JP6467316B2 - Flow inspection apparatus, transfer apparatus, and flow inspection method - Google Patents

Description

  The present invention relates to a network that checks the operation of a transfer device and the transfer rule set in the transfer device in a flow-based network in which a transfer rule is determined by a combination of packet header information, input port, output port, and output header information. The present invention relates to an inspection system, a network inspection method, a flow inspection apparatus, and a program.

1.1 Background OpenFlow is one of the typical technologies of SDN that realizes network control by software. OpenFlow separates the network device into two components, a data transfer control function unit and a data transfer function unit, and by defining an OpenFlow protocol that is an open interface between them, enables flexible control of the data transfer function unit .

  OpenFlow is different from the transfer control for each layer defined in the OSI reference model in the related technology, and is based on a combination of 40 or more types of information such as arbitrary addresses and port numbers representing a plurality of layers from layer 1 to layer 4. Transfer control is performed in units of expressed “flows”.

  The OpenFlow data transfer function unit (data plane) performs a specified action on a packet having header information that matches the matching condition, and transfers the packet. A transfer rule represented by a combination of this match condition and action is called a “flow entry”. In addition to the match field and action field, statistical information for each flow called a counter is added to the flow entry.

  In order to check the normality of a network configured by a transfer device that performs flow-based packet processing typified by the above OpenFlow, a packet having header information that can pass the communication (flow) to be checked is transmitted. It is necessary to acquire three pieces of information: success or failure of transmission of a test packet to a destination, information on a node that has passed through, and flow entry information used for transfer processing in each transfer device.

  In network services in related technologies, normality is verified using tools established for each layer and protocol such as Ethernet (registered trademark) OAM, BFD, ICMP, ping, traceroute, and the like. However, even if a tool established for each layer is used in a flow-based network, sufficient verification cannot be performed.

  For example, even if the communication of the ICMP packet can be confirmed in a certain section, the transmitted ICMP packet is processed by the flow entry for transferring the ICMP packet inside each passing data plane and reaches the destination. Therefore, even if an existing tool is used, the continuity of the flow constituting the service cannot be verified, and the normality of the service is not guaranteed.

1.2 Related Technology In the related technology, in order to solve the above-described problem, in a network to which OpenFlow is applied, a test packet that simulates a user packet that flows on the network and an inquiry process to a transfer control device such as an OpenFlow controller ( By utilizing Packet-In), a method for dealing with the above problems is proposed as follows.

  In the first related technology, by using TTL (Time To Live) subtraction processing of a test packet and Packet-In generated by TTL Invalid, it is possible to check communication between designated transfer devices and acquire route information. A method is proposed.

  First, a UDP packet (if another L4 protocol is used in the OpenFlow switch flow table is used) is generated as a test packet, and header information that matches the inspection target flow entry is set. At this time, a value for identifying the test packet is stored in a header field that is not used in the match condition.

  In the TTL area, 2 (the number of hops to the destination in the case of route confirmation) is stored, and in the payload portion, the route information (information that can identify the source transfer device and the destination transfer device) to be inspected is stored, and Packet-Out To do. Thereby, reachability and route information of an arbitrary packet can be acquired.

  In the second related technology, each transfer device is pre-tagged, and it is possible to distinguish and process the test packet and the user packet by using this tag. Acquired. For tagging transfer devices, a graph coloring algorithm is utilized so that adjacent transfer devices do not have the same tag.

  When the test packet is transmitted from the control device 12 to the transfer device to be inspected, a tag indicating the packet-out destination transfer device is inserted into the header field of the test packet. At this time, the tag indicating the transfer device is stored in a header field (such as VLAN priority bit) that is not used as a match condition for each flow entry. The transfer apparatus that has received the test packet by Packet-Out processes the test packet according to the flow entry that matches the packet.

  Next, in the adjacent transfer device that has received the test packet, the packet is based on a flow entry (this is set in advance) for a packet in which a tag different from its own tag is stored. Perform In. With such a series of processing, it is possible to obtain arrival information and route information of an arbitrary packet via the control device 12.

