loss does not always occur in all flows.

  The present invention has been made in view of such a background, and the present invention is a packet monitor capable of reducing the memory required for the packet cache while maintaining communication reliability in communication using the TCP protocol. It is an object to provide an apparatus, a packet monitoring method, and a packet monitoring system.

To solve the problems described above, a first aspect of the present invention, a server on the IP network - with providing a plurality of packet monitoring unit for monitoring the TCP packets transmitted and received TCP session established between the client terminal, multiple a management server for managing the number of the packet monitoring device, the IP network on the server - a packet monitoring system for monitoring the TCP packets transmitted and received by the TCP session established between the client terminal, said packet A packet flow identifying unit that identifies which TCP session the TCP packet transmitted / received on the IP network is transmitted / received on the IP network, and an ACK packet transmitted / received within the predetermined time in the TCP session If the number of duplicates exceeds a predetermined threshold In addition, a quality monitoring determination unit that determines that the TCP session should be quality-monitored, and whether the TCP packet that is transmitted and received in the TCP session is necessary for each TCP session that is determined to be quality-monitored A quality monitoring unit that performs a determination based on at least one of the duplication number of the TCP packet, packet loss, packet delay, and round trip time in the TCP session; and the duplication number of the packet, the packet loss, Based on the late arrival of the packet and the round trip time, the degradation interval in the TCP session is either the interval between the server and the packet monitoring device or between the client terminal and the packet monitoring device. And the deteriorated section is If it is between the client monitoring device and the packet monitoring device, the quality monitoring unit determines that the TCP packet cache is unnecessary. For the TCP packet determined to be required, the degradation section determination unit that finally determines that a cache is required, and the TCP session that transmits and receives the TCP packet has been determined to require a cache. A packet cache unit that caches the TCP packet and retransmits the cached TCP packet when a retransmission request is received, and the packet monitoring device includes the degradation section in the TCP session. When it is determined that the server and the packet monitoring device, When the determination result of the degradation section including identification information for identifying the CP session is transmitted to the management server and it is determined that the degradation section is between the client terminal and the packet monitoring apparatus, The final determination that the packet needs to be cached, and the management server is on the communication path of the TCP packet and is upstream in the communication path than the packet monitoring apparatus that has transmitted the determination result Identifying the packet monitoring device located on the side, the identification information received from the packet monitoring device that sent the determination result to the packet monitoring device located on the identified server side, and the TCP identified by the identification information A cache necessity judgment requesting the necessity of caching of the TCP packet transmitted and received in the session. The packet monitoring device located on the server side receives the identification information and the cache necessity determination request, and transmits a cache request for the TCP packet transmitted and received in the TCP session indicated by the identification information. The packet monitoring system is characterized by performing necessity determination.

In this way, the packet monitoring apparatus can determine whether or not a packet cache is necessary for each TCP session in the IP network, and perform TCP packet caching and retransmission. This eliminates the need to cache TCP session packets that do not require packet caching, thereby reducing the memory required for caching. Further, since the packet monitoring device performs monitoring on the IP network, it is possible to avoid a decrease in data transfer rate due to TCP congestion control without modifying the terminal side device.
Furthermore, only for TCP sessions that are estimated to be highly effective based on at least one of packet duplication, packet loss, packet delay (packet sequence number order reversal), and round trip time, TCP packet caching and retransmission can be performed. As a result, the resources of the packet monitoring device can be used effectively, and the traffic from the data transmission terminal to the packet monitoring device and the device load can be reduced.
In addition, TCP packet caching and retransmission can be performed by a packet monitoring device close to the degradation occurrence section on the IP network. Thereby, the traffic between the packet monitoring device and the server and the device load can be reduced. In addition, it is possible to shorten the time until the retransmission data packet is received at the client terminal.

  According to the present invention, it is possible to provide a packet monitoring device, a packet monitoring method, and a packet monitoring system that can reduce the memory required for the packet cache while maintaining communication reliability in communication using the TCP protocol. Can do.

It is a figure which shows an example of the network structure which has arrange | positioned the packet monitoring apparatus which concerns on this Embodiment. It is a block diagram which shows the functional structure of the packet monitoring apparatus which concerns on this Embodiment. It is a flowchart which shows the process by the packet flow identification part which concerns on this Embodiment. It is a figure which shows an example of the data structure of the monitoring flow table which concerns on this Embodiment. It is a figure which shows an example of a data structure of the data packet information table which concerns on this Embodiment. It is a flowchart which shows the process at the time of the data packet input of the quality monitoring part which concerns on this Embodiment. It is a flowchart which shows the process at the time of the ACK packet input of the quality monitoring part which concerns on this Embodiment. It is a figure which shows an example of the system configuration | structure of the packet monitoring system which has arrange | positioned multiple packet monitoring apparatuses concerning this Embodiment.

  Exemplary embodiments of a packet monitoring device 100, a packet monitoring method, and a packet monitoring system 800 according to the present invention will be described below in detail with reference to the accompanying drawings.

