JP6154279B2 - Network monitoring device, network monitoring system, network monitoring method, and network monitoring program - Google Patents

Description

  The present invention relates to a network monitoring device, a network monitoring system, a network monitoring method, and a network monitoring program.

  Patent Document 1 proposes a network quality monitoring device and a network quality monitoring method for SIP (Session Initiation Protocol) networks (see Patent Document 1). Specifically, after capturing and collecting SIP signaling messages in capture devices installed at multiple locations in the SIP network, the response time from request transmission to response reception or the number of request retransmissions is obtained for each capture section. A technique for determining that an abnormality has occurred in a corresponding section when an upper limit value that is determined to be abnormal is exceeded as a result of obtaining and statistically processing these values is proposed.

JP 2008-193482 A

3GPP TS 29.274 V11.7.0, June 2013

  For example, the network quality monitoring apparatus and the network quality monitoring method proposed in Patent Document 1 are not limited to the SIP network, but can be applied to an LTE network by defining an LTE (Long Term Evolution) signaling message. It is thought that.

However, in the prior art as described above, since the request message flowing through the monitoring section is used for failure determination in the corresponding section, it is necessary to install a capture device for each section to be monitored, which is enormous in constructing a monitoring environment. There was a problem that costs were incurred.
In particular, the communication carrier that constructs and operates a large-scale LTE network has the above-described problems when applying the conventional technology as described above.
Also, real-time monitoring is desired for monitoring network quality.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a network monitoring device, a network monitoring system, a network monitoring method, and a network monitoring program that can efficiently monitor a network. .

  (1) In order to solve the above-described problem, a network monitoring apparatus according to an aspect of the present invention is based on information on a request message and a response message that transmit a section between two communication apparatuses constituting a network. A failure determination unit that determines a failure for each state of a predetermined size of one or a plurality of messages is provided.

  (2) One aspect of the present invention is the network monitoring device according to (1) described above, wherein the network monitoring device extracts a sequence number included in the request message and a sequence number included in the response message. A state of a predetermined size combination of each message in the pair of the request message and the response message associated with each other based on the sequence number extracted by the sequence extraction unit A configuration in which a failure is determined every time may be used.

  (3) According to one aspect of the present invention, in the network monitoring device according to any one of (1) and (2) described above, as the predetermined size of the message, A configuration using a size of a part of the message may be used.

  (4) One aspect of the present invention is the network monitoring device according to any one of (1) to (3) described above, in which the network monitoring device includes the request message and the request message associated with each other A response time measuring unit that measures a response time related to the response message, wherein the failure determination unit determines a failure for each state of the predetermined size of the message based on the response time measured by the response time measurement unit. A configuration may be used.

(5) In order to solve the above-described problem, a network monitoring system according to an aspect of the present invention transmits a section between a first communication device and a second communication device configuring a network. A receiving unit that receives a message and a second message, and a sequence that extracts a sequence number included in the first message received by the receiving unit and a sequence number included in the second message received by the receiving unit An associating unit that associates the first message with the second message based on the sequence number included in the first message and the sequence number included in the second message;
The first message associated by the associating unit based on a database storing information relating to the first message and the second message, and information relating to the first message and the second message And a failure determination unit that determines a failure for each state of the size of one or more messages in the set of the second message and the second message.

  (6) In order to solve the above-described problem, a network monitoring method according to an aspect of the present invention includes a request message and a response message in which a reception unit transmits a section between two communication devices configuring a network. The failure determination unit performs failure determination for each state of a predetermined size of one or a plurality of messages based on the information about the request message and the response message received by the reception unit.

  (7) In order to solve the above-described problem, a network monitoring program according to an aspect of the present invention includes a request message and a response message in which a failure determination unit transmits a section between two communication devices constituting a network. This is a program for causing a computer to execute a step of determining a failure for each state of a predetermined size of one or a plurality of messages on the basis of the information regarding.

  According to the present invention, a network can be efficiently monitored.

1 is a diagram illustrating a schematic configuration of a communication system according to an embodiment of the present invention. It is a block diagram which shows the structure of the capture apparatus which concerns on one Embodiment of this invention. It is a figure which shows the structure of the message which concerns on one Embodiment of this invention. It is a figure which shows an example of the response time which concerns on one Embodiment of this invention. It is a figure which shows the example of several types of message which concerns on one Embodiment of this invention. It is a flowchart figure which shows an example of the procedure of the process performed when a message is received in the capture device which concerns on one Embodiment of this invention. It is a flowchart figure which shows an example of the procedure of the process regarding the determination of the failure performed in the capture device which concerns on one Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Outline of Communication System According to this Embodiment>
FIG. 1 is a diagram showing a schematic configuration of a communication system according to an embodiment of the present invention.
The communication system according to the present embodiment has a configuration in which a network monitoring device (capture device 21 in the present embodiment) is provided in an LTE network communication system.
The communication system according to the present embodiment includes a plurality (N in this embodiment) of base station devices (eNodeB) 1-1 to 1-N, an MME (Mobility Management Entity) device 2, and an HSS (Home Subscriber System). ) Device 3, SGW (Serving Gateway) device 4, multiple (in this embodiment, M) PGW (Packet data network Gateway) devices 5-1 to 5-M, and DNS (Domain Name System) server device 6, an authentication server device 7, other communication devices 8 to 10 (three are exemplified in the present embodiment), and a capture device 21.
Various apparatuses may be used as the communication apparatuses 8 to 10.

