JP5829183B2 - Method, node device, and program for detecting faulty node device or faulted link in real time based on routing protocol - Google Patents

Description

  The present invention relates to a method, a node device, and a program for detecting a fault location in a network in real time based on a routing protocol.

  In the Internet, a node device (for example, a router) appropriately relays and forwards a packet using a routing protocol. As a typical route control protocol, there is “BGP (Border Gateway Protocol)” for exchanging route information between organization networks on the Internet. The node device may be a single device or a system constituted by a plurality of devices. A unique “AS (Autonomous System) number” (unique identification number) in the Internet is assigned to a node device compatible with BGP. The AS number is assigned to each set of node devices under the common policy and the same management operation. The AS number is basically 2 bytes (currently 4 bytes), and is managed by IANA (Internet Assigned Numbers Authority).

  FIG. 1 is a network configuration diagram in BGP.

According to FIG. 1, node devices 1 having AS numbers are connected to each other via a network. Each node device periodically transmits a route update message (UPDATE) including a source prefix (source network address) based on BGP and an AS number by broadcast. The UPDATE message includes the following parameters:
(1) Message type (2) Prefix (3) AS_PATH attribute “Message type” represents the type of route update message (notification Announce / delete Withdraw).
The “prefix” is a set (xxx.xxx.xxx.xxx/xx) of an IP address and a subnet mask, and represents a transmission source network address (transmission source address range).
The “AS_PATH attribute” represents a path of an arrival route from the prefix (AS number string).

  Each node device that has received the UPDATE message includes the AS number of the node device in the path of the UPDATE message, and relays the UPDATE message.

  The observation node device receives the route update message broadcast from each node device. Further, the observation node device has a path (route) table called RIB (Routing Information Base). Here, the “path” is a path between the management node device (transmission source) and the observation node device, and means a connection via the relay node device. The “link” means a connection between adjacent node devices that are directly connected.

  The path table includes the “prefix” of the source node device and the “AS number path” corresponding to the prefix. The path table is updated by periodically receiving UPDATE messages.

  Conventionally, for a network based on such a routing protocol, in order to detect a faulty link, a large number of route update messages are collected in a database, and then route update messages having similar observation times are clustered (for example, dendrogram). (See, for example, Non-Patent Document 1). According to this technique, the failure location can be estimated from the change state of the AS path for each prefix for a plurality of route update messages before and after the occurrence of the failure.

  There is also a technique for extracting a link between each node device from an AS path for each prefix included in the route update message and calculating the number of prefixes used for each link in time series (for example, see Non-Patent Document 2 or 3). . According to this technique, the number of prefixes (number of UPDATE messages) received at the evaluation time T is recorded for each link. A link in which the number of prefixes decreases or becomes zero is estimated as a failure location.

  Although not a technique for detecting a link failure, there is a technique for deriving a desired path (see, for example, Non-Patent Document 4).

  Further, according to the same inventor as the present application, a technique is also disclosed in which the observation node device records a received route update message and estimates a failure link from the amount of change in the number of prefixes (for example, Patent Documents 1 and 2). And Non-Patent Document 5). This uses the BGP routing table and the BGP UPDATE message to calculate the number of prefixes that use the link between the ASs.

  According to this technology, as an algorithm for detecting a faulty link, when the number of prefixes that use a monitored link is equal to or less than a threshold (for example, 0), the link is detected as a fault location candidate, and the number of prefixes The time when becomes 0 becomes the failure detection time. Specifically, the link group detected for each optimum route (normal state path) is set as one set, and the candidates of the set are sorted in the order of detection time. Then, the candidate group within d seconds from the first detection is divided as the same cluster, and the link closest to the observation point is estimated as a failure link for each cluster.

JP 2011-166248 A JP 2011-089443 A

A FeldMann, O. Maennel, Z. Mao, A. Berger and B. Maggs, "Locating Internet routing instabililties," SIGCOMM 2004. M. Lad, R. Oliveira, D. Massey, L. Zhang, "Inferring the Originof Routing Changes using Link Weights," IEEE ICNP 2007. A. Campisano, L. Cittadini, G. Di Battista, T. Refice, C. Sasso, "Tracking back the root cause of a path change in interdomainrouting," IEEE Network Operations and Management Symposium, 2008. R. Oliveira, B. Zhang, D. Pei, L. Zhang, "Quantifying PathExploration in the Internet", IEEE / ACM Transaction on Networking, 2008. M. Watari, A. Tachibana, S. Ano, Inferring the Origin of RoutingChanges based on Preferred Path Changes, PAM 2011.

  According to the technique described in Non-Patent Document 1, the failure location is estimated using a table representing the state of the network before and after the occurrence of the failure. However, in the actual Internet, route fluctuations occur every second, making it difficult to define the state before the failure. Further, according to this technique, a complicated algorithm is required, so that a huge amount of calculation is required according to the scale of the network, and a fault link cannot be detected in real time. Furthermore, when failures occur in a plurality of links almost simultaneously, there is a problem that a specific failure link cannot be detected by clustering, and clustering must be executed every short time slot.

  Also, according to the techniques described in Non-Patent Documents 2 and 3, the failure location is estimated by periodically checking the number of prefixes without defining the state before the failure. A route update message is received, and the number of prefixes is incremented for each link from the AS path corresponding to the prefix of the route update message. It can be determined that a failure has occurred for a link whose prefix number is 0 or decremented.