Junichi Otsuka, Takaharu Omi, Seiji Oyama, Yasumi Hasegawa, Yoichi Yamada, “Examination of communication / path confirmation method for each virtual network in the OpenFlow environment,” IEICE Technical Report ICM2013-64, pp. 11-28. 75--80, 2014. K. Agarwal, E .; Rozner, C.I. Dixon, and J.M. Carter, "SDN traceroute: Tracing SDN Forward-ing without Changing Network Behavior," ACM International Workshop on Hottopinwaredefined in 14 '. 145--150, 2014.

  In the first and second related technologies, a test packet having header information simulating a user packet transmitted from a service user is generated and transmitted to the first transfer device of the flow to be verified. Realizes communication confirmation and acquisition of route information (routed node information).

  However, in order to manage a flow-based network, verification for each flow is necessary as described above, and in addition to this information, it is necessary to acquire flow entry information that matches the packet in each transfer device. There is. This information is mainly used for debugging at the time of setting creation, setting verification, identification of a failure location when a failure occurs, and the like.

  Furthermore, in order to apply the transfer apparatus to the network service, it is desirable that the test can be performed even in a situation where various user traffic flows in the network such as after the service starts. Therefore, even when other packets are flowing, the test packet can be identified, and without affecting the operation of other packets, the success or failure of sending the test packet to the destination, the information of the node that passed, and each transfer It is necessary to acquire three pieces of flow entry information used for transfer processing in the apparatus.

  In order to solve the above-mentioned problems, the present invention provides a transfer device operation and a transfer device setting in a flow-based network in which a transfer rule is determined by a combination of packet header information, input port, output port, and output header information. The purpose is to obtain arrival information and route information of an arbitrary packet by checking the transferred transfer rule, and to quickly identify the cause of the failure when the failure occurs.

  In order to achieve the above object, in the present invention, based on a test request transmitted from an operator, a test packet group that matches the test target flow is generated, and the packet is transmitted to the head switch of the test target flow. The flow table and flow entry information used for the test packet processing are acquired.

Specifically, the flow inspection apparatus according to the present invention is:
A flow inspection device that performs packet processing in the transfer device by transferring a test packet to the transfer device, and checks the reachability of the inspection target packet,
A test information management unit for holding a test packet and identification information of the test packet;
A flow information management unit that acquires and holds flow entry information to be set in the flow table of the transfer device;
A test request receiver for receiving a test request from an operator;
A test packet generation unit that generates a test packet based on the flow entry information managed by the flow information management unit in response to the test request received by the test request reception unit, and transmits the test packet to the transfer device;
A test result receiving unit that performs a test process on the flow table corresponding to the identification information of the test packet among a plurality of flow tables included in the transfer apparatus, and receives a test result of the test process;
Based on the identification information of the test packet added to the payload of the test result, the test result determination comparing the test packet transmitted by the test packet generator with the flow table corresponding to the flow entry information included in the test result And
A test result notifying unit for notifying an operator of the comparison result compared by the test result determining unit.

In the flow inspection apparatus according to the present invention,
The reachability check of the inspection target packet may be repeated for each flow table in which the flow entries constituting the communication path to be tested are stored.

In the flow inspection apparatus according to the present invention, the test packet generation unit may add a test table ID for designating a flow table to be inspected to the test packet.

The transfer apparatus according to the present invention is a transfer apparatus that receives the test packet generated by the flow inspection apparatus and performs a transfer process,
  A receiving unit for receiving the test packet;
  A test table determination unit that determines whether the flow entry processed in the previous stage matches the flow table to be inspected in the next-stage flow table for the test packet received by the reception unit;

Specifically, the flow inspection method according to the present invention is:
A flow inspection method for performing packet processing in the transfer device by transferring a test packet to the transfer device, and checking reachability of the inspection target packet,
Test information management procedure for holding test packets and identification information of the test packets;
A flow information management procedure for acquiring and holding flow entry information to be set in the flow table of the transfer device;
A test request receiving procedure for receiving a test request from an operator;
Generating a test packet based on the flow entry information managed by the flow information management procedure in response to the test request received in the test request receiving procedure, and transmitting the test packet to the transfer device;
A test result receiving procedure for performing a test process on the flow table corresponding to the identification information of the test packet among a plurality of flow tables included in the transfer apparatus, and receiving a test result of the test process;
Based on the identification information of the test packet added to the payload of the test result, the test result determination comparing the test packet transmitted by the test packet generation procedure with the flow table corresponding to the flow entry information included in the test result Procedure and
And a test result notification procedure for notifying an operator of the comparison result compared in the test result determination procedure.