≪Overview of network configuration≫
FIG. 1 is a diagram showing an example of a network configuration in which a packet monitoring apparatus 100 according to the present embodiment is arranged. The packet monitoring apparatus 100 according to the present embodiment monitors TCP packets transmitted and received in a TCP session established between the server 110 and the client terminal 120, which are two terminals on the IP network. More specifically, the packet monitoring apparatus 100 includes a TCP data packet transmitted from the server 110 on the IP network to the client terminal 120 and an ACK packet transmitted correspondingly from the client terminal 120 to the server 110. The target packet flow is to be monitored. Hereinafter, a TCP session between two terminals using a TCP data packet having the same transmission source address, transmission source port number, transmission destination address, and transmission destination port number and a corresponding ACK packet is referred to as a “flow”. Unless otherwise specified, in this embodiment, the ACK number indicates the ACK number of the ACK packet, and the sequence number indicates the sequence number of the data packet.

  The packet monitoring device 100 is provided at the edge of the IP network on the access network side. The gateway (GW) 130 is provided on the Internet side (server 110 side) of the IP network, and the edge is provided on the access network side (client terminal 120 side). Each router 140 is arranged. In the TCP session between the server 110 and the client terminal 120, the section A is between the packet monitoring apparatus 100 and the client terminal 120 (downstream section), and the section B is between the packet monitoring apparatus 100 and the server 110 (upstream section). And

<< Functional Configuration of Packet Monitoring Device 100 >>
FIG. 2 is a block diagram showing a functional configuration of the packet monitoring apparatus 100 according to the present embodiment. The packet monitoring apparatus 100 includes a packet flow identification unit 201, a quality monitoring determination unit 202, a quality monitoring unit 203, a degradation section determination unit 204, a packet cache unit 205, a table storage unit 211, a data packet information table storage unit 212, and a packet A cache storage unit 213 is included.

  The packet flow identification unit 201 identifies in which TCP session (flow) the TCP packet transmitted / received on the IP network is transmitted / received. Further, the packet flow identification unit 201 selects an execution process (quality monitoring determination, quality monitoring, cache, and monitoring cancellation) to be performed on the received TCP packet, and outputs it to the corresponding functional units (details will be described later). See FIG. 3).

  The quality monitoring determination unit 202 should count the number of overlapping ACK packets transmitted and received within a predetermined time in a TCP session (flow), and when the predetermined threshold is exceeded, the quality monitoring determination unit 202 should perform quality monitoring on the TCP session (flow) Is determined.

  For each TCP session (flow) established on the IP network, the quality monitoring unit 203 determines whether or not it is necessary to cache TCP packets transmitted and received in the TCP session (flow). The quality monitoring unit 203, for example, overlaps the number of packets transmitted and received in a TCP session (flow) (“duplicate packet counter” and “duplicate ACK counter” described later), packet loss, the number of late arrivals of packets, and a TCP session (flow It is determined that it is necessary to cache a TCP packet transmitted / received in the TCP session (flow) based on at least one of the round trip times in FIG. Note that “packet arrival” in the present embodiment means a case where a packet that should have arrived first is delayed due to a reverse of the arrival order of packets or retransmission of packets. In other words, this is a case where the sequence number of the packet is reversed in order, and when the sequence number is not reversed, even if it arrives late, it does not fall under “packet arrival”. When the quality monitoring unit 203 determines that the TCP packet cache is required, the quality monitoring unit 203 transmits a degradation segment determination request to the degradation segment determination unit 204. Then, the final determination as to whether or not the TCP packet is cached is performed based on the result of determination of the deterioration section by the deterioration section determination unit 204.

  The degradation section determination unit 204 determines that the degradation section in the TCP session is a section between the server 110 and the packet monitoring apparatus 100 (section B in FIG. 1) or a section between the client terminal 120 and the packet monitoring apparatus 100 (FIG. 1). And if the degradation period is between the server 110 and the packet monitoring device 100 (section B in FIG. 1), it is determined that the TCP packet cache is unnecessary, and the degradation period Is between the client terminal 120 and the packet monitoring device 100 (section A in FIG. 1), it is determined that TCP packet caching is required.

  The packet cache unit 205 caches a TCP packet when the TCP session (flow) for transmitting and receiving the TCP packet is a TCP session (flow) determined by the quality monitoring unit 203 to require the caching of the TCP packet. When the packet cache unit 205 receives a retransmission request for a cached TCP packet, the packet cache unit 205 retransmits the TCP packet requested for retransmission.

  The table storage unit 211 stores a monitoring flow table 400 and a user information table 450. From the packet flow identification unit 201, the quality monitoring determination unit 202, the quality monitoring unit 203, the degradation section determination unit 204, and the packet cache unit 205. Is also accessible. The data packet information table storage unit 212 stores a data packet information table 500 used by the quality monitoring unit 203. The packet cache storage unit 213 stores the packet cache by the packet cache unit 205.

≪Details of each functional part≫
Next, details of each functional unit of the packet monitoring apparatus 100 will be described.