  According to the techniques described in these Non-Patent Documents 1, 2, and 3, it takes a certain time to detect a route change of a route update message until a failure is detected after an actual failure occurs. The fixed time is actually the time at which path fluctuations in the BGP network converge. This time takes about 2 to 3 minutes for the Internet. In particular, since the fault location is estimated after waiting for complete convergence of the path variation, it cannot be detected in real time. In addition, the accuracy of failure estimation varies greatly depending on the waiting time for convergence of route fluctuations.

  Furthermore, according to the techniques described in Patent Documents 1 and 2 and Non-Patent Document 1, a failure can be detected only in link units. Therefore, when a failure occurs at the AS level (node device), it is detected that a failure has occurred in all links to which the node device is connected. The failure at the AS level means that, for example, when one AS is a system configured by a plurality of node devices (BGP routers), all of the plurality of node devices go down at the same time.

  Therefore, the present invention observes a route update message based on a route control protocol in a normal sequence, and can determine whether a failure of a link between node devices or a failure of the node device itself can be detected. An object is to provide an apparatus and a program.

According to the present invention, a plurality of devices having unique identification numbers are connected to each other, and are a network that transmits and receives a route update message of a route control protocol,
Each node device periodically broadcasts a route update message including one or more prefixes and a unique identification number as a publicity source,
Each node device relays and forwards the route update message, including the unique identification number of the node device, in the path consisting of consecutive relay node device unique identification numbers included in the received route update message,
In the failure detection method in which the observation node device detects whether the failure of the link between the node devices or the failure of the node device itself,
Observation node device
A path through which the received route update message has passed is recorded, and a failure candidate node device in which the number of prefixes for each node device becomes zero and a failure candidate link in which the number of prefixes for each link becomes zero are detected. Steps,
A second step of determining whether there is a detour link other than the failure candidate link for the failure candidate node device that matches the upstream node device of the failure candidate link;
When there is a detour link, if the route update message of the prefix that is the source of the failure candidate node device has reached, it is determined that a failure has occurred in the failure candidate link, and conversely, the route of the prefix And a third step of determining that a failure has occurred in the failure candidate node device if the update message has not arrived.

According to another embodiment of the failure detection method of the present invention,
Regarding the first step in the observation node device,
An eleventh step of determining one normal state path in a normal state for each prefix for which each node device is a publicity source using the path through which the route update message has passed;
A twelfth step of determining, for each prefix, a node device that advertises the prefix as a “monitoring target node device” and a link connecting to the monitoring target node device as a “monitoring target link”;
A thirteenth step of recording the path through which the received route update message has passed and measuring the number of prefixes of the monitoring target node device and the number of prefixes including the monitoring target link in the path in unit time;
It is also preferable to have a fourteenth step of detecting a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero.

According to another embodiment of the failure detection method of the present invention,
Regarding the fourteenth step in the observation node device,
When the prefix in the normal state path is in Announce (notification) state, when the route update message of type Withdraw (deletion) is received, the number of prefixes of the monitored node device and the monitored link in the prefix is decremented by 1. ,
When the prefix in the normal state path is in the Announce state, when the route update message of type Announce is received, and the monitored node device is not the public information source node device, the number of prefixes of the monitored node device is decremented by 1,
When the prefix in the normal state path is in the Announce state, when a route update message of type Announce is received, the monitoring target link is not included in the path of the prefix, or the monitoring target node device is not the PR node device The number of prefixes of the monitored node device is decremented by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received and the monitored node device is a public information source node device, the number of prefixes of the monitored node device is incremented by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received, the monitoring target link is included in the path of the prefix, and the monitoring target node device is the public information source node device. In this case, it is also preferable to increment the number of prefixes of the monitored link by 1.

According to another embodiment of the failure detection method of the present invention,
For the eleventh step in the observation node device, the accumulated use time for each path included in the received route update message is collected for each prefix of each node device, and the path with the longest accumulated use time in the predetermined time range is collected. It is also preferable to determine the normal state path.

According to another embodiment of the failure detection method of the present invention,
The routing protocol is BGP (Border Gateway Protocol),
The unique identification number is an AS (Autonomous System) number,
The route update message is BGP UPDATE (Announce / Withdraw),
A prefix is a source address consisting of a pair of an IP address and the number of bits of a subnet mask or a range thereof.
The path of the route update message is also preferably included in the AS_PATH attribute.

According to the present invention, a node device having a unique identification number connected to a network that transmits and receives a route update message of a routing protocol,
A route update message transmission means for periodically broadcasting a route update message including one or more prefixes and a unique identification number as a public information source;
A node having relay transfer means for relaying and forwarding the route update message, including the unique identification number of the node device, in a path composed of consecutive relay node device unique identification numbers included in the received route update message In the device
Failure path detection that records the path through which the route update message is received and detects the failure candidate node device for which the number of prefixes for each node device is zero and the failure candidate link for which the number of prefixes for each link is zero Means,
Detour link determination means for determining presence / absence of detour links other than the failure candidate link for the failure candidate node apparatus that matches the upstream node apparatus of the failure candidate link;
When there is a detour link, if the route update message of the prefix that is the source of the failure candidate node device has reached, it is determined that a failure has occurred in the failure candidate link, and conversely, the route of the prefix If the update message has not arrived, a failure detection means for determining that a failure has occurred in the failure candidate node device is provided.