  The above inventions can be combined as much as possible.

  According to the present invention, in a flow-based network in which a transfer rule is determined by a combination of packet header information, input port, output port, and output header information, the operation of the transfer device and the transfer rule set in the transfer device are inspected. By doing so, arrival information and route information of an arbitrary packet can be acquired, and the cause of the failure when the failure occurs can be quickly identified.

2 shows an example of the configuration and flow of a flow inspection apparatus according to the present embodiment. An example of the table preserve | saved by the test information management part which concerns on this embodiment is shown. An example of the table preserve | saved by the flow information management part which concerns on this embodiment is shown. An example of the conversion of the transfer rule (flow rule) which concerns on this embodiment is shown. An example of the test flow which concerns on this embodiment is shown. 2 shows an example of internal processing of a transfer apparatus according to the present embodiment. 2 shows an example of internal processing of a transfer apparatus according to the present embodiment. 2 shows an example of internal processing of a transfer apparatus according to the present embodiment. 1 shows an example of the configuration of a flow inspection apparatus according to the present embodiment. 1 shows an example of the configuration of a flow inspection apparatus according to the present embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited to embodiment shown below. These embodiments are merely examples, and the present invention can be implemented in various modifications and improvements based on the knowledge of those skilled in the art. In the present specification and drawings, the same reference numerals denote the same components.

2. 2. Specific Description According to this Embodiment 2.1 Outline According to this Embodiment As shown in FIG. 1, the flow inspection apparatus according to this embodiment includes a test information management unit 10, a flow information management unit 16, and a test request. The receiving unit 9, the test packet generating unit 15, the test result receiving unit 13, the test result determining unit 14, and the test result notifying unit 8 are provided. In addition, the flow inspection method according to the present embodiment includes a test information management procedure, a flow information management procedure, a test request reception procedure, a test packet generation procedure, a test result reception procedure, a test result determination procedure, And a test result notification procedure.

  In addition to the node information through the success / failure of transmission of the test packet to the destination, flow entry information in which the test packet is matched in each transfer device 18 is acquired, and the normality of the operation in units of flow (the specified packet is the node of the intended node) A test packet group that matches the test target flow is generated on the basis of the test request transmitted from the operator in order to check whether or not the destination is processed by the flow entry in the intended flow table 22 We propose a new verification mechanism that enables acquisition of flow entry information and flow table 22 used for test packet processing by transmitting packets to the head switch of the flow.

  This mechanism mainly includes a flow inspection device 11, a flow table conversion unit 17 (device), a transfer device 18 that performs flow-based control, and a control device 12 that controls the transfer device 18 (the control device 12 has the same casing as the transfer device 18). But is also possible). The flow inspection apparatus 11 performs management of transfer rule information transmitted from the control apparatus 12, generation of a test packet triggered by a test request from an operator, and determination of a test result.

  In the flow table conversion unit 17, in order to provide a test packet discrimination processing unit for test packet identification and a flow information storage processing unit 26 for acquiring matched transfer rule information in the flow table 22 of the transfer device 18, Convert to the transfer rule group to be set. (The flow table conversion unit 17 can be considered in two ways: a method realized outside the transfer device 18 (inside the flow inspection device 11, etc.) and a method implemented inside.) The transfer device 18 performs flow-based transfer processing. In addition, the control device 12 sets flow entries for a plurality of transfer devices 18 and exchanges various other control information.

  In the present invention, a test packet is received in a flow inspection apparatus in response to a test request made up of a test section issued by an operator and flow (ip_dst = 192.168.1.0 / 24, VLAN = 100, etc.) information. Generated.

  In OpenFlow, a pipeline processing mechanism called a multi-table is introduced, and packet processing composed of a plurality of flow tables 22 is performed in each transfer device 18, so that the normality of the operation of each transfer device 18 is verified. In order to do this, it is necessary to acquire flow entry information used for processing for each flow table 22.

  In the present invention, as shown in FIG. 1, a test packet is generated for each table to be checked in order to cope with a pipeline processing mechanism such as a multi-table. A test table ID is added to the test packet generated by the flow inspection apparatus 11, and the flow table 22 to be inspected by one test packet is designated. The test packet is processed by the flow entry in the designated flow table 22, and when the test packet reaches the next flow table 22, the test result is transmitted to the flow inspection apparatus 11.