<Packet flow identification unit 201>
FIG. 3 is a flowchart showing processing by the packet flow identification unit 201 according to the present embodiment. FIG. 4 is a diagram illustrating an example of a data configuration of the monitoring flow table 400 according to the present embodiment.
In the flowchart of FIG. 3, the packet flow identification unit 201 waits until a TCP packet is input (step S <b> 301: No), and when a TCP packet is input (step S <b> 301: Yes), stores it in the table storage unit 211. With reference to the monitored flow table 400, it is determined whether or not the packet has been transmitted / received in the flow registered in the monitored flow table 400 (step S302).

  The monitoring flow table 400 shown in FIG. 4 includes a flow ID 401, a server IP address 402, a terminal IP address 403, a server port number 404, a terminal port number 405, an MSS (Maximum Segment Size) 406, an application identification number 407, and a terminal identification number 408. And an execution process 409.

  The flow ID 401 is an ID for identifying a flow registered in the monitoring flow table 400. The server IP address 402 is an IP address of the server 110 that is a transmission source of the TCP packet (data packet) in the flow. The terminal IP address 403 is an IP address of the client terminal 120 that is a transmission destination of the TCP packet (data packet) in the flow. The server port number 404 is a port number of the server 110. The terminal port number 405 is the port number of the client terminal 120.

  The MSS 406 is the maximum segment size in the flow. The application identification number 407 is an identification number of an application that uses communication in the flow. The terminal identification number 408 is a number for identifying a communication destination client terminal when there are a plurality of client terminals 120. The execution process 409 is a process content to be executed for the packet of the flow.

  Returning to FIG. 3, when the packet flow identifying unit 201 receives the packet in step S301 of FIG. 3 (step S301: Yes), the header information and information of the monitoring flow table 400 shown in FIG. 4 (for example, the server IP address 402) Terminal IP address 403, server port number 404, terminal port number 405, etc.) to determine whether a matching flow is registered (step S302 in FIG. 3).

  When the flow is registered (step S302: Yes), the packet flow identification unit 201 refers to the flag in the header information of the input packet and determines whether or not the end of the flow is detected ( Step S303). Specifically, the packet flow identification unit 201 determines whether the flag in the header information of the packet indicates whether the connection is released or the connection is forcibly disconnected. When the end of the flow is detected (step S303: Yes), the process proceeds to step S311 to delete the information of the corresponding flow from the monitoring target table (step S311) and output the input packet on the IP network ( Step S312), the process according to this flowchart is terminated.

  On the other hand, when the end of the flow is not detected (step S303: No), the execution process 409 corresponding to the flow in the monitoring flow table 400 (FIG. 4) is referred to and executed on the input packet. Processing is determined (step S304). In the monitoring flow table 400 of FIG. 4, four processes of “quality monitoring determination”, “quality monitoring”, “cache”, and “monitoring stop” are registered as execution processing 409. When the execution process 409 is “quality monitoring determination” (step S304: quality monitoring determination), when the input packet is an ACK packet, the information of the corresponding flow ID 401 and the ACK packet are output to the quality monitoring determination unit 202. (Step S305), the process according to this flowchart is terminated. When the input packet is a data packet, it is output as it is on the IP network.

  When the execution process 409 is “quality monitoring” (step S304: quality monitoring), the input packet is output to the quality monitoring unit 203 together with the information of the corresponding flow ID 401 (step S306), and the processing according to this flowchart ends. To do. When the execution process 409 is “cache” (step S304: cache), the input packet is output to the packet cache unit 205 together with the information of the corresponding flow ID 401 (step S307), and the process according to this flowchart ends. In steps S306 and S307, output is performed regardless of whether the input packet is a data packet or an ACK packet. If the execution process 409 is “monitoring stop”, the input packet is output to the IP network as it is (step S312), and the process according to this flowchart ends.

  In step S302, if the flow that transmits and receives the TCP packet is not registered in the monitoring flow table 400 (step S302: No), the packet flow identification unit 201 determines that the flow that transmits and receives the input packet is a new flow (new It is determined whether it is a TCP session that has started connection to (step S308). When it is a new flow (step S308: Yes), the packet flow identification unit 201 refers to the user information table 450 of the table storage unit 211 and determines whether the new flow is a monitoring target flow (step S309).

  Here, the user information table 450 includes identification information (IP address, port number, application information, terminal information, etc.) of the service target user of the packet monitoring apparatus 100. The packet flow identification unit 201 determines whether or not the information such as the IP address and the port number in the user information table 450 matches the new flow information (the header information of the input packet). Is determined as a monitoring target flow. If there is application information or terminal information that cannot be identified from the packet header information in the user information table 450, the application information and terminal information of the corresponding flow are identified by a function such as DPI (Deep Packet Inspection), and the monitoring target flow It is determined whether or not there is.

  When the new flow is a monitoring target flow (step S309: Yes), the packet flow identification unit 201 registers the flow information of the new flow in the monitoring flow table 400 (step S310), and then proceeds to the process of step S304. . In step S310, the execution process 409 of the monitoring flow table 400 is set to “quality monitoring determination” which is an initial value. On the other hand, when the new flow is not the monitoring target flow (step S309: No) and when the flow for transmitting and receiving the input packet is not the new flow (step S308: No), the packet flow identifying unit 201 The input packet is output to the IP network as it is (step S312), and the processing according to this flowchart ends.