Here, the LTE network includes a radio network called eUTRAN (Evolved Universal Terrestrial Radio Network) and a core network called EPC (Evolved Packet Core).
eUTRAN is composed of only base station apparatuses 1-1 to 1-N.
The EPC includes a plurality of device groups such as the MME device 2, the HSS device 3, the SGW device 4, and the PGW devices 5-1 to 5-M.

  In the communication system according to the present embodiment, each base station apparatus 1-1 to 1-N and the MME apparatus 2 are connected. The MME device 2 and the HSS device 3 are connected. The MME device 2 and the SGW device 4 are connected, and a capture device 21 is provided between them. The SGW apparatus 4 is connected to each of the PGW apparatuses 5-1 to 5-M, the DNS server apparatus 6, and the authentication server apparatus 7. The PGW apparatus 5-1 and the communication apparatuses 8 to 10 are connected.

In the present embodiment, one device and another device are connected using a wired or wireless line, and one device and another device connected thereto are referred to as “section”. In the present embodiment, a capture device 21 is provided in a section between the MME device 2 and the SGW device 4.
In the communication system according to the present embodiment, one device (in this embodiment, as an example, the MME device 2) transmits a request message that is a message for making a predetermined request (request), and another device (this embodiment). In the form, as an example, the SGW device 4) is a message that responds to the request message by performing processing according to the request message request (including processing in the own device and processing for issuing a request to another device). Send a response message.
The configuration of the communication system illustrated in FIG. 1 is an example, and various configurations may be used as the arrangement and number of devices in the communication system.

<Outline of Capture Device According to this Embodiment>
FIG. 2 is a block diagram showing the configuration of the capture device 21 according to an embodiment of the present invention.
The capture device 21 according to the present embodiment includes a receiving unit 101 and a message processing unit 102.
The receiving unit 101 includes a request message receiving unit 111 and a response message receiving unit 112.
The message processing unit 102 includes a sequence extraction unit 121, a message database 122, a response time measurement unit 123, and a failure determination unit 124.
For example, the receiving unit 101 is called an exporter, and the message processing unit 102 is called a collector.

<Outline of message according to this embodiment>
In this embodiment, the message is a message according to the standard of 3GPP TS 29.274 V11.7.0, and further a message according to GTPv2 (GPRS Tunneling Protocol version 2) related to GPRS (General Packet Radio Service) (for example, , Signaling message) is used as an example (see Non-Patent Document 1).
For example, packet communication is used as message communication.

FIG. 3 is a diagram showing a configuration of the message 201 according to an embodiment of the present invention.
In the present embodiment, the configuration of the message 201 is used as the configuration of the request message and the configuration of the response message.
In the frame of the message 201 according to the present embodiment, an L2 (Layer 2) header 211, an IP (Internet Protocol) header 212, a UDP (User Datagram Protocol) header 213, and a GTPv2 header 214 are arranged from the top of the frame, and subsequently. Thus, a combination of a type T (Type), a length (Length) L, and a value (Value) V is arranged for one or a plurality of n sets.

  In the example of FIG. 3, in the combination of the type T, the length L, and the value V in the message 201, first, T (1) that is the first type 215-1 and the first length 216-1. A certain L (1) and V (1) as the first value 217-1 are arranged, followed by the second and subsequent ones, and finally the nth type 215-n. T (n), L (n) that is the nth length 216-n, and V (n) that is the nth value 217-n are arranged. When n = 1, only the first one is arranged.

The message 201 includes a unique sequence number (for example, it may be substantially unique). The sequence number is included in the GTPv2 header 214, for example.
The sequence number of the request message matches the sequence number of the response message for the request message. That is, the response message includes the same sequence number as the sequence number included in the request message to be responded to. For one request message, for example, when a response is required, there is one response message. When a response is not required (only notification is required), the response message is Absent.
The L2 header 211 includes information on the size of the entire frame.
The IP header 212 includes information on subsequent sizes following the IP header 212. The size from the L2 header 211 to the IP header 212 is, for example, constant.

Information of the combination of type T, length L, and value V is information of IE (Information Element).
The type T specifies one of a plurality of types, for example, there are 150 types or more. As a specific example, as the IE type, it is defined that the first IE type is related to the International Mobile Subscriber Identity (IMSI) number, and the 71st IE type is related to the Access Point Name number. It is defined that the type of the 75th IE relates to the Mobile Equipment Identity number, and the types of IEs of other numbers are also defined (see Non-Patent Document 1). ).
The length L specifies the length of the value V and has, for example, a fixed length or a variable length.
The value V is an information string (for example, a character string).

One message 201 may include a plurality of pieces of information of combinations of type T, length L, and value V. That is, a plurality of IEs may be included in one message 201.
A message type is determined and specified for each IE or a combination of a plurality of IEs included in one message 201. For each message type, the size of the request message and the size of the response message can be different. Further, since the device that processes the request message request, the processing content (for example, processing load), and the like may be different for each message type, the response time of the response message to the request message may be different.

In LTE, messages having different purposes may be defined by a message with the same name (in this embodiment, a request message or a response message), but in this embodiment, a combination of IEs (IE is 1). In each case, it is regarded as only one combination), and the message type is different and can be identified.
In LTE, a device that has received a request message issues a request to another device according to the content of the request, receives a response to the request, and transmits a response message. May communicate. This is a unique network configuration of LTE.