According to another embodiment of the node device of the present invention,
Failure candidate detection means
A normal state path determining means for determining one normal state path in a normal state for each prefix for which each node device is a publicity source using the path through which the route update message has passed;
For each prefix, a monitoring target determination unit that determines a node device that advertises the prefix as a “monitoring target node device” and a link connecting to the monitoring target node device as a “monitoring target link”;
Prefix count measuring means for recording the path through which the received route update message has passed and measuring the number of prefixes of the monitored node device and the number of prefixes including the monitored link in the path in unit time;
It is also preferable to have a failure candidate determination unit that determines a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero.

According to another embodiment of the node device of the present invention,
The failure candidate determination means
When the prefix in the normal state path is in Announce (notification) state, when the route update message of type Withdraw (deletion) is received, the number of prefixes of the monitored node device and the monitored link in the prefix is decremented by 1. ,
When the prefix in the normal state path is in the Announce state, when the route update message of type Announce is received, and the monitored node device is not the public information source node device, the number of prefixes of the monitored node device is decremented by 1,
When the prefix in the normal state path is in the Announce state, when a route update message of type Announce is received, the monitoring target link is not included in the path of the prefix, or the monitoring target node device is not the PR node device The number of prefixes of the monitored node device is decremented by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received and the monitored node device is a public information source node device, the number of prefixes of the monitored node device is incremented by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received, the monitoring target link is included in the path of the prefix, and the monitoring target node device is the public information source node device. In this case, it is also preferable to increment the number of prefixes of the monitored link by 1.

  According to another embodiment of the node device of the present invention, the normal state path determination unit collects the accumulated usage time for each path included in the received route update message for each prefix of each node device, and the predetermined time range. Thus, it is also preferable to determine the path having the longest accumulated use time as the normal state path.

According to another embodiment of the node device of the present invention,
The routing protocol is BGP (Border Gateway Protocol),
The unique identification number is an AS (Autonomous System) number,
The route update message is BGP UPDATE (Announce / Withdraw),
A prefix is a source address consisting of a pair of an IP address and the number of bits of a subnet mask or a range thereof.
The path of the route update message is also preferably included in the AS_PATH attribute.

According to the present invention, including one or more prefixes and a unique identification number for a computer mounted on a node device having a unique identification number connected to a network that transmits and receives a route update message of a routing protocol as a public information source A route update message transmission means for periodically transmitting a route update message by broadcast;
A node that functions as a relay transfer unit that relays and forwards the route update message by including the unique identification number of the node device in the path composed of consecutive relay node device unique identification numbers included in the received route update message In the program for the device,
Failure path detection that records the path through which the route update message is received and detects the failure candidate node device for which the number of prefixes for each node device is zero and the failure candidate link for which the number of prefixes for each link is zero Means,
Detour link determination means for determining presence / absence of detour links other than the failure candidate link for the failure candidate node apparatus that matches the upstream node apparatus of the failure candidate link;
When there is a detour link, if the route update message of the prefix that is the source of the failure candidate node device has reached, it is determined that a failure has occurred in the failure candidate link, and conversely, the route of the prefix If the update message has not arrived, the computer is caused to function as failure detection means for determining that a failure has occurred in the failure candidate node device.

  According to the failure detection method, the node device, and the program of the present invention, a route update message based on a route control protocol is observed in a normal sequence, and it is determined whether the failure is a link failure between node devices or a failure of the node device itself. Can be detected.

It is a network block diagram in BGP. It is a flowchart of the observation node apparatus in this invention. It is explanatory drawing showing detection (S11) of a normal state path | pass. It is explanatory drawing showing reception of the route update message corresponding to the rule 1. FIG. 6 is an explanatory diagram illustrating reception of a route update message corresponding to rule 2. FIG. 12 is an explanatory diagram illustrating reception of a route update message corresponding to rule 3. FIG. It is explanatory drawing showing reception of the route update message corresponding to the rules 5 and 6. It is explanatory drawing showing the "path table" "node device prefix number" "link prefix number" observed by the observation node device in a normal state. FIG. 5 is an explanatory diagram showing “path table”, “number of node device prefixes”, and “number of link prefixes” observed by an observation node device when a failure occurs in the node device. FIG. 5 is an explanatory diagram showing a “path table”, “number of node device prefixes”, and “number of link prefixes” observed by an observation node device when a failure occurs in a link. Explanatory drawing showing the “path table”, “number of node device prefixes”, and “number of link prefixes” observed by the observation node device when a failure occurs in the link and only one prefix is transferred It is. It is a functional block diagram of the node apparatus in this invention.

  Below, the form for implementing this invention is demonstrated in detail using drawing.

  FIG. 2 is a flowchart of the observation node device according to the present invention.

  FIG. 2 shows the same network configuration as FIG. 1, and seven node devices 1 (AS10 to AS70) having AS numbers are connected to each other using BGP. The UPDATE message transmitted from each of the node devices AS20 to AS70 reaches the observation node device AS10.