<Quality monitoring determination unit 202>
The quality monitoring determination unit 202 determines whether or not to perform quality monitoring by monitoring duplicate ACKs for each flow (flow ID). The quality monitoring determination unit 202 holds the latest ACK number for each flow (flow ID), and updates the latest ACK number when the ACK packet input from the packet flow identification unit 201 is not a duplicate ACK packet. On the other hand, if it is a duplicate ACK packet, “1” is added to the duplicate ACK counter set for each flow ID only when the first duplicate ACK packet of the ACK is detected. Since duplicate ACKs may be detected in a large amount in a short time, for duplicate ACK packets with the same ACK number, the counter is incremented by “1” only when the first duplicate ACK packet is detected. That is, the quality monitoring determination unit 202 monitors the duplicate ACK for each received ACK packet with a different ACK number, and adds “1” to the duplicate ACK counter each time the first duplicate ACK packet is detected. Then, the quality monitoring determination unit 202 determines whether the value of the duplicate ACK counter has exceeded a predetermined threshold value THa within Ta for every predetermined time Ta. Furthermore, the quality monitoring determination unit 202 counts the number of times that the value of the duplicate ACK counter is determined to exceed the predetermined threshold value THa within the second predetermined time Tb including the predetermined time Ta a plurality of times, and the number of times is determined. When the threshold value THb is exceeded, the execution process of the corresponding flow in the monitoring flow table 400 is set to “quality monitoring”, and the quality monitoring determination process of the corresponding flow is ended. Here, the reason why the second predetermined time Tb is set and the threshold THb is provided in addition to the number of times it is determined that the threshold THa has been exceeded is that a large number of duplicate ACKs may be temporarily detected. This is for determining whether a state where a large number of duplicate ACKs are detected continues, or whether a state where no duplicate ACKs are detected in a short time has been reached. With this determination, the quality monitoring determination unit 202 can set the execution process 409 of the corresponding flow to “quality monitoring” when the state where the duplicate ACK is detected continues.
The duplicate ACK counter is initialized to 0 every predetermined time Ta. In addition, the latest ACK number for each flow held by the quality monitoring determination unit 202 is not updated when the ACK number of the arrived ACK packet is smaller than the held ACK number.

<Quality monitoring unit 203>
FIG. 5 is a diagram showing an example of the data configuration of the data packet information table 500 according to the present embodiment. The data packet information table 500 is created for each flow (flow ID 401) and includes, as data items, a sequence number 501, a data packet ACK number 502, a data size 503, a window size 504, a packet arrival time 505, an RTT (Round Trip). Time) 506, duplicate packet counter 507, duplicate ACK counter 508, data loss flag 509, late arrival flag 510, and RTT flag 511. The initial values of all counters and flags in the data packet information table 500 are set to “0”.

  The sequence number 501 is the sequence number of the data packet input to the quality monitoring unit 203. The ACK number 502 is the ACK number of the data packet with the sequence number 501. The data size 503 is the data size of the data packet. The window size 504 is the amount of data that can be sent without waiting for an acknowledgment. The packet arrival time 505 is a packet arrival time. RTT 506 is the time from when the quality monitoring unit 203 outputs a data packet until the corresponding ACK packet is received.

  The duplicate packet counter 507 is a counter that counts the number of overlapping data packets. The duplicate ACK counter 508 is a counter that counts the number of duplicate ACK packets corresponding to the data packet with the sequence number 501. The data loss flag 509 is a flag indicating that a data loss has occurred. The late arrival flag 510 is a flag indicating that a late arrival of the data packet (reversal of the sequence number of the packet) has occurred. The RTT flag 511 is a flag indicating that the RTT has exceeded a predetermined threshold.

  When the TCP packet is input from the packet flow identification unit 201, the quality monitoring unit 203 updates the data packet information table 500 (FIG. 5) using the input packet, and the packet cache based on the data in the data packet information table 500 The necessity determination of is performed. The processing for an input packet differs depending on whether it is a data packet or an ACK packet. Hereinafter, the processing when the input packet is a data packet will be described with reference to FIG. 6, and the processing when the input packet is an ACK packet will be described with reference to FIG.

  FIG. 6 is a flowchart showing processing at the time of data packet input of the quality monitoring unit 203 according to the present embodiment. The quality monitoring unit 203 determines whether or not a data packet is input. If no data packet is input, the quality monitoring unit 203 waits until the data packet is input (step S601: No). When the data packet is input (step S601: Yes), the quality monitoring unit 203 acquires the arrival time information of the data packet (step S602). Next, the quality monitoring unit 203 refers to the header information (sequence number and the like) of the data packet and the data packet information table 500 to determine whether or not the data packet is registered in the data packet information table 500 ( Step S603).

  When the information of the same packet is registered (step S603: Yes), the quality monitoring unit 203 adds “1” to the duplicate packet counter 507 on the assumption that the data packet has been duplicated (step S604). The data packet is output to the IP network (step S609), and the processing according to this flowchart is terminated. On the other hand, when the packet information is not registered (step S603: No), the quality monitoring unit 203 registers information (sequence number, arrival time, etc.) of the data packet that has arrived this time in the data packet information table 500 (step S605). ).