<Message transmission / reception and response time>
In the present embodiment, a capture device 21 is provided in a section between the MME device 2 and the SGW device 4, and the capture device 21 acquires a request message and a response message transmitted and received between the MME device 2 and the SGW device 4. (Capture).

FIG. 4 is a diagram illustrating an example of a response time according to an embodiment of the present invention.
In the example of FIG. 4, the MME device 2 transmits a request message to the SGW device 4 (process ST1). The SGW device 4 receives the request message, performs processing according to the request (including processing in the device itself and processing for issuing a request to another device), and transmits a response message to the MME device 2. (Process ST2). The MME device 2 receives the response message.
In this case, for example, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is the response time T1.
Note that the response time start timing is not the timing at which the MME device 2 has transmitted the request message, but the timing at which the SGW device 4 has received the request message, or the timing between these transmissions and receptions, for example. May be. Similarly, as the end timing of the response time, for example, not the timing at which the MME device 2 receives the response message, but the timing at which the SGW device 4 transmits the response message, or the timing between these transmissions and receptions. May be used.

  As an example, when the terminal device is turned on by an operation performed by a user of a terminal device such as an LTE mobile phone (including a smartphone), the terminal device is initially connected to the LTE network. Will be connected to. In this case, the MME device 2 transmits a request message of a session establishment request (Create Session Request) to the SGW device 4, and the SGW device 4 that has received the request message performs necessary processing in response to the request. After that, a response message of a session establishment response (Create Session Response) is returned (transmitted) to the MME device 2.

In the LTE network, when the response time is calculated from the request message of the session establishment request transmitted by the MME device 2 and the response message of the session establishment response to which the SGW device 4 responds, the same SGW device as the same MME device 2 Even in the section between 4 (same section), the response time can be greatly different, for example, from several ms to several hundred ms.
This is because, for example, when the SGW device 4 performs processing only by its own device before the SGW device 4 returns a response message of the session establishment response to the request message of the session establishment request transmitted by the MME device 2, Alternatively, when a request message and a response message (which may be the same as or different from the original message) are transmitted and received in a section between the SGW apparatus 4 and another apparatus X, Alternatively, a request message and a response message (may be the same as or different from the original message) in a section between the SGW apparatus 4 and another apparatus Y (an apparatus different from the apparatus X). This is because transmission and reception may be performed. When transmission / reception of a request message and a response message is performed in a section between the SGW apparatus 4 and the other apparatuses X and Y, the SGW apparatus 4 transmits the response message to the MME apparatus 2 before returning the response message. It is necessary to wait for the time required for transmission and reception with X and Y.
The response time in the actual network can vary greatly depending on, for example, the number of other devices involved until the SGW device 4 responds and the processing content.

Here, the SGW apparatus 4 may perform the process according to the request of the received request message in its own apparatus. In this case, the MME device 2 transmits a request message to the SGW device 4, and the SGW device 4 receives the request message, performs a process according to the request by itself, and sends a response message to the MME device 2. Send to.
In addition, other devices (in the example of FIG. 1, PGW devices 5-1 to 5-M, DNS server device 6, authentication server device 7) directly connected to SGW device 4 that has received the request message from MME device 2. In addition to the configuration that performs processing according to the request in (), as another configuration example, a configuration that performs processing according to the request in a device connected to the SGW device 4 that has received the request message via another device is used. For example, a configuration in which processing according to a request is performed in a plurality of apparatuses may be used.

<About message size>
Regarding processing in response to a request message request, the device that performs the processing (routed device) and the content of the processing differ depending on the content of the request message.
In this embodiment, the type of message varies depending on the number and type of IEs carried in GTPv2.

  Therefore, in the present embodiment, the size of the request message and the size of the response message are analyzed, and a group of messages having the same combination (size combination state) of these sizes is clustered (classified). For each (combination of request message size and response message size), the response time is aggregated for statistical processing, or an individual threshold is set for the response time.

In this embodiment, the type of message (in this embodiment, a combination of IE types) is (presumably) specified by the size of the request message and the size of the response message.
For example, a request message carries various types of information depending on its purpose. If the type of information (message type) carried by the request message is different, in most cases, it is reflected in the size of the request message. Therefore, by focusing on the size of the request message, it is possible to easily sort the message type (for example, the purpose of the message). Also, the size of the response message may differ depending on the type of message, as with the size of the request message.

  Even when two request messages of different types have the same size, the size of the response message is likely to be different. Therefore, by classifying the size of the request message and the size of the response message as a pair, it is possible to improve the accuracy of message sorting.

As the size of the request message and the size of the response message, for example, in the configuration of the message 201 shown in FIG. 3, the size of the entire frame (L2 frame in the present embodiment) may be used, or The subsequent size following the IP header 212 (for example, the size of the payload length of the IP header 212) may be used.
The size of the message is represented by, for example, the number of bytes.
In general, the number of message types (in this embodiment, combinations of IE types) is finite, and the number of combinations of request message size and response message size is finite.