Here, the flow until the prefixes p60, p61, and p62 transmitted from the node device AS60 reach the observation node device AS10 will be described in detail.
The node device AS60 periodically transmits an UPDATE (Announce) message including the prefix and AS number managed by the node device AS60 as follows.
UPDATE (Announce) message [A | p60 | 60]: To node device AS40
UPDATE (Announce) message [A | p61 | 60]: To node device AS50
UPDATE (Announce) message [A | p62 | 60]: To node device AS40 The node device AS40 adds its AS number [40] to the AS path of the UPDATE message received from AS60 as follows. To the node devices AS30 and AS20.
UPDATE (Announce) message [A | p60 | 40 60]: To node device AS20
UPDATE (Announce) message [A | p62 | 40 60]: To node device AS30 The node device AS50 adds its AS number [50] to the AS path of the UPDATE message received from AS60 as follows. To the node device AS20.
UPDATE (Announce) message [A | p61 | 50 60]: to node device AS20 The node device AS30 adds its AS number [30] to the AS path of the UPDATE message received from AS40 as follows. To the node device AS20.
UPDATE (Announce) message [A | p62 | 30 40 60]: to node device AS20 The node device AS20 adds its AS number to the AS path of the UPDATE message received from AS30, AS40, or AS50 as follows: 20] is added and transmitted to the node device AS10.
UPDATE (Announce) message [A | p60 | 20 40 60]: To node device AS10
UPDATE (Announce) message [A | p61 | 20 50 60]: To node device AS10
UPDATE (Announce) message [A | p62 | 20 30 40 60]: to node device AS10 The node device AS10 adds its AS number [10] to the AS path of the UPDATE message received from AS60 and adds it. Record in the pass table.

  Similarly to the sequence described above, the node devices AS50, AS40, AS30, and AS20 other than the node device AS60 also periodically transmit the UPDATE message by broadcast, and the UPDATE message relays the other node devices to the observation node. Received by device AS10.

According to FIG. 2, the observation node device AS10 according to the present invention executes the following three steps each time it receives a route update (UPDATE) message.
[S1] Records a path through which the received route update message has passed, and detects a failure candidate node device in which the number of prefixes for each node device has become zero and a failure candidate link in which the number of prefixes for each link has become zero. . Here, when zero prefix numbers are detected for a plurality of node devices and a plurality of links, the node device and link closest to the observation point can be considered as failure candidates.

[S2] Next, for the failure candidate node device that matches the upstream node device of the failure candidate link, the presence / absence of a detour link other than the failure candidate link is determined. Here, when a failed link is generated by BGP, a predetermined time is required and the route update message is transferred while searching for a detour route. Therefore, the observation point can determine that the failure candidate node device does not require the detour link only when the route update message having the failure candidate node device as the publicity source cannot be received even after the predetermined time has elapsed.

[S3] If there is a detour link, it is determined as follows.
(1) If the route update message of the prefix from which the failure candidate node device is a PR source has arrived, it is determined that a failure has occurred in the failure candidate link.
(2) Conversely, if the route update message for the prefix has not arrived, it is determined that a failure has occurred in the failure candidate node device.
Of course, when only the failure candidate node device has a prefix number of zero, the failure candidate node device closest to the observation point is estimated as the failure location. If only the failure candidate link has a prefix number of zero, the failure candidate link closest to the observation point is estimated as the failure location.

Here, the first step [S1] will be described in detail.
(S11) One normal state path (optimum route) in the normal state is determined for each prefix for which each node device is a source of information using the path through which the route update message has passed.

  FIG. 3 is an explanatory diagram showing detection of a normal state path (S11).

  When the observation node device AS10 receives an UPDATE (Announce) message for each prefix, the observation node device AS10 acquires the prefix and AS path from the UPDATE message. The observation node device AS10 collects the accumulated usage time for each AS path included in the received UPDATE message for each prefix of the transmission source node device. According to FIG. 4, for example, the management source node device is AS60, and the accumulated usage time of prefixes p60, p61, and p62 advertised by the node device AS60 is recorded.

Thereafter, the observation node device AS10 determines one normal state path in the normal state for each prefix of each node device, using the path (AS_PATH attribute) included in the UPDATE message. Here, the path with the longest accumulated use time is determined as the normal state path. According to FIG. 2, the normal state path is determined for the management source node apparatus AS60 as follows.
AS pass for p60, accumulated usage time "240 hours" [10 20 40 60]
AS pass for p61, cumulative usage time “200 hours” [10 20 50 60]
AS pass for p62, cumulative usage time “180 hours” [10 20 30 40 60]

(S12) Next, for each prefix, a node device that advertises the prefix is determined as a “monitoring target node device”, and a link connected to the monitoring target node device is determined as a “monitoring target link”.

According to FIG. 3, it is determined as follows based on the normal state path.
For the prefix p70, the node device AS70 and the link [60-70] are determined as monitoring targets.
For the prefix p60, the node device AS60 and the link [40-60] are determined as monitoring targets.
For the prefix p61, the node device AS60 and the link [50-60] are determined as monitoring targets.
For the prefix p62, the node device AS60 and the link [40-60] are determined as monitoring targets.
For the prefix p50, the node device AS50 and the link [30-50] are determined as monitoring targets.
For the prefix p40, the node device AS40 and the link [30-40] are determined as monitoring targets.
For the prefix p30, the node device AS30 and the link [20-30] are determined as monitoring targets.
For the prefix p20, the node device AS20 and the link [10-20] are determined as monitoring targets.