  Upon receiving the test result, the flow inspection apparatus 11 determines the progress of the inspection based on the test result, adds a test table ID for inspecting the next flow table 22, and has the same header information as before. The test packet is transmitted again to the leading edge transfer device 18 of the flow.

  By repeating this until the end of the flow (or the end of the test section designated by the operator) reaches the transfer device, it is possible to follow the processing for each flow table 22 of the generated test packet, and reachability to the destination And route information, and flow entry information used for transfer processing in each transfer device 18 can be obtained. In addition to these, since the test packet is transmitted for each flow table to be inspected, it is possible to quickly identify the cause of the failure when the failure occurs.

2.2 Configuration of Flow Inspection Device According to this Embodiment As shown in FIG. 1, the inspection mechanism according to this embodiment mainly functions as a flow inspection device 11, a control device 12, a transfer device 18, and a flow table conversion 17. It consists of a flow table conversion device. A plurality of configurations for realizing the present invention are conceivable.

(1) Regarding the introduction of the test function 1) A method of introducing the test function by converting the flow table 22 (flow entry) to be set by the flow table conversion unit 17 outside the transfer device 18 2) provided in the transfer device 18 Of converting the flow table 22 (flow entry) to be set by the flow table conversion unit 17 and introducing a test function

(2) Test packet / test table identification method 1) Store test packet identifier and test table identifier in empty header area that does not collide with all flows in network 2) Encapsulate test packet identifier and test packet identifier in outer Stores test table identifier (test table ID). The transfer device 18 that has received the test packet determines whether or not the test packet is a test packet in the test packet determination unit 23. If the test packet is “2”, the transfer of the test packet is released. (3) Method for obtaining matched flow entry information in 1) When utilizing “4-1” using metadata, one flow table 22 is added to the scheduled flow table ID: N Then, the test table ID of the table N is confirmed. When taking the form “4-2” or “4-3”, the test table determination unit 35 needs to store the information recorded in the metadata in the empty header field of the test packet before transmitting the test result. Is

2.3 Utilization of header field of test packet (4) Test packet / result transmission / reception method 1) Both transmission and reception are via control device 12. 2) Transmission is performed by control device 12, and reception is performed by flow inspection device 11.
3) The flow inspection apparatus 11 performs both transmission and reception.
(5) About the conversion method of the flow table 22 in “1-1” 1) The flow table setting information transmitted from the control device 12 is received and converted.
2) The application itself is converted at the upper level of the control device 12.
Details of each function are shown below.

(Control device)
A plurality of transfer devices 18 are controlled. Based on the transfer device 18 and the flow entry setting request from the outside, the flow entry is recorded and deleted from the flow table 22 of each transfer device 18.
(Transfer device)
The packet is received from the receiving unit 33 via the network, the transfer packet is generated according to the input packet information described in the flow entry in the flow table 22 and the control method, and the transmission unit 34 according to the control method in the flow entry. A device that transmits to the next communication device.
(Receiver)
Receive packets over the network.
(Transmitter)
The packet is transmitted based on the flow table 22 in which the packet processing method is defined.
(Flow table)
Stores a flow entry that defines the processing content for each flow. Pipeline processing is possible. Each flow table 22 is given an identifier.
(Flow information storage processing part)
The test packet is processed according to the matching flow entry.

  Each flow entry is given an identifier called a flow ID, and a process of storing the flow ID of the flow entry matching the test packet in metadata (or an empty header field) is performed. When inspecting a flow that transits a plurality of tables, the flow ID stored in the metadata (or the empty header field) is overwritten for each table.

(Test table determination unit)
Installed in the next flow table 22 of the flow table 22 in which the flow entries to be inspected are stored (when “2-2” is taken, the table having the table ID of the maximum value of the table that can be set in the transfer device 18) A new one is also installed there). When the test packet identifier and the test table ID of the previous flow table ID + 1 are stored in the metadata (or the header field of the test packet), the test packet processed by the metadata and the transfer device 18 is transferred to the flow inspection device 11 ( Alternatively, it is transmitted as a test result to the control device 12). If not stored, each packet is processed according to the matching flow entry.
(Test packet determination unit (required for "2-2"))
Installed in minimum flow table ID and maximum flow table ID. In the table of the minimum flow table ID, the header information of the received test packet is confirmed to determine whether it is a test packet, and if it is a test packet, the encapsulation is released and the test table ID is added to a specific bit of metadata. Implement the process to store. In the flow table 22 of the maximum flow table ID, if it is a test packet, it is encapsulated again and a transfer process (action) is executed.
(Flow entry)
Defines processing details for each flow.