FIG. 5 is a diagram illustrating an example of a plurality of types of messages according to an embodiment of the present invention.
The example of FIG. 5 shows an example of three types of messages (request message and response message pairs) carrying combinations of different IE types.
The first (first type) message carries, for example, the type of the first IE and the type of the 77th IE, and the response time is 1 ms. The first (first type) message has a request message size of 285 bytes and a response message size of 64 bytes.
The second (second type) message carries, for example, the type of the first IE and the type of the 78th IE, and the response time is 10 ms. The second (second type) message has a request message size of 394 bytes and a response message size of 230 bytes.
The third (third type) message carries, for example, the type of the first IE and the type of the 80th IE, and the response time is 100 ms. The third (third type) message has a request message size of 285 bytes and a response message size of 238 bytes.

Here, as in the example of FIG. 5, the combination of the size of the request message and the size of the response message usually differs for each message type.
Only the size of the request message may be different for each type of message. Also, only the size of the response message may be different for each type of message. For this reason, it is possible to estimate the type of message based solely on the size of the request message or only based on the size of the response message, but based on a combination of the size of the request message and the size of the response message It is more accurate to estimate the message type.
As a specific example, in the example of FIG. 5, the first (first type) message and the third (third type) message have different response times and are different types of messages. The first (first type) message and the third (third type) message have the same request message size, but carry different information because the response message size is different. (Which is another type of message).

As an example, for each message type (in this embodiment, a combination of message sizes), the response time can be aggregated and statistical processing can be performed.
As another example, a threshold corresponding to the response time can be set for each message type (in this embodiment, a combination of message sizes). For example, for the first (first type) message size combination, a threshold of 10 ms is set for a response time of 1 ms, and for the second (second type) message size combination, a threshold of 60 ms for a response time of 10 ms. And a threshold of 150 ms is set for a response time of 100 ms for the third (third type) message size combination.

As an example, for each same message type, statistical processing can be performed on the response time to determine the presence or absence of a failure. As a specific example, a moving average of response times is obtained for each type of message, and an outlier (a value that deviates from a predetermined moving average from a past moving average value) is searched, and an outlier falls within a predetermined time range. Can be determined that there is a failure when there is a predetermined number of times (one or more predetermined times). Also, variance can be used instead of moving average. Moreover, as an outlier, for example, an instantaneous value at the time of measurement can be used, or an average value of a plurality of instantaneous values close in time can be used.
As another example, a threshold is set for the response time for each message type, and it is determined that there is a failure when the time required for message response processing (in this embodiment, the response time) exceeds the threshold. be able to. As a threshold for the response time, for example, a fixed value is set in advance for each message type, or an average value of response times in a predetermined time range is obtained for each message type, and the average value is obtained. A value obtained by adding a predetermined value (for example, a positive value) to can be used as the threshold value.

<Outline of processing performed in capture device according to this embodiment>
An overview of processing performed in the capture device 21 according to the present embodiment is shown.
The request message receiving unit 111 receives a request message. In the present embodiment, the request message receiving unit 111 receives a request message transmitted from the MME device 2 to the SGW device 4. Further, the request message receiving unit 111 detects (for example, extracts) information specifying the size of the received request message.
The response message receiving unit 112 receives a response message. In the present embodiment, the response message receiving unit 112 receives a response message transmitted from the SGW device 4 to the MME device 2. Further, the response message receiving unit 112 detects (for example, extracts) information that specifies the size of the received response message.

Here, as an example, the receiving unit 101 includes a switch (or may be referred to as a tap) connected between the MME device 2 and the SGW device 4, and a capture unit connected to the switch. Composed.
The switch relays a message (a request message or a response message in the present embodiment) transmitted between the MME device 2 and the SGW device 4. At this time, the signal of the i-th port (where i is an arbitrary integer) is mirrored to the j-th port (j is an arbitrary integer, for example, i−1 or i + 1) (the same signal is generated) and mirrored. The signal is acquired by the capture unit. This mirroring is only one way of acquiring.
A functional unit that acquires a request message by such mirroring corresponds to the request message receiving unit 111, and a functional unit that acquires a response message by such mirroring corresponds to the response message receiving unit 112.
Whether the message is a request message or a response message can be determined by the request message receiving unit 111 or the response message receiving unit 112 based on information included in the message header, for example. .

The sequence extraction unit 121 analyzes the request message received by the request message reception unit 111 and extracts information on the sequence number included in the request message. Thereby, the sequence number of the request message is specified. Then, the sequence extraction unit 121 stores (stores) information regarding the request message in the message database 122.
Similarly, the sequence extraction unit 121 analyzes the response message received by the response message reception unit 112 and extracts information on the sequence number included in the response message. Thereby, the sequence number of the response message is specified. Then, the sequence extraction unit 121 stores (stores) information regarding the response message in the message database 122.

  Here, in the present embodiment, the sequence extraction unit 121 associates (maps) the response message received by the response message reception unit 112 with the request message received by the request message reception unit 111. Specifically, the sequence extraction unit 121 analyzes and identifies the sequence number included in the response message for the response message received by the response message reception unit 112, and the same sequence included in the stored content of the message database 122 Information related to the response message is stored (stored) in the message database 122 in association with the request message having the number.

  As an example, the sequence extraction unit 121 does not store the information about the response message in the message database 122 when the information about the request message corresponding to the response message is not stored in the message database 122. As another example, when the information about the request message corresponding to the response message is not stored in the message database 122, the sequence extraction unit 121 stores the information about the response message in the message database 122 regardless of the request message. Remember.

  Further, in the present embodiment, the sequence extraction unit 121 specifies the message reception time for the request message received by the request message reception unit 111 and the response message received by the response message reception unit 112.