(S13) The path through which the received route update message has passed is recorded, and the number of prefixes of the monitoring target node device and the number of prefixes including the monitoring target link in the path in unit time are measured.

(S14) Then, a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero are detected.

Here, a set of failure candidate node devices and failure candidate links is detected for each normal state path (optimum route). The failure candidate node devices and failure candidate links in the set are sorted in the order of their detection times, and a predetermined time d from the first detection
Divide candidate groups within seconds as the same cluster. Then, for each cluster, the failure location is estimated for the failure candidate node device and the failure candidate link.

  Next, the prefix counting method (S13) for the monitoring target node device and the monitoring target link will be described in detail. The observation node device analyzes the BGP message in time series, and totals the fluctuation amount of the number of prefixes of the monitoring target node device and the monitoring target link. The rules are described in detail below.

[Rule 1] When the path update message of type Withdraw (deletion) is received when the prefix in the normal state path is Announce (notification), the number of prefixes of the monitoring target node device and the monitoring target link in the prefix is determined. Decrease by one.

  FIG. 4 is an explanatory diagram showing reception of a route update message corresponding to rule 1. According to FIG. 4, for example, when the observation node device AS10 receives the With62 path update message of p62, the number of prefixes of the node device AS60 is decremented by 1 to “3-> 2”, and the link 40-60 The number of prefixes is decremented by 1 to “2-> 1”.

[Rule 2] When the prefix in the normal state path is in the Announce state, when the route update message of the type Announce is received and the monitored node device is not the PR node device, the number of prefixes of the monitored node device is set to 1. Decrease. As a reason for changing the public information source node device, for example, a case where the network configuration is changed is assumed. Conversely, if the monitored node device is a public information source node device, no processing is performed.

  FIG. 5 is an explanatory diagram showing reception of a route update message corresponding to rule 2. According to FIG. 5, for example, when the observation node device AS10 receives a route update message of the p60 Announce path “10 20 40 60 90”, since the source node device is AS90, The number of prefixes is decremented to “3-> 2”. If the correct route update message for the p60 announce path “10 20 40 60” is received, no processing is performed.

[Rule 3] When the prefix in the normal state path is in the Announce state, when a route update message of type Announce is received and the monitoring target link is not included in the path of the prefix, the prefix of the monitoring target node device Decrease the number by one. If the monitoring target link is correctly included in the path of the prefix and the monitoring target node device is the public information source node device, no processing is performed.

  FIG. 6 is an explanatory diagram showing reception of a route update message corresponding to rule 3. According to FIG. 6, for example, when the observation node device AS10 receives the Announce path “10 20 50 60” of p60, the monitoring target link [40-60] is not included, and the link [40-60 ] The prefix number is decremented to “2-> 1”. If the p60 announce path “10 20 40 60” is received correctly, no processing is performed.

[Rule 4] No processing is performed when a path update message of type Withdraw is received when the prefix in the normal state path is the Withdraw state.

[Rule 5] When the prefix in the normal state path is in the Withdraw state, when the route update message of type Announce is received and the monitored node device is a public information source node device, the number of prefixes of the monitored node device is set. Increment by one.

[Rule 6] When a path update message of type Announce is received when the prefix in the normal state path is in the Withdraw state, the monitoring target link is included in the path of the prefix and the monitoring target node device is In the case of a public information source node device, the number of prefixes of the monitoring target link is incremented by one.

  FIG. 7 is an explanatory diagram showing reception of a route update message corresponding to the rules 5 and 6. According to FIG. 7, for example, when the observation node device AS10 is in the Withdraw state for p62, the UPDATE message of the Announce path “10 20 50 60” is received. Here, the public information source node device is the monitoring target node device AS60, and the path includes the monitoring target link [50-60]. In this case, the number of prefixes of the monitoring target node device AS60 is incremented by 1 to “2 → 3”, and the monitoring target link [50-60] is also incremented by 1 to “0 → 1”.

[Rule 7] For prefixes for which the optimum route has not been determined, nothing is done even when a route update message (Announce / Withdraw) is received.

  FIG. 8 is an explanatory diagram showing “path table”, “number of node device prefixes”, and “number of link prefixes” observed by the observation node device in a normal state.

[Path table]
For each prefix, “AS path”, “status”, “monitoring target AS”, and “monitoring target link” are recorded. The “AS path” is a path included in the received UPDATE message, and is based on a normal state path as described later. The “state” is a type (Announce (notification) or Withdraw (deletion)) included in the received UPDATE message. The “monitoring target AS” is an AS that is a publicity source of the prefix. The “monitoring target link” is a link connected downstream from the monitoring target AS, and is a link through which the prefix flows.
[Number of node device prefixes]
For each node device (AS number), the number of prefixes transmitted by the node device as a public information source and observed by the observation node device is recorded. According to FIG. 8, the node device AS60 transmits as a public information source and is observed by the observation node device, and the number of prefixes is “3” of p60, p61, and p62.
[Number of link prefixes]
For each link between node devices (AS numbers), the number of prefixes received via the link is recorded. According to FIG. 8, the number of prefixes received via the link 40-60 is “2” of p60 and p62, and the number of prefixes received via the link 50-60 is “1” of p61. Is.