Hereinafter, specific components of the flow inspection apparatus 11 according to the present embodiment will be described.
(Test Information Management Department)
As shown in FIG. 2, in the table stored in the test information management unit 10, the test ID is stored in the payload of each test packet for associating the test packet at the time of transmission with the test result. The test ID and the state of the test packet at the time of transmission are managed together.
(Flow Information Management Department)
As shown in FIG. 3, in a table held in the flow information management unit 16, information on a scheduled flow entry set in the flow table 22 of the transfer device 18 is acquired and managed via the control device 12. Since each flow entry is given a flow ID that can uniquely identify the flow entry, it is managed together. Based on this, flow entries constituting each flow are extracted and managed together with test sections and flow information.
(Test packet generator)
Based on the flow table information of each transfer device 18 in the network managed by the flow information management unit 16, a test packet that matches the test request received from the operator is generated. The generated test packet satisfies the test section designated by the operator and the flow information. A test ID managed by the test information management unit 10 is given to the payload of the test packet.

  The test packet needs to be processed separately from the user packet transmitted from the user so as not to affect the service user. Therefore, an identifier for identifying the test packet from the received packets is stored in the test packet. As an identifier, identification information is stored in a header field that is not used as a match condition in all transfer apparatuses 18 or “4-1”, and is encapsulated in a protocol that is not used as a match condition in all transfer apparatuses. Two methods, “4-2”, which consider this as an identifier, can be considered.

  In this embodiment, since only one flow table 22 that constitutes a flow with one test packet is tested, the identifier (flow table ID) of the flow table 22 to be inspected with the transmitted test packet is also included in the identifier. It is added together.

  If the test packet received as a test result in the flow inspection apparatus 11 has not reached the end point transfer device 18 in the inspection section, the test packet in which the next inspection flow table ID is set is again transferred to the head transfer device 18 of the flow. Send to This is repeated until the end point transfer device 18 is reached.

(Test result judgment part)
A test packet at the time of transmission is called from the test information management unit 10 based on the test packet identification information (test ID) added to the payload of the received test result, and from the flow information management unit 16 based on the received flow ID. Call the matched flow entry and flow table 22. The test packet at the time of transmission, the matched flow entry (flow table 22), and the header information of the processed test packet are compared with the via flow entry information stored in the flow information management unit 16, and the result is notified of the test result. Pass to part 8.

(Test request receiver)
Receive a test request from an operator. The test request is stored in the test information management unit 10.
(Test result notification section)
The test result received from the test result determination unit 14 is notified (displayed) to the operator.

(Flow table conversion device)
The flow table 22 of each transfer device 18 is converted so as to be composed of three elements of a flow information storage processing unit 26, a test table determination unit 35, and a test packet determination unit 23, and the transfer device 18 (“5 -2 "is transmitted to the control device 12).