  In this embodiment, the combination of IE types included in the request message and the response message may not be specified, and the processing load is reduced if not specified. However, as another configuration example, sequence extraction is possible. A configuration may be used in which the combination of the IE type of the message is specified by the unit 121 or the like. In this case, the combination of IE types related to the response message and the type of message may be specified by analyzing the response message, or the same information as the corresponding request message may be read and used.

  The message database 122 stores information regarding request messages and response messages. In the present embodiment, the message database 122 includes, as information related to the request message and the response message, information specifying a sequence number, information specifying a reception time, and a message type (for example, “request message”) for each message. Alternatively, the information specifying the request / response type “response message” may be stored in association with the information specifying the message size. Here, in the present embodiment, as information for specifying the size related to the message, information for specifying the size of the request message detected by the request message receiving unit 111 or the size of the response message detected by the response message receiving unit 112 Information for identifying the is used.

The response time measuring unit 123 measures the response time of the response message with respect to the request message. In the present embodiment, the response time measurement unit 123 obtains a value obtained by subtracting the reception time of the request message from the reception time of the response message (the difference between these reception times) for the request message and the response message associated with each other. Is detected (measured) as a response time.
In this embodiment, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is used as an example of the response time. , Approximately the time from the timing of receiving the request message transmitted by the MME device 2 (request message reception time) to the timing of receiving the response message to the MME device 2 (response message reception time) It is regarded as response time. Note that other methods for acquiring the response time may be used.

  The failure determination unit 124 determines a failure related to the network based on the response time measured by the response time measurement unit 123. In the present embodiment, as an example, the failure determination unit 124 aggregates the response time measured by the response time measurement unit 123 for each message type (in this embodiment, a combination of message sizes) and performs statistical processing. Thus, the failure is determined based on the moving average or the like. As another example, the failure determination unit 124 may use a response time (e.g., a response time measured by the response time measurement unit 123 based on a threshold value determined for each message type (in this embodiment, a combination of message sizes)). A failure is determined for one measurement value). Also, other methods for determining a failure may be used.

Here, in the capture device 21 according to the present embodiment, the request message is first received for the set of the request message and the response message, information about the request message is stored in the message database 122, and then the response message is stored. Although the operation of receiving and associating with the request message corresponding to the response message has been described, as another configuration example, the order of reception may be reversed. That is, for a set of request message and response message, the response message is received first, information about the response message is stored in the message database 122, and then the request message is received and the response corresponding to the request message. A configuration for associating with a message may be used.
In addition, various types of information related to the message (for example, in the configuration of acquiring the IE type information, the IE type information is included) may be acquired based on the information included in the request message, or , May be acquired based on information included in the response message, or may be acquired based on information included in both the request message and the response message.

  In the capture device 21 according to the present embodiment, a pair of request message and response message (in this embodiment, the sequence numbers match) are associated with each other, and information related to these messages is stored in the message database 122. However, as another configuration example, when the information about the request message and the information about the response message are separately stored in the message database 122 and the message is read from the message database 122 (for example, read by the response time measurement unit 123) A configuration that identifies a pair of a request message and a response message based on the sequence number may be used.

<Example of processing flow>
FIG. 6 is a flowchart illustrating an example of a procedure of processing performed when a message (a request message or a response message in the present embodiment) is received by the capture device 21 according to an embodiment of the present invention.
When the request message receiving unit 111 receives the request message and extracts information about the size of the request message (step S1), the sequence extraction unit 121 analyzes the received request message and extracts information about the sequence number, etc. (Step S2). Then, the sequence extraction unit 121 stores necessary information in the message database 122 (step S3). Thereby, this process is complete | finished.
Similarly, when the response message receiving unit 112 receives the response message and extracts size information regarding the response message (step S1), the sequence extraction unit 121 analyzes the received response message and extracts sequence number information. Is performed (step S2). Then, the sequence extraction unit 121 stores necessary information in the message database 122 (step S3). Thereby, this process is complete | finished.

FIG. 7 is a flowchart illustrating an example of a procedure of processing relating to failure determination performed in the capture device 21 according to an embodiment of the present invention.
Requests that the response time measurement unit 123 corresponds to each other based on the stored contents of the message database 122 (request messages or response messages) to be measured (having the same sequence number in this embodiment) A process for reading out the mapping of the information about the message and the response message is performed (step S11).
In this process (step S11), when the response time measurement unit 123 determines that there is no corresponding request message and response message pair (does not exist in the message database 122) (step S12), for example, this process is performed. finish.

  On the other hand, in the above processing (step S11), when the response time measurement unit 123 determines that there is a corresponding request message and response message pair (exists in the message database 122) (step S12), each message In this embodiment, the response time is measured for a set of request message and response message (step S13). Then, the failure determination unit 124 determines a failure based on the measurement result (step S14). Thereby, this process is complete | finished.

Here, in the present embodiment, the message database 122 has already been configured to store mapping information (association information) between the request message and the response message. In 122, a configuration that does not store mapping information (association information) between the request message and the response message may be used.
In such another configuration example, the response time measurement unit 123 performs a mapping process on the message (request message or response message) to be measured based on the sequence number (step S11). The response time measurement unit 123 stores information on a pair of messages (messages having the same sequence number in the present embodiment) corresponding to a message to be measured (request message or response message) in the message database 122. It is determined by checking whether it is present (presence / absence) (step S12). As a result of this confirmation (step S12), when the response time measurement unit 123 determines that the information regarding the message of the pair is not stored in the message database 122, for example, the process ends. On the other hand, as a result of the confirmation (step S12), if the response time measurement unit 123 determines that the information regarding the paired message is stored in the message database 122, the process proceeds to step S13.