  FIG. 9 is an explanatory diagram illustrating the “path table”, “number of node device prefixes”, and “number of link prefixes” observed by the observation node device when a failure occurs in the node device.

  When a failure occurs in the node device AS60, the observation node device AS10 results in the number of prefixes of the failure candidate node devices AS60 and AS70 and the failure candidate links [40-60] [50-60] according to the above-described rule 1. ] [60-70] prefix number is zero. Here, the upstream failure candidate node device closest to the observation point is AS60, and the failure candidate links closest to the observation point are [40-60] [50-60].

  Next, the failure candidate node device AS60 determines whether there is a detour link other than the failure candidate link [40-60] [50-60]. When a failed link is generated by BGP, a route update message is transferred while searching for a detour route in a predetermined time. Therefore, the observation node device AS10 can determine that the failure candidate node device AS60 does not require a detour link when it cannot receive a route update message with the failure candidate node device AS60 as a publicity source even after a predetermined time has elapsed. .

When there is a detour link, the observation node device AS10 determines as follows.
(1) If the failure candidate node device AS60 has received a route update message for a prefix that is a source of information, it determines that a failure has occurred in the failure candidate link.
(2) Conversely, if the route update message for the prefix has not arrived, it is determined that a failure has occurred in the failure candidate node device AS60.

Note that the node device AS40 determines that a failure has occurred in the node device AS60 or the link [AS40-AS60] when the route update message cannot be received from the node device AS60. At this time, the node device AS40 that has detected the failure transmits an UPDATE (Withdraw) message to the node devices AS20 and AS30.
UPDATE (Withdraw): [W | p60, p62, p70]
Withdraw means that the route has been deleted. The UPDATE (Withdraw) message includes a prefix via the link [AS40-AS60] for the route update (UPDATE) message relayed in the past by the node device AS40.

  FIG. 10 is an explanatory diagram showing the “path table”, “node device prefix count”, and “link prefix count” observed by the observation node device when a failure occurs in the link.

  When a failure occurs in the link [40-60], the observation node device AS10 results in the number of prefixes of the failure candidate node device AS70 and the failure candidate link [40-60] [60- The number of prefixes in [70] is zero. On the other hand, for p61 for which the failure candidate node device AS60 is the source of information, the link [50-60] does not become a failure candidate link and the prefix of the node device AS60 is zero because it passes through the link [50-60]. The node device AS60 does not become a failure candidate node device.

  Next, for the failure candidate node device AS70, the presence / absence of a detour link other than the failure candidate link [40-60] [60-70] is determined. If the observation node device AS10 cannot receive a route update message using the failure candidate node device AS70 as a publicity source even after a predetermined time has elapsed, it can be determined that the failure candidate node device AS70 does not require a detour link.

  As for the prefix p70, detour links [20-50] [50-60] [60-70] are observed as time passes. Therefore, the observation node device AS10 determines that a failure has occurred in the failure candidate link if the route update message of the prefix for which the failure candidate node device AS70 is a public information source has arrived. Here, since the failure candidate links [40-60] [60-70] are detected, it is determined that a failure has occurred in the link [40-60] on the downstream side.

  FIG. 11 shows a “path table”, “number of node device prefixes”, and “number of link prefixes” observed by an observation node device when a failure occurs in the link and only one prefix is transferred. It is explanatory drawing showing.

  When a failure occurs in the link [40-60], the observation node device AS10 results in the number of prefixes of the failure candidate node devices AS60 and AS70 and the failure candidate link [40-60] [40] [ The number of prefixes in [60-70] becomes zero. Here, for the failure candidate node device AS70, the observation node device AS10 receives a route update message via the links [20-50] [50-60] [60-70] after a predetermined time has elapsed.

  Next, the failure candidate node device AS60 determines whether there is a detour link other than the failure candidate link [40-60]. The observation node device AS10 can determine that the failure candidate node device AS60 does not require a detour link when the route update message using the failure candidate node device AS60 as a publicity source cannot be received even after a predetermined time has elapsed.

  According to FIG. 11, detour links [20-50] [50-60] are observed with respect to the prefix p60 as time elapses. For this reason, the observation node device AS10 determines that a failure has occurred in the failure candidate link if the route update message of the prefix for which the failure candidate node device AS60 is a public information source has arrived. Here, since the failure candidate links [40-60] [60-70] are detected, it is determined that a failure has occurred in the link [40-60] on the downstream side. However, if the difference in failure detection time for each link (the number of prefixes becomes zero) is within a predetermined time d seconds, 40-60 closest to the observation point is estimated as the failure location. If the failure detection times of the failure candidate links [40-60] and [60-70] are longer than the predetermined time d seconds, they are treated as different failures.

  FIG. 12 is a functional configuration diagram of the node device according to the present invention.

  12, the node device 1 includes a relay transfer unit 10, a failure candidate detection unit 11, a detour link determination unit 12, a failure detection unit 13, a route update message reception monitoring unit 14, and a route update message transmission. Part 15. These functional components are realized by executing a program that causes a computer mounted on the node device to function. It should be noted that these functions except for the relay transfer unit 10 can be installed in the failure location detection apparatus 2 that stores the transfer progress information of the route update message in advance.