2.4 Example of Operation According to the Present Embodiment In the case of “1-1”, when setting a flow entry in the flow table 22 of each transfer device 18, the flow table conversion unit 17 converts the flow entry scheduled for setting. Then, the flow table 22 is converted to include the three elements of the flow information storage processing unit 26, the test table determination unit 35, and the test packet determination unit 23.
The flow entry scheduled to be set in the flow table 22 of each transfer device 18 is stored in the flow information management unit 16. At this time, a flow ID is assigned to each flow entry, and a table ID is assigned to each flow table 22.
Test request from the operator (information such as test section, flow information (ip_dst = 192.168.1.0 / 24, VLAN = 100, etc.)) is received by the test request receiving unit 9, and triggered by this, Based on the management information of the flow information management unit 16, the test packet generation unit 15 generates a test packet having header information that can pass the test target flow.
Test packet identifiers are stored in header fields that are not used in match conditions in all transfer apparatuses 18 so that the test packets are processed in the transfer apparatus 18 separately from user packets transmitted from service users. (“2-1”) or encapsulates with a protocol that is not used as a match condition in all transfer apparatuses 18 (“2-2”).
A test ID is added to the payload of the test packet to link the test request and the header information of the test packet at the time of transmission with the test result. The test information management unit 10 holds the association between the test packet and the test ID.
The generated test packet is a control device 12 in the case of “4-1” and “4-2”, and in the case of “4-3”, the leading transfer device 18 (in the test section) of the flow to be inspected from the flow inspection device 11 Send to the first switch.
The test packet received by the transfer device 18 is first processed by the test packet determination unit 23 in the case of “2-2”. The test packet determination unit 23 determines whether the received packet is a test packet. If it is a test packet, it is encapsulated with a protocol that does not collide with the flow entries set in the flow table 22 of all the transfer devices 18. At this time, the test packet determination unit 23 releases the encapsulation, and stores the test table ID stored in the test packet in a header field that is not used for all flow entries.
Next, it is determined from the test table ID stored in the test packet whether the test packet is a test result transmission target in the table currently being processed. This is because when the test packet storing the test table ID corresponding to the table ID of the flow table 22 of the transfer device 18 in the preceding stage is received, the control device 12 (in the case of “5-2, 3”, the flow inspection device This is realized by previously adding a flow entry for notifying the test result to 11) with a maximum priority value.
If the flow entry does not match, the test packet is processed by the flow information storage processing unit 26. In the flow information storage processing unit 26, processing is performed by a flow entry in which header information matches basically like a user packet. Since a flow ID storage process has been added to the flow entry in advance, the flow ID corresponding to the flow entry that matches the metadata (in the case of “3-2”, the empty header field of the test packet) is determined accordingly. Stored.
After storing the flow ID in the metadata (in the case of “3-2”, the empty header field of the test packet), processing is performed according to the action field of the matched flow entry.
When transitioning to the next flow table 22, confirmation processing is performed as to whether or not the flow entry confirms the test table ID set to the highest priority value again. If there is a match, the flow ID and the test packet stored in the metadata (in the case of “3-2”, the empty header field of the test packet), the control device 12 (in the case of “4-2, 3”, the flow inspection device 11 ) At this time, when metadata is used for storing the flow ID (“3-1”) and the test result is transmitted to the flow inspection apparatus 11 without going through the control apparatus 12 (“4-2, 3”). ) Performs processing for storing the content of the metadata in the empty header field of the test packet before transmitting the test result.
If the test table ID does not match any flow entry in any test table determination unit 35 in the transfer device 18, the test packet needs to be transferred to the next hop transfer device 18 according to the matching flow entry. However, when taking a method of distinguishing the test packet from the user packet by encapsulation (“2-2”), in the test packet determination unit 23 provided in the table ID of the maximum value of the table that can be set in the transfer device 18, Prior to the transfer process, if the test packet, a process of encapsulating is performed.
The test packet received by the flow inspection device 11 via the control device 12 (in the case of “4-2, 3”, the test result is acquired by the test result receiving unit 13 in the flow inspection device 11) is a test packet. The test packet at the time of transmission is called from the test information management unit 10 based on the test packet identification information (test ID) added to the payload, and the flow entry matched from the flow information management unit 16 based on the received flow ID And the flow table 22 is called.
The test packet at the time of transmission, the matched flow entry (flow table 22), and the header information of the processed test packet are compared with the via flow entry information stored in the flow information management unit 16, and the result is the test result. It passes to the notification unit 8.
Add 1 to the test table ID stored in the test packet until reaching the end point transfer device 18 in the test section designated by the test request from the operator, and transmit it to the head transfer device 18 in the test section.
Note that FIG. 4 illustrates conversion of transfer rules (flow rules) according to the present embodiment in “2-2”, “3-1”, and “4-1”. A flowchart of the flow inspection method according to the present embodiment will be described below with reference to FIGS.

  FIG. 5 is a flowchart showing a test flow. Based on the test request (step S101), the test packet generator 15 generates a test packet (step S102). The test ID and the generated test packet are stored in the test information management unit 10 (step S103). A test packet is transmitted to the first switch of the test target flow (step S104). The test result receiving unit 13 receives the test result (step S105).

  A test packet at the time of transmission is called from the test ID (step S106). A flow entry corresponding to the flow ID is called from the flow information management unit 16 (step S107). The test result determination unit 14 evaluates the normality based on the test packet at the time of transmission, the test packet after processing, and the matched flow entry (step S108). It is determined whether a test packet storing all test table IDs satisfying the test section has been transmitted (step S109). If transmission has not been completed, steps S104 to S108 are repeated, and if transmission has been completed, the test is terminated. (Step S111).