As described above, the capture device 21 in the communication system according to the present embodiment captures a request message and a response message in the LTE network, associates the request message with the response message based on the sequence number, Messages (for example, request messages and response messages) are clustered for each combination of message size and message size of a response message (in this embodiment, it is regarded as a message type).
In the capture device 21 in the communication system according to the present embodiment, the response time is measured and statistically processed for a group of request messages and response messages clustered for each combination of message sizes (message types). Determine the failure. Here, the statistical processing can be performed at various timings such as a regular timing.
Further, in the capture device 21 in the communication system according to the present embodiment, a device related to a message (for example, a device that performs processing according to a request message request) is associated with each message size combination (message type). If the response time threshold is exceeded, the location of the failure is narrowed down.

As described above, according to the capture device 21 in the communication system according to the present embodiment, for example, in the LTE network, a message (message flowing in the predetermined interval) captured by the capture device 21 installed in a predetermined interval is used. Thus, it is possible to detect a failure that occurs in another section. For this reason, it is possible to determine a failure in a wide range with a relatively small number of capture devices 21. Also, the failure determination can be performed with high accuracy by the capture device 21 compared to the case where the failure determination is performed only for the section where the capture device 21 is installed, for example. Thereby, for example, the quality of the network in the mobile network can be monitored.
Thus, according to the capture device 21 in the communication system according to the present embodiment, the network can be efficiently monitored.

Further, according to the capture device 21 in the communication system according to the present embodiment, by classifying messages based on the size of the request message and the size of the response message, for example, in a mobile network such as an LTE network, a large number of messages ( Request messages and response messages) can be monitored in real time with respect to response time, etc. by sorting messages by message type (combination of message sizes) without deep analysis of payload data (for example, variable length). Can be done.
As a specific example, the capture device 21 does not analyze the IE information included in the message, but detects the message size information (and the sequence number information in the present embodiment). Implementation of advanced programming for deep analysis of payload data with variable length and analysis processing for each message are reduced, and high-speed message classification becomes possible. Normally, analysis is performed from the beginning to the end of the frame. In this embodiment, if message size information (and sequence number information in this embodiment) is detected, messages are classified. Is possible.
Thus, according to the capture device 21 in the communication system according to the present embodiment, for example, even in a real network with a large number of messages, a failure can be determined in real time, and the network can be monitored efficiently.

Here, in this embodiment, the configuration in which the message is classified (estimated message type) based on both the request message size and the response message size (combination) has been shown. A configuration may be used in which messages are classified (estimated message type) based on one (only) of the message size and the response message size.
As an example, the capture device 21 classifies messages (for example, request messages and response messages) for each request message size.
As another example, the capture device 21 classifies messages (for example, request messages and response messages) for each response message size.

  Here, in the capture device 21 according to the present embodiment, as a message (in this embodiment, a message transmitted / received in a section between the MME device 2 and the SGW device 4), a request message for a session establishment request and a session establishment response. Although the case where the response message is used is shown, various other messages may be used. As a specific example, a request message of a session release request (Delete Session Request) and a response message of a session release response (Delete Session Response) are used, or a request message and a bearer change response (Modify Bearer) of a bearer change request (Modify Bearer Request) (Response) response message can be used.

  In the capture device 21 according to the present embodiment, a configuration is shown in which a message that is provided between the MME device 2 and the SGW device 4 and that is transmitted and received in the section is captured. However, the transmission and reception is performed in various other sections. A configuration may be used that captures messages that are received. For example, the capture device 21 may be provided in various other sections, and may be configured to capture messages transmitted / received in the sections, and the base station apparatus (in this embodiment, the base station apparatus 1- 1-1-N) and the capture device 21 may be provided in a section between the MME device 2. The capture device 21 can capture a message transmitted / received in the section according to the section in which the capture device 21 is provided, and can determine a failure related to another section based on the captured message.

  In the present embodiment, the configuration of the capture device 21 including the reception unit 101 and the message processing unit 102 is shown. As another configuration example, the capture device 21 including the reception unit 101 but not including the message processing unit 102 is illustrated. In this case, the function of the message processing unit 102 is provided in a device other than the capture device 21 (corresponding to an example of a network monitoring device in this configuration example). This device (a device other than the capture device 21) may be provided in a section in which the capture device 21 is provided, or may be provided in any other place (for example, another section). Information related to a message transmitted after being received by the receiving unit 101 of the device 21 (may include information on the message itself) is received from the capture device 21 and processed.

  Further, in the present embodiment, a configuration in which the functions of the processing units 111 to 112 and 121 to 124 illustrated in FIG. 2 are provided in an integrated device (capture device 21 in the present embodiment) has been described. As an alternative, a configuration in which these functions are distributed to two or more devices may be used.

Further, in the present embodiment, the configuration in which the failure is determined based on the response time from the request message to the response message is shown for each message type, but the configuration in which the failure is determined based on other information is used. May be. As a specific example, when retransmitting a request message, it is possible to use a configuration in which a failure is determined based on the number of retransmissions. For example, the failure is replaced with the number of retransmissions instead of the response time in this embodiment. It is possible to make a determination.
In the present embodiment, an LTE network is shown, but the present invention may be applied to other various networks.