  When the relay transfer unit 10 receives the UPDATE (Announce) message, the relay transfer unit 10 further includes the AS number of the node device in the path composed of successive AS numbers of the relay node device included in the UPDATE (Announce) message. , Relay the UPDATE message.

  The route update message transmission unit 15 periodically broadcasts an UPDATE message including a prefix and an AS number based on BGP.

  The route update message reception monitoring unit 14 outputs the BGP UPDATE message extracted from the relay transfer unit 10 to the failure candidate detection unit 11.

[Failure candidate detection unit 11]
The failure candidate detection unit 11 records the path through which the received route update message has passed, the failure candidate node device in which the number of prefixes for each node device is zero, and the failure candidate link in which the number of prefixes for each link is zero And detect.

  The failure candidate detection unit 11 includes a normal state path determination unit 111, a monitoring target determination unit 112, a prefix number counting unit 113, and a failure candidate determination unit 114.

  The normal state path determination unit 111 determines one normal state path (optimum route) in the normal state for each prefix for which each node device is a source of information, using the path through which the route update message has passed. The normal state path determination unit 111 uses the path included in the UPDATE (Announce) message to determine one normal state path in the normal state for each prefix of each node device. Specifically, for each node device prefix, the accumulated usage time for each path included in the received UPDATE (Announce) message is collected, and the path with the longest accumulated usage time within the predetermined time range is the normal state path. Determine as. The determined normal state path is output to the monitoring target determining unit 112.

  The monitoring target determining unit 112 determines, for each prefix, a node device that advertises the prefix as a “monitoring target node device” and a link connecting to the monitoring target node device as a “monitoring target link”.

  The prefix number counting unit 113 records the path through which the received route update message has passed, and measures the number of prefixes of the monitoring target node device and the number of prefixes including the monitoring target link in the path in unit time.

  The failure candidate determination unit 114 detects a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero.

[Detour link determination unit 12]
The detour link determination unit 12 determines the presence / absence of a detour link other than the failure candidate link for the failure candidate node device that matches the upstream node device of the failure candidate link.

[Fault detection unit 13]
If there is a detour link, the failure detection unit 13 determines that a failure has occurred in the failure candidate link if the failure candidate node device has reached the route update message of the prefix that is the source of information. If the route update message for the prefix has not arrived, it is determined that a failure has occurred in the failure candidate node device.

  As described above in detail, according to the failure detection method, the node device, and the program of the present invention, the route update message based on the route control protocol is observed in the normal sequence, the link failure between the node devices, or It is possible to detect whether or not the node device itself is faulty.

  According to the above-described various embodiments of the present invention, various changes, modifications, and omissions in the technical idea and scope of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 Node apparatus 10 Relay transfer part 11 Failure candidate detection part 111 Normal state path determination part 112 Monitoring object determination part 113 Prefix number counting part 114 Failure candidate determination part 12 Detour link determination part 13 Failure detection part 14 Path update message reception monitoring part 15 Route update message transmitter 2 Fault location detection device

Claims (11)