  Subsequently, the quality monitoring unit 203 calculates the sequence number E_SEQ of the data packet to be input this time from information (such as the sequence number of the previously received data packet) held in the data packet information table 500, and actually It is compared with the sequence number SEQ of the data packet input this time (step S606). If SEQ> E_SEQ (step S606: SEQ> E_SEQ), the quality monitoring unit 203 sets the data loss flag 509 of the data packet information table 500 for the data packet that has arrived this time, assuming that a data packet loss has occurred. “1” is set (step S607). Then, the quality monitoring unit 203 outputs the data packet to the IP network (step S609), and ends the processing according to this flowchart.

  In the case of SEQ <E_SEQ (step S606: SEQ <E_SEQ), the quality monitoring unit 203 assumes that the arrival of the data packet (reversal of the sequence number of the packet) has occurred, and the arrival flag 510 of the data packet information table 500 Is set to “1” (step S608). Then, the quality monitoring unit 203 outputs the data packet to the IP network (step S609), and ends the processing according to this flowchart.

  In the case of SEQ = E_SEQ (step S606: SEQ = E_SEQ), the quality monitoring unit 203 outputs the data packet to the destination client terminal 120 on the assumption that the data flow is functioning normally (step S609). The process according to this flowchart ends.

  FIG. 7 is a flowchart showing processing at the time of ACK packet input of the quality monitoring unit 203 according to the present embodiment. In the flowchart of FIG. 7, the quality monitoring unit 203 determines whether or not an ACK packet has been input. If no ACK packet has been input (step S701: No), the quality monitoring unit 203 waits until it is input. When the ACK packet is input (step S701: Yes), the quality monitoring unit 203 acquires arrival time information of the ACK packet (step S702). Next, the quality monitoring unit 203 monitors duplicate ACKs for each flow (flow ID), and determines whether or not the ACK packet input from the packet flow identification unit 201 is a duplicate ACK packet (step S703). . The quality monitoring unit 203 holds the latest ACK number (latest ACK number) for each flow (flow ID), and when the ACK packet input from the packet flow identification unit 201 is not a duplicate ACK packet (step S703: No), The latest ACK number of the corresponding flow (flow ID) is updated (step S705). The latest ACK number for each flow held by the quality monitoring unit 203 is not updated when the ACK number of the arrived ACK packet is smaller than the held ACK number. On the other hand, if it is a duplicate ACK packet (step S703: Yes), the quality monitoring unit 203 assumes that duplication of the ACK packet has occurred and sets “1” to the duplicate ACK counter 508 of the corresponding packet in the data packet information table 500. Addition is performed (step S704). Then, the ACK packet is output to the IP network (step S710), and the processing according to this flowchart ends.

  Subsequently, the quality monitoring unit 203 refers to the data packet information table 500 and determines whether or not the value of the late arrival flag 510 of the data packet corresponding to the ACK packet is “0” (step S706).

  Here, when the value of the late arrival flag 510 is “0” (step S706: Yes), the quality monitoring unit 203 calculates the RTT from when the data packet is output until the ACK packet is received (step S707). ). The calculated RTT is stored in the RTT 506 of the data packet information table 500. Then, the quality monitoring unit 203 determines whether or not the RTT exceeds a predetermined threshold (step S708). If the RTT exceeds the predetermined threshold (step S708: Yes), the RTT of the data packet information table 500 is determined. The flag 511 is set to “1” (step S709). Then, the quality monitoring unit 203 outputs an ACK packet to the IP network (step S710), and ends the processing according to this flowchart.

  On the other hand, if the value of the late arrival flag 510 is not “0” (ie, “1”) (step S705: No) in step S706, or if the RTT is equal to or less than a predetermined threshold value in step S708 (step S708). : No), the quality monitoring unit 203 outputs an ACK packet to the IP network (step S710), and ends the processing according to this flowchart.

  Then, the quality monitoring unit 203 updates the data packet information table 500 by the processing described above, and then determines whether or not the packet cache is necessary in the flow based on the data in the data packet information table 500 every predetermined time. I do. Note that the necessity determination of the packet cache here is a determination for extracting a flow having a high possibility of determining that the packet cache should be performed, and finally, the deterioration section determination result by the deterioration section determination unit 204 The necessity of the packet cache is determined based on the above.

  Specifically, the quality monitoring unit 203 refers to the data packet information table 500 at predetermined time intervals, and finally performs packet caching when, for example, the calculated value shown below exceeds a predetermined threshold value. As a possibility that it is determined that it should be, a deterioration section determination request for the corresponding flow (corresponding flow ID 401) is output to the deterioration section determination unit 204.