  FIG. 6 is a flowchart showing internal processing of the transfer device 18 in “2-2”, “3-1”, “4-2, 3”. When the input data (step S201) is a test packet (step S202), the test packet is decapsulated and the test table ID is stored in the metadata (step S203). Next, when the test table ID = Table_ID-1 (step S204), the released test packet is recapsulated (step S209), and the test result is transmitted to the flow inspection apparatus 11 (step S211).

  If the test table ID is not Table_ID-1 (step S204), the matching process is performed according to the flow entry (step S205), and the flow ID that matches the metadata is written (step S206). After the flow ID is written in the metadata, Instruction is executed (step S207). action = goto_table = N? If the condition is satisfied, step S204 to step S208 are repeated.

  action = goto_table = N? If not, the contents of the metadata are stored in the empty header field of the test packet (step S212), the test packet is reencapsulated (step S213), and the action is executed (step S214).

  FIG. 7 is a flowchart showing internal processing of the transfer device 18 in “2-1”, “3-2”, and “4-1, 2, 3”. When the input data (step S301) is test table ID = Table_ID-1 (step S302), the test result is transmitted to the flow inspection apparatus 11 (step S304).

  If the test table ID is not Table_ID-1 (step S302), the matching process is performed according to the flow entry (step S303), the matched flow ID is written in the empty header field of the packet, and the instruction is executed (steps S305 and S306). . action = goto_table = N? If the condition is satisfied, step S302 to step S307 are repeated. action = goto_table = N? If not, an action is executed (step S308).

  FIG. 8 is a flowchart showing internal processing of the transfer device 18 in “2-1”, “3-1”, and “4-1”. When the input data (step S401) is test table ID = Table_ID-1 (step S402), the test result is transmitted to the flow inspection apparatus 11 (step S404).

  If the test table ID is not Table_ID-1 (step S402), the matching process is performed according to the flow entry (step S403), and the flow ID that matches the metadata is written (step S405). The flow ID is written in the metadata and the instruction is executed (step S406). action = goto_table = N? If the condition is satisfied, Steps S402 to S407 are repeated.

  action = goto_table = N? If not, Instruction is executed (step S408) and an action is executed (step S409). At that time, the process of “goto_table = N + 1” is performed, and when the test table ID = Table_ID−1 is satisfied, the test result is transmitted to the flow inspection apparatus 11 (step S413), and the data when the test table ID = Table_ID−1 is not satisfied. Discard (step S414).

  Here, since the content of the metadata cannot be transferred directly to another transfer device 18, in the case of the configuration of FIG. 7, table = N is provided next to table = N + 1, and the test table ID is determined. Take. 9 shows a configuration example of the flow inspection apparatus 11 in “2-1”, and FIG. 10 shows a configuration example of the flow inspection apparatus 11 in “2-2”. Here, the flow table conversion unit 17 may be built inside the transfer device 18.

2.5 Effects of the Invention In the present embodiment, a method for acquiring a flow entry information by utilizing a pipeline processing mechanism when a test packet matches in each transfer device 18 that could not be obtained by related technology. Proposed. According to the present invention, an operator can grasp the flow of a specific packet even in a situation where a user packet is flowing. Therefore, the detailed processing state in the network device is verified in detail compared with the related technology. Things will be possible. Further, by using the present invention, the processing of the test packet in each transfer device 18 is followed for each flow entry that matches each table, so that the location of the failure can be identified more quickly than in the related art.

  In addition, a test packet is generated for each flow table 22 that constitutes a flow to be inspected, and the test is performed, so that all test results are stored in the empty header field of metadata or test packet. The number of possible flow entries increases. Further, regarding the method of “sequentially executing a test for each table”, it can be applied to any network device that performs pipeline processing, not limited to a flow-based network such as OpenFlow.