A network in which a plurality of node devices having unique identification numbers are connected to each other and transmit / receive a route update message of a routing protocol,
Each node device periodically broadcasts a route update message including one or more prefixes and a unique identification number as a publicity source,
Each node device relays and forwards the route update message, including the unique identification number of the node device, in the path consisting of consecutive relay node device unique identification numbers included in the received route update message,
In the failure detection method in which the observation node device detects whether the failure of the link between the node devices or the failure of the node device itself,
The observation node device is
The path through which the received route update message has passed is recorded, and a failure candidate node device in which the number of prefixes for each node device has become zero and a failure candidate link in which the number of prefixes for each link has become zero are detected. And the steps
A second step of determining whether there is a detour link other than the failure candidate link for the failure candidate node device that matches the upstream node device of the failure candidate link;
When there is the detour link, if the route update message of the prefix for which the failure candidate node device is a publicity source has arrived, it is determined that a failure has occurred in the failure candidate link. A failure detection method comprising: a third step of determining that a failure has occurred in the failure candidate node device if the route update message of has not arrived. Regarding the first step in the observation node device,
An eleventh step of determining one normal state path in a normal state for each prefix for which each node device is a publicity source using the path through which the route update message has passed;
A twelfth step of determining, for each prefix, a node device that advertises the prefix as a “monitoring target node device” and a link connecting to the monitoring target node device as a “monitoring target link”;
A thirteenth step of recording the path through which the received route update message has passed and measuring the number of prefixes of the monitoring target node device and the number of prefixes including the monitoring target link in the path in unit time;
2. The fourteenth step of detecting a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero. The failure detection method described. Regarding the fourteenth step in the observation node device,
When the prefix in the normal state path is in the Announce (notification) state, when the route update message of type Withdraw (deletion) is received, the number of prefixes of the monitored node device and the monitored link in the prefix is decremented by 1 And
When the prefix in the normal state path is in the Announce state, if the monitored node device is not the public information source node device when the route update message of type Announce is received, the number of prefixes of the monitored node device is decremented by 1. ,
When the prefix in the normal state path is in the Announce state, when a route update message of type Announce is received, the monitoring target link is not included in the path of the prefix, or the monitoring target node device is a public information source node device If not, decrement the number of prefixes of the monitored node device by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received and the monitored node device is a public information source node device, the number of prefixes of the monitored node device is incremented by 1. ,
When the prefix in the normal state path is the Withdraw state, when a route update message of type Announce is received, a monitoring target link is included in the path of the prefix, and the monitoring target node device is a public information source node 3. The failure detection method according to claim 2, wherein if the device is a device, the number of prefixes of the monitored link is incremented by one.   For the eleventh step in the observation node device, the accumulated usage time for each path included in the received route update message is collected for each prefix of each node device, and the accumulated usage time is the longest in a predetermined time range. The failure detection method according to claim 2 or 3, wherein a path is determined as the normal state path. The routing protocol is BGP (Border Gateway Protocol),
The unique identification number is an AS (Autonomous System) number,
The route update message is BGP UPDATE (Announce / Withdraw),
The prefix is a source address consisting of a set of an IP address and the number of bits of a subnet mask, or a range thereof,
The node path failure detection method according to claim 1, wherein the path of the route update message is included in an AS_PATH attribute. A node device having a unique identification number connected to a network that transmits and receives a route update message of a routing protocol;
A route update message transmission means for periodically broadcasting a route update message including one or more prefixes and a unique identification number as a public information source;
A relay transfer unit that relays and forwards the route update message including the unique identification number of the node device in a path including the unique identification number of the relay node device included in the received route update message. In the node device,
A failure candidate that records the path through which the received route update message has passed and detects a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero Detection means;
Detour link determination means for determining whether there is a detour link other than the failure candidate link for the failure candidate node apparatus that matches the upstream node apparatus of the failure candidate link;
When there is the detour link, if the route update message of the prefix for which the failure candidate node device is a publicity source has arrived, it is determined that a failure has occurred in the failure candidate link. And a failure detection unit that determines that a failure has occurred in the failure candidate node device if the route update message of the node is not reached. The failure candidate detection means includes
Normal state path determination means for determining one normal state path in a normal state for each prefix for which each node device is a source of information using the path through which the route update message has passed;
For each prefix, a monitoring target determination unit that determines a node device that advertises the prefix as a “monitoring target node device”, and determines a link connecting to the monitoring target node device as a “monitoring target link”;
Prefix count measuring means for recording the path through which the received route update message has passed and measuring the number of prefixes of the monitored node device and the number of prefixes including the monitored link in the path in unit time;
7. The failure candidate determining unit that determines a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero. The described node equipment. The failure candidate determination means includes
When the prefix in the normal state path is in the Announce (notification) state, when the route update message of type Withdraw (deletion) is received, the number of prefixes of the monitored node device and the monitored link in the prefix is decremented by 1 And
When the prefix in the normal state path is in the Announce state, if the monitored node device is not the public information source node device when the route update message of type Announce is received, the number of prefixes of the monitored node device is decremented by 1. ,
When the prefix in the normal state path is in the Announce state, when a route update message of type Announce is received, the monitoring target link is not included in the path of the prefix, or the monitoring target node device is a public information source node device If not, decrement the number of prefixes of the monitored node device by 1,
When the prefix in the normal state path is the Withdraw state, when the route update message of type Announce is received and the monitored node device is a public information source node device, the number of prefixes of the monitored node device is incremented by 1. ,
When the prefix in the normal state path is the Withdraw state, when a route update message of type Announce is received, a monitoring target link is included in the path of the prefix, and the monitoring target node device is a public information source node 8. The node device according to claim 7, wherein if it is a device, the number of prefixes of the monitoring target link is incremented by one.   The normal state path determination unit collects the accumulated usage time for each path included in the received route update message for each node device prefix, and selects the path with the longest accumulated usage time in the predetermined time range. 9. The node device according to claim 7, wherein the node device is determined as a normal state path. The routing protocol is BGP (Border Gateway Protocol),
The unique identification number is an AS (Autonomous System) number,
The route update message is BGP UPDATE (Announce / Withdraw),
The prefix is a source address consisting of a set of an IP address and the number of bits of a subnet mask, or a range thereof,
The node device according to claim 6, wherein the path of the route update message is included in an AS_PATH attribute. A route update message containing one or more prefixes and a unique identification number is periodically transmitted to a computer mounted on a node device having a unique identification number connected to a network that transmits and receives a route update message of a routing protocol. A route update message transmitting means for transmitting by broadcast to,
Including the unique identification number of the node device in the path consisting of consecutive relay node device unique identification numbers included in the received route update message, it functions as a relay transfer means for relaying and forwarding the route update message. In the program for the node device,
A failure candidate that records the path through which the received route update message has passed and detects a failure candidate node device in which the number of prefixes for each node device is zero and a failure candidate link in which the number of prefixes for each link is zero Detection means;
Detour link determination means for determining whether there is a detour link other than the failure candidate link for the failure candidate node apparatus that matches the upstream node apparatus of the failure candidate link;
When there is the detour link, if the route update message of the prefix for which the failure candidate node device is a publicity source has arrived, it is determined that a failure has occurred in the failure candidate link. A program for a node device, which causes a computer to function as a failure detection means for determining that a failure has occurred in the failure candidate node device if the route update message has not arrived.

Images