(1) [Number of data packets in which the value of the duplicate packet counter 507 exceeds a predetermined value] / [Number of registered data packets]
(2) [Number of data packets in which the value of the duplicate ACK counter 508 exceeds a predetermined value] / [Number of registered data packets]
(3) [Total value of data loss flag] / [Number of registered data packets]
(4) [Total value of late arrival flags] / [Number of registered data packets]
(5) [total value of RTT flag] / [number of registered late arrival flags is “0”]

  The quality monitoring unit 203 refers to the data packet information table 500. For example, when at least one of the calculated values (1) to (5) exceeds a predetermined threshold, the quality monitoring unit 203 determines the degradation period of the corresponding flow. The request is transmitted to the degradation period determination unit 204. This determination is made when a plurality of calculated values (1) to (5) exceed a threshold value, or a calculated value of any set of the calculated values (1) to (5) sets a threshold value. When it exceeds, for example, a deterioration section determination request for the corresponding flow may be transmitted to the deterioration section determination unit 204. Further, this calculated value may be calculated for all the number of data packets registered in the data packet information table 500, or may be calculated for the number of data packets added within a predetermined time.

<Deterioration section determination unit 204>
When receiving the degradation segment determination request from the quality monitoring unit 203, the degradation segment determination unit 204 determines that the degradation segment of communication is the packet monitoring device 100 from the data registered in the data packet information table 500 of the corresponding flow (flow ID). It is determined whether it is downstream (section A in FIG. 1) or upstream (section B in FIG. 1). When the deterioration section determination unit 204 determines that the deterioration section is “downstream”, the execution section 409 of the monitoring flow table 400 is set to “cache”. On the other hand, when it is determined that the deterioration section is “upstream”, the execution process 409 of the monitoring flow table 400 is set to “monitoring stop”. When the degradation period determination process ends, the degradation period determination unit 204 deletes the packet information of the corresponding flow from the data packet information table 500 and ends the process.

  The determination of the communication deterioration section by the deterioration section determination unit 204 is, for example, by calculating and comparing the following (Na) to (Nd) for the data packet information table 500 (FIG. 5) of the corresponding flow (flow ID 401). Thus, the deterioration section is determined.

(Na) = total of late arrival flags 510 (Nb) = late arrival flag 510 is “0” and both counters (duplicate packet counter 507 and duplicate ACK counter 508) are “1” or more. Number of data packets (Nc) = late arrival flag 510 is “0”, RTT flag 511 is “0”, and one of the two counters (duplicate packet counter 507 and duplicate ACK counter 508) is “1”. Number of data packets greater than or equal to: (Nd) = late arrival flag 510 is “0”, RTT flag 511 is “1”, and one of two counters (duplicate packet counter 507 and duplicate ACK counter 508) Number of data packets with "1" or more

  And the degradation area determination part 204 calculates (Na)-(Nd), and determines a degradation area based on the following (Formula 1). Α and β are coefficients.

Here, (Na) is a value depending on the occurrence of upstream packet loss, packet arrival order reversal, and the like, since the sums of late arrival flags 510 of “1” are totaled.
In (Nb), since the late arrival flag 510 is “0”, no packet loss or reversal of the arrival order of packets occurs upstream. Since the data packet and the ACK packet are retransmitted, this value is a value for estimating the deterioration of the data packet downstream.
In (Nc), since the late arrival flag 510 is “0”, there is no loss of data packet or reversal of the arrival order of packets in the upstream. Only one of the retransmission of the data packet or the retransmission of the ACK packet is performed, and the RTT flag 511 is “0”, so that it is a value for estimating the occurrence of the deterioration of the ACK packet upstream.
Contrary to (Nc), (Nd) is a value for estimating the occurrence of downstream deterioration because the RTT flag 511 is “1”.

  For example, the degradation section determination unit 204 uses this (Equation 1) for the degradation section determination, and when (Equation 1) is established, determines that the degradation is upstream (section B), and (Equation 1) is not established. Sometimes, it is determined that the degradation is downstream (section A).

<Packet cache unit 205>
When the packet input from the packet flow identification unit 201 is a data packet, the packet cache unit 205 determines whether the data packet is cached in the packet cache storage unit 213. If the data packet is already cached, the packet cache unit 205 does not cache the data packet and outputs the data packet to the IP network. On the other hand, when the data packet is not cached, the packet cache unit 205 caches the data packet in the packet cache storage unit 213 and then outputs the data packet to the IP network.

  The packet cache unit 205 monitors duplicate ACKs for each flow (flow ID), holds the latest ACK number (latest ACK number) for each flow (flow ID), and is input from the packet flow identification unit 201. If the packet is an ACK packet, it is determined whether the ACK packet is a duplicate ACK packet. If it is not a duplicate ACK packet, the packet cache unit 205 updates the latest ACK number of the corresponding flow (flow ID), and outputs the ACK packet to the IP network. Note that the latest ACK number for each flow held by the packet cache unit 205 is not updated when the ACK number of the arrived ACK packet is smaller than the held ACK number. In addition, the packet cache unit 205 deletes from the packet cache storage unit 213 a data packet that has been confirmed to be received at the client terminal 120 by the ACK packet.