<An example of the effect of this embodiment with respect to a comparative example with this embodiment>
In addition, the example of the effect of this embodiment with respect to a comparative example with this embodiment is shown.
As a comparative example to this embodiment, after measuring the response time (or the number of retransmissions of the request message) from the transmission of the request message to the reception of the response message for each section to be monitored, In order to determine whether or not a failure has occurred, the response time (or the number of retransmissions) is uniformly determined using all the request messages and all the response messages that flow through the section between the MME device and the SGW device. Consider a measurement technique (a technique according to a comparative example).
In the technology according to the comparative example, in the capture device installed in the section between the MME device and the SGW device, a failure that affects all messages flowing in the corresponding section, that is, between the MME device and the SGW device. Only failures that occur in the section can be detected. As a specific example, in the technique according to the comparative example, three types of messages (for example, request messages and response messages) having different combinations of message sizes (for example, different combinations of IE types) are captured, When the reference value of the response time of the message is 1 ms, 10 ms, and 100 ms, a threshold value (response time, for example, 50 ms, etc., based on the average value of 37 (= 111/3) ms is obtained by these statistical processes. ) Is set, it is difficult to determine a failure suitable for each message type, and it is difficult to determine a failure in another section.
On the other hand, in the present embodiment, it is possible to execute failure determination suitable for each type of message, and it is possible to perform failure determination in other sections, thus monitoring the network with high accuracy. can do.

As another comparative example, when considering a configuration that specifies the type of message based on IE information (for example, a combination of IE type information) included in a message (for example, a request message or a response message), In this configuration, it is necessary to analyze deeply, for example, variable-length payload data in the message. However, when performing deep analysis of messages, the processing load increases, especially in environments with a large number of messages, deep analysis becomes a bottleneck, and real-time monitoring (for example, online monitoring) May be difficult. This is particularly the case with communication carriers that operate large-scale LTE networks.
On the other hand, in this embodiment, since the message type is specified (for example, estimated) based on the message size, the network can be monitored efficiently.

[Configuration example according to the above embodiment]
As one configuration example, a request message and a response message that transmit a section between two communication devices (in this embodiment, the MME device 2 and the SGW device 4) that configure a network (in this embodiment, an LTE network). Based on the information about the status of each of a predetermined size of one or more messages (for example, a predetermined size of one of the request message and the response message, or a combination of the predetermined sizes) A network monitoring device (capture device 21 shown in FIG. 2 in the present embodiment) including a failure determination unit (in this embodiment, the failure determination unit 124) that performs failure determination.

  As an example of the configuration, the network monitoring device includes a sequence extraction unit (a sequence extraction unit 121 in this embodiment) that extracts a sequence number included in the request message and a sequence number included in the response message, and the failure The determination unit determines a failure for each state of a predetermined size combination of each message in the pair of the request message and the response message associated with each other based on the sequence number extracted by the sequence extraction unit. Do.

  As an example of the configuration, as the predetermined size of the message, the entire size of the message (as an example, the total number of bytes of the frame of the message 201 shown in FIG. 3), or the size of a part of the message (example) 3), the number of bytes after the IP header 212 in the frame of the message 201 shown in FIG.

  As an example of the configuration, the network monitoring apparatus includes a response time measurement unit (in this embodiment, a response time measurement unit 123) that measures a response time related to the request message and the response message that are associated with each other, and the failure The determination unit determines a failure for each state of the predetermined size of the message based on the response time measured by the response time measurement unit.

  As a configuration example, a first transmission is performed in a section between a first communication device (MME device 2 in the present embodiment) and a second communication device (SGW device 4 in the present embodiment) configuring a network. And a second message (in this embodiment, a request message and a response message, in any order), a receiving unit (in this embodiment, a receiving unit 101), and a first message received by the receiving unit A sequence extraction unit that extracts a sequence number included in one message and a sequence number included in the second message received by the reception unit; and a sequence number included in the first message and the second message An associating unit that associates the first message with the second message based on the included sequence number (this embodiment In the state, as an example, an association function unit included in the sequence extraction unit 121, or as an association function unit included in the response time measurement unit 123 as another example, the first message and the second The first message associated by the association unit based on a database (in this embodiment, the message database 122) that stores information about the message, and information about the first message and the second message A network monitoring system (in this embodiment, the capture device shown in FIG. 2), and a failure determination unit that performs failure determination for each state of the size of one or more messages in the set of the second message and the second message 21).

  As one configuration example, the receiving unit receives a request message and a response message that transmit a section between two communication devices that form a network, and the failure determination unit receives the request message and the response that are received by the receiving unit. A network monitoring method (in this embodiment, a method performed by the capture device 21 shown in FIG. 2) that determines a failure for each state of a predetermined size of one or a plurality of messages based on information about messages. is there.

  As an example of the configuration, the failure determination unit determines, for each state of a predetermined size of one or a plurality of messages, based on information about a request message and a response message that transmit a section between two communication devices that configure a network. A network monitoring program (in this embodiment, a program for executing processing performed by the capture device 21 shown in FIG. 2) for causing a computer to execute a step of determining a failure.

[Summary of the above embodiments]
As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the concrete structure is not restricted to this embodiment, The design change etc. of the range which does not deviate from the summary of this invention are included.