2.6 Functions in the flow inspection apparatus and transfer apparatus according to the present embodiment Various functions according to the present invention will be described below.
Tests are sequentially executed in units of flow tables in which the flow entries constituting the test target flow are stored (the test results are acquired with a plurality of packets instead of acquiring the test results with one packet).
After the transfer process, it is determined in the next-stage flow table 22 whether the flow entry processed in the previous stage is in the flow table 22 to be inspected.
A test table ID is introduced, and the flow table 22 to be tested with the transmitted test packet is identified in the transfer device 18.
A flow entry scheduled to be set in each transfer device 18 is acquired, and a test packet corresponding to the test request is generated based on the flow entry.
A flow entry set in the transfer device 18 from the control device 12 is converted in advance, and the transfer device 18 has a test function.
-Even if the test function is introduced, it does not affect the transfer processing of user packets.
-Even if the test function is introduced, the original flow entry is not affected (the process for user packets before and after the introduction of the test function is always equivalent).
• Use encapsulation to distinguish between test packets and user packets.
-When encapsulation is not used, the identifier is stored in a header field that is not used as a match condition for all other flow entries.
Define a flow ID to uniquely identify the flow entry.
Define a test ID to uniquely identify the test.
In order to obtain matched flow entry information, an action for storing the flow ID in metadata (or an empty header field of a packet) is added to the action field of each flow entry.
Normality is determined from three types of information: header information of the test packet at the time of transmission, header information of the test packet after processing, and matched flow entry information.

  The present invention can be applied to the information communication industry.

8: Test result notification unit 9: Test request reception unit 10: Test information management unit 11: Flow inspection device 12: Control device 13: Test result reception unit 14: Test result determination unit 15: Test packet generation unit 16: Flow information management Unit 17: Flow table conversion unit 18: Transfer device 19: Application
22: Flow table 23: Test packet determination unit 26: Flow information storage processing unit 33: Reception unit 34: Transmission unit 35: Test table determination unit

Claims (5)

Perform packet processing in the transfer device by transferring the test packet to the transfer device,
A flow inspection apparatus for inspecting the reachability of a packet to be inspected,
A test information management unit for holding a test packet and identification information of the test packet;
A flow information management unit that acquires and holds flow entry information to be set in the flow table of the transfer device;
A test request receiver for receiving a test request from an operator;
A test packet generation unit that generates a test packet based on the flow entry information managed by the flow information management unit in response to the test request received by the test request reception unit, and transmits the test packet to the transfer device;
A test result receiving unit that performs a test process on the flow table corresponding to the identification information of the test packet among a plurality of flow tables included in the transfer apparatus, and receives a test result of the test process;
Based on the identification information of the test packet added to the payload of the test result, the test result determination comparing the test packet transmitted by the test packet generator with the flow table corresponding to the flow entry information included in the test result And
A test result notifying unit for notifying an operator of the comparison result compared in the test result determining unit;
A flow inspection apparatus comprising:   2. The flow inspection apparatus according to claim 1, wherein the inspection of the reachability of the inspection target packet is repeatedly performed for each flow table in which the flow entries constituting the communication path to be tested are stored. It said test packet generating unit is configured to test packet, the flow test apparatus according to claim 1 or 2, characterized in that the addition of the test table ID to specify the flow table to be examined. A transfer device that receives the test packet generated by the flow inspection device according to claim 1 and performs transfer processing,
A receiving unit for receiving the test packet ;
A test table determination unit that determines whether the flow entry processed in the previous stage matches the flow table to be inspected in the next-stage flow table for the test packet received by the reception unit ;
Transfer apparatus comprising: a. Perform packet processing in the transfer device by transferring the test packet to the transfer device,
A flow inspection method for inspecting the reachability of a packet to be inspected,
Test information management procedure for holding test packets and identification information of the test packets;
A flow information management procedure for acquiring and holding flow entry information to be set in the flow table of the transfer device;
A test request receiving procedure for receiving a test request from an operator;
Generating a test packet based on the flow entry information managed by the flow information management procedure in response to the test request received in the test request receiving procedure, and transmitting the test packet to the transfer device;
A test result receiving procedure for performing a test process on the flow table corresponding to the identification information of the test packet among a plurality of flow tables included in the transfer apparatus, and receiving a test result of the test process;
Based on the identification information of the test packet added to the payload of the test result, the test result determination comparing the test packet transmitted by the test packet generation procedure with the flow table corresponding to the flow entry information included in the test result Procedure and
A test result notification procedure for notifying an operator of the comparison result compared in the test result determination procedure;
The flow inspection method characterized by performing.

Images