  On the other hand, when the input ACK packet is a duplicate ACK packet, the packet cache unit 205 reads the data packet requested for retransmission from the packet cache storage unit 213 and transmits it to the client terminal 120 when the first duplicate ACK packet is detected. The received ACK packet is discarded. Thereafter, when the data packet requested for retransmission is stored in the packet cache storage unit 213, the packet cache unit 205 discards the received ACK packet and detects the duplicate ACK even when the first duplicate ACK packet is detected. Each time a predetermined number of packets are received, the data packet requested to be retransmitted is read from the packet cache storage unit 213 and transmitted to the client terminal 120. For example, if the predetermined number = 5, the data requested to be retransmitted is the same as when the same ACK packet is received for the second time (first duplicate ACK), when it is received seventh, and when it is received twelfth. Send the packet. The packet cache unit 205 outputs a duplicate ACK packet to the network when the retransmitted data packet is not stored in the packet cache storage unit 213.

  Further, the packet cache unit 205 sets the execution process 409 of the monitoring flow table 400 to “quality monitoring determination” for a flow in which a duplicate ACK packet is not detected within a predetermined time. As a result, when the flow deterioration factor is resolved, the TCP packet cache can be terminated.

<< Example of Packet Monitoring System 800 Using Multiple Packet Monitoring Devices 100 >>
By arranging a plurality of packet monitoring apparatuses 100 according to the present embodiment, it becomes possible to cache and retransmit packets more efficiently. An example of a packet monitoring system 800 in which a plurality of packet monitoring devices 100 are arranged is shown below.

  FIG. 8 is a diagram showing an example of a system configuration of a packet monitoring system 800 in which a plurality of packet monitoring apparatuses 100 according to the present embodiment are arranged. As in FIG. 1, the packet monitoring system 800 has a packet flow composed of a TCP data packet transmitted from the server 110 to the client terminal 120 and an ACK packet transmitted correspondingly from the client terminal 120 to the server 110. It is a monitoring target. In the packet monitoring system 800, a packet monitoring device 810 is arranged at the Internet side edge on the IP network, and a packet monitoring device 820 is arranged at the access network side edge. Also, the packet monitoring system 800 is provided with a management server 830 that manages the packet monitoring devices 810 and 820 on the IP network.

  A gateway (GW) 130 is arranged on the Internet side (server 110 side) of the IP network, and an edge router 140 is arranged on the access network side (client terminal 120 side). A router 805 is arranged between the packet monitoring device 810 and the packet monitoring device 820. In the TCP session between the server 110 and the client terminal 120, the section C is between the packet monitoring device 820 and the client terminal 120, the section D is between the packet monitoring device 810 and the packet monitoring device 820, and the packet monitoring device 810 is A section E is defined between the server 110 and the server 110.

  First, in the packet monitoring system 800, the packet monitoring described above is performed by the packet monitoring device 820 installed at the edge on the client terminal 120 side. As a result of packet monitoring, when communication deterioration is detected and the deterioration section determining unit 204 of the packet monitoring apparatus 820 determines that the deterioration section is “downstream” (section C in FIG. 8), the packet monitoring apparatus 820 determines the data packet. Cache, retransmission of lost packets, deletion of duplicate ACK packets, etc. are performed as appropriate. At this time, the packet monitoring device 820 does not communicate with the management server 830.

  On the other hand, when the deterioration section is determined to be “upstream” (section D or E in FIG. 8), the deterioration section determination unit 204 of the packet monitoring device 820 sets the execution process to “monitoring stop” and the monitoring flow table 400. The degradation section determination result including the identification information (information such as the flow ID and IP address) of the corresponding flow registered in is transmitted to the management server 830.

  The management server 830 collects the path information of the corresponding flow from the apparatus in the IP network based on the identification information of the corresponding flow received from the packet monitoring apparatus 820, and is on the communication path of the corresponding flow. Also, the packet monitoring device 810 located upstream is identified. The management server 830 registers the identification information of the corresponding flow in the monitoring flow table 400 of the packet monitoring device 810. That is, the management server 830 transmits the identification information of the corresponding flow and a cache necessity determination request for requesting the necessity of caching of a TCP packet transmitted / received in the TCP session identified by the identification information. At this time, the execution process 409 of the monitoring flow table 400 is registered as “quality monitoring”.

  The packet monitoring apparatus 810 that has received the cache necessity determination request from the management server 830 performs quality monitoring with reference to the monitoring flow table 400 when a TCP packet is input. When the deterioration section determination unit 204 of the packet monitoring device 810 determines that the deterioration section is “downstream” (section D in FIG. 8), the execution processing 409 of the monitoring flow table 400 is set to “cache”, and the data packet cache is set. The packet monitoring device 810 appropriately performs retransmission of lost packets, deletion of duplicate ACK packets, and the like, and transmits the degradation section determination result to the management server 830. On the other hand, when it is determined that the deterioration section is “upstream” (section E in FIG. 8), the execution process 409 of the monitoring flow table 400 is set to “stop monitoring”, and the identification information of the corresponding flow and the deterioration section determination result are set. Transmit to the management server 830.

  When the degradation section determination result received from the packet monitoring apparatus 810 is “upstream” (section E in FIG. 8), the management server 830 deletes the information of the corresponding flow from the monitoring flow table 400 of the packet monitoring apparatus 810. Request. On the other hand, when the deterioration section is “downstream” (section D in FIG. 8), the management server 830 requests to delete the information of the corresponding flow from the monitoring flow table 400 of the packet monitoring apparatus 820.