  Further, a program for realizing the function of each device (for example, the capture device 21) according to the above-described embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded on the computer. Processing may be performed by causing the system to read and execute.

The “computer system” herein may include hardware such as an operating system (OS) and peripheral devices.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM (Read Only Memory), a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disk), A storage device such as a hard disk built in a computer system.

Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (DRAM) inside a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Dynamic Random Access Memory)) that holds a program for a certain period of time is also included.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be for realizing a part of the functions described above. Further, the program may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.

1-1 to 1-N: base station device, 2 ... MME device, 3 ... HSS device, 4 ... SGW device, 5-1 to 5-M ... PGW device, 6 ... DNS server device, 7 ... authentication server device, 8 to 10: Communication device, 21 ... Capture device, 101 ... Reception unit, 102 ... Message processing unit, 111 ... Request message reception unit, 112 ... Response message reception unit, 121 ... Sequence extraction unit, 122 ... Message database, 123 ... Response time measurement unit, 124 ... failure determination unit, 201 ... message, 211 ... L2 header, 212 ... IP header, 213 ... UDP header, 214 ... GTPv2 header, 215-1 to 215-n ... IE type, 216-1 216-n IE length, 217-1 to 217-n IE value

Claims (10)

A failure determination unit that determines a failure for each state of a predetermined size of one or a plurality of messages based on information about a request message and a response message that are transmitted in a section between two communication devices constituting the network ; ,
A sequence extraction unit that extracts a sequence number included in the request message and a sequence number included in the response message ,
The failure determination unit, for each state of a combination of a predetermined size of each message in a set of the request message and the response message associated with each other based on the sequence number extracted by the sequence extraction unit, Make a decision,
Network monitoring device. A failure determination unit that determines a failure for each state of a predetermined size of one or a plurality of messages based on information related to a request message and a response message that are transmitted in a section between two communication devices constituting a network Prepared ,
As the predetermined size of the message, the whole size of the message or the size of a part of the message is used.
Network monitoring device. A failure determination unit that determines a failure for each state of a predetermined size of one or a plurality of messages based on information about a request message and a response message that are transmitted in a section between two communication devices constituting the network ; ,
A response time measuring unit that measures a response time for the request message and the response message associated with each other , and
The failure determination unit determines a failure for each state of the predetermined size of the message based on the response time measured by the response time measurement unit.
Network monitoring device. A receiving unit that receives a first message and a second message that transmit a section between a first communication device and a second communication device that form a network;
A sequence extraction unit that extracts a sequence number included in the first message received by the reception unit and a sequence number included in the second message received by the reception unit;
An associating unit that associates the first message with the second message based on a sequence number included in the first message and a sequence number included in the second message;
A database for storing information relating to the first message and the second message;
Based on information on the first message and the second message, the state of the size of one or more messages in the set of the first message and the second message associated by the association unit Each time, a failure determination unit for determining a failure,
A network monitoring system comprising: The receiving unit receives a request message and a response message that transmit a section between two communication devices constituting the network,
Failure determination section, based on the information on the received request message and the response message by the receiving unit, for each state of a predetermined size of 1 or more messages, have rows determination of the fault,
The sequence extraction unit extracts a sequence number included in the request message and a sequence number included in the response message,
The failure determination unit, for each state of a combination of a predetermined size of each message in a set of the request message and the response message associated with each other based on the sequence number extracted by the sequence extraction unit, Make a decision,
Network monitoring method. The receiving unit receives a request message and a response message that transmit a section between two communication devices constituting the network,
Failure determination section, based on the information on the received request message and the response message by the receiving unit, for each state of a predetermined size of 1 or more messages, have rows determination of the fault,
As the predetermined size of the message, the whole size of the message or the size of a part of the message is used.
Network monitoring method. The receiving unit receives a request message and a response message that transmit a section between two communication devices constituting the network,
Failure determination section, based on the information on the received request message and the response message by the receiving unit, for each state of a predetermined size of 1 or more messages, have rows determination of the fault,
A response time measuring unit measures the response time associated with the request message and the response message associated with each other;
The failure determination unit determines a failure for each state of the predetermined size of the message based on the response time measured by the response time measurement unit.
Network monitoring method. The failure determination unit performs failure determination for each state of a predetermined size of one or a plurality of messages, based on information on a request message and a response message transmitted in a section between two communication devices constituting the network. Steps to perform ,
A sequence extraction unit extracting a sequence number included in the request message and a sequence number included in the response message;
A network monitoring program for causing a computer to execute the,
The failure determination unit, for each state of a combination of a predetermined size of each message in a set of the request message and the response message associated with each other based on the sequence number extracted by the sequence extraction unit, Make a decision,
Network monitoring program. The failure determination unit performs failure determination for each state of a predetermined size of one or a plurality of messages, based on information on a request message and a response message transmitted in a section between two communication devices constituting the network. The steps to do
A network monitoring program for causing a computer to execute ,
As the predetermined size of the message, the whole size of the message or the size of a part of the message is used.
Network monitoring program. The failure determination unit performs failure determination for each state of a predetermined size of one or a plurality of messages, based on information on a request message and a response message transmitted in a section between two communication devices constituting the network. Steps to perform ,
A response time measuring unit measuring the response time associated with the request message and the response message associated with each other;
A network monitoring program for causing a computer to execute the,
The failure determination unit determines a failure for each state of the predetermined size of the message based on the response time measured by the response time measurement unit.
Network monitoring program.

Images