  As described above, the packet monitoring system 800 performs snoop (data packet cache, loss packet retransmission, duplication ACK deletion, etc.) at a monitoring point (packet monitoring device) close to the degradation occurrence section on the IP network. Can do. Therefore, according to the packet monitoring system 800, it is possible to reduce the traffic between the packet monitoring device and the server and the device load. Further, according to the packet monitoring system 800, it is possible to reduce the time until the client terminal 120 receives a retransmission data packet.

  As described above, the packet monitoring apparatus 100 according to the embodiment determines whether or not a packet cache is necessary for each TCP session (flow) in the IP network, and snoops (data packet cache, lost packet). For example, retransmission of duplicate ACKs, etc.). This eliminates the need to cache TCP session packets that do not require packet caching, thereby reducing the memory required for caching. Further, since the packet monitoring apparatus 100 performs monitoring on the IP network, it is possible to avoid a decrease in data transfer rate due to TCP congestion control without modifying the terminal side apparatus (server 110 or client terminal 120).

  Further, according to the packet monitoring apparatus 100, the snoop is performed only in the flow that is estimated to have a high improvement effect based on the overlapping number of packets, the packet loss, the packet arrival number, and the round trip time. Also, by determining the degradation period, it is possible to eliminate the need to cache TCP session packets that do not require packet caching. As a result, the resources of the packet monitoring device 100 can be used effectively, and the traffic and device load from the server 110 to the packet monitoring device 100 can be reduced.

  Further, according to the packet monitoring apparatus 100, prior to determining whether or not the cache is necessary, only duplication ACK monitoring with a relatively small processing amount is performed, and only whether or not a flow in which a large amount of packet loss has occurred is determined. Thereby, the resource of the packet monitoring apparatus 100 can be used effectively.

  In this embodiment, the packet monitoring device 100 (820) is arranged at the access network side edge, and the packet monitoring device 810 is arranged at the Internet side edge (see FIGS. 1 and 8). However, the present invention is not limited to such an arrangement, and the functions provided in the packet monitoring apparatus 100 may be provided in the edge router 140, the gateway (GW) 130, the router 805, and the like to monitor packets. .

100, 810, 820 Packet monitoring device 110 Server 120 Client terminal 130 Gateway (GW)
140 Edge router 201 Packet flow identification unit 202 Quality monitoring determination unit 203 Quality monitoring unit 204 Degraded section determination unit 205 Packet cache unit 211 Table storage unit 212 Data packet information table storage unit 213 Packet cache storage unit 400 Monitoring flow table 450 User information table 500 Data packet information table 830 Management server

Claims (1)

Server on IP network - with providing a plurality of packet monitoring unit for monitoring the TCP packets transmitted and received TCP session established between the client terminal, a management server for managing the packet monitoring device multiple, the IP network server above - a packet monitoring system for monitoring the TCP packets transmitted and received by the TCP session established between the client terminal,
The packet monitoring device includes:
A packet flow identification unit for identifying in which TCP session the TCP packet transmitted / received on the IP network is transmitted / received;
A quality monitoring determination unit that determines that the TCP session should be quality monitored when the overlapping number of ACK packets transmitted and received in the TCP session within a predetermined time exceeds a predetermined threshold;
For each TCP session that is determined to be quality-monitored, a determination as to whether or not the TCP packet to be transmitted / received in the TCP session needs to be cached includes a plurality of TCP packets, packet loss, packet delay, and the A quality monitoring unit that executes based on at least one of round trip times in a TCP session;
Based on the duplication number of the packet, the packet loss, the late arrival of the packet, and the round trip time, the degradation section in the TCP session is a section between the server and the packet monitoring device or the client terminal and the It is determined whether the packet monitoring device is between the server and the packet monitoring device, and it is determined that the TCP packet cache is unnecessary, and the deterioration interval is the A degradation section determination unit that finally determines that a cache is required for the TCP packet that the quality monitoring unit has determined that a cache is required, between the client terminal and the packet monitoring device;
When the TCP session that transmits and receives the TCP packet is determined to require caching, the TCP packet is cached, and when a retransmission request is received, the cached TCP packet is A packet cache unit to be retransmitted;
With
The packet monitoring device includes:
When it is determined that the deterioration interval in the TCP session is between the server and the packet monitoring device, the determination result of the deterioration interval including identification information for identifying the TCP session is transmitted to the management server, If it is determined that the degradation interval is between the client terminal and the packet monitoring device, the final determination that the TCP packet needs to be cached in its own device,
The management server
Identify the packet monitoring device located on the server side that is on the communication path of the TCP packet and is upstream in the communication path than the packet monitoring device that transmitted the determination result,
The identification information received from the packet monitoring device that transmitted the determination result to the packet monitoring device located on the specified server side, and the cache of the TCP packet transmitted and received in the TCP session identified by the identification information A cache necessity determination request for requesting necessity determination, and
The packet monitoring device located on the server side is:
A packet monitoring system that receives the identification information and the cache necessity determination request and determines whether or not the TCP packet to be transmitted / received in the TCP session indicated by the identification information is cached.

Images