JP7164140B2 - COMMUNICATION ANALYSIS DEVICE, COMMUNICATION ANALYSIS METHOD AND PROGRAM - Google Patents

Description

The present invention relates to a communication analysis device, communication analysis method and program.

Recently, cloud systems are increasingly being operated in a multi-tenant configuration. In the case of an IaaS (Infrastructure as a Service) type cloud system, a cloud system provider prepares a host machine for operating a virtual machine. A multi-tenant configuration is realized by preparing multiple virtual machines on the host machine and lending the virtual machines to multiple users.

A single tenant may be configured across multiple host machines. In other words, multiple virtual machines within a tenant may be distributed on multiple host machines. In this case, one virtual machine may be automatically migrated between a plurality of host machines for purposes such as ensuring fault tolerance. Such technology includes, for example, an existing technology called live migration.

When a tenant is configured over multiple host machines, the host machines are not necessarily physically close to each other. For example, by building a virtual network using network tunneling technology such as VxLAN (Virtual eXtensible Local Area Network) and configuring tenants on the virtual network, even if multiple host machines are physically separated, tenant Communication is possible as one network inside.

Communication between virtual machines in physically distant locations generally goes through a WAN (Wide Area Network), so the bandwidth is lower than communication within a LAN (Local Area Network), and it often takes longer round-trip time. generally slower. Therefore, even within the same tenant, if the physical distance between the host machines on which the virtual machines operate is long, the speed of communication between virtual machines may not be sufficiently high.

In such a situation, visualization of the communication status between virtual machines, such as which host machine is executing communication between virtual machines, and how much communication is involved, will help optimize operations. Easy to plan and convenient.

In Patent Document 1, a standard protocol for flow aggregation such as NetFlow (Non-Patent Document 1) is used to obtain information such as which host machine is executing communication between virtual machines and how much the communication volume is. Techniques for collecting and analyzing are disclosed.

JP 2015-142269 A

Cisco Systems, "Cisco Systems NetFlow Services Export Version 9", IETF, [searched on March 13, 2017], Internet <http://www.ietf.org/rfc/rfc3954.txt>

However, in Patent Literature 1, although the amount of communication between virtual machines can be visualized, the paths of communication flows cannot be analyzed and presented. When communication between virtual machines in the same host machine passes through a virtual router located in another host machine, it is difficult to intuitively determine the route of the communication flow only from the endpoint of the communication.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a communication analysis device, a communication analysis method, and a program capable of clarifying communication flow paths between virtual machines.

A communication analysis device according to an embodiment of the present invention includes a receiving unit that receives a plurality of pieces of flow information collected in a network that includes a plurality of virtual machines; An identification unit that identifies a set of flow information representing the same communication flow, and an analysis unit that identifies a route of the communication flow based on the set of flow information and the connection information of the network.

A communication analysis method according to an embodiment of the present invention comprises the steps of: receiving a plurality of pieces of flow information collected in a network including a plurality of virtual machines; and identifying a route of the communication flow based on the set of flow information and connection information of the network.

A program according to an embodiment of the present invention comprises steps of receiving a plurality of pieces of flow information collected in a network including a plurality of virtual machines; A computer is caused to perform the steps of identifying a set of flow information representing a flow and identifying a route of the communication flow based on the set of flow information and the connection information of the network.

According to the present invention, it is possible to clarify the path of communication flow between virtual machines.

1 is a block diagram of a communication analysis system according to a first embodiment; FIG. 1 is a block diagram of a flow collector according to a first embodiment; FIG. 4 is a conceptual diagram of an ID record according to the first embodiment; FIG. FIG. 4 is a diagram for explaining a flow record according to the first embodiment; FIG. It is an example of connection information according to the first embodiment. 3 is a block diagram showing the hardware configuration of a flow collector according to the first embodiment; FIG. 4 is a flowchart of database creation processing according to the first embodiment; 4 is a flowchart of route identification processing according to the first embodiment; It is an example of a flow record according to the first embodiment. FIG. 11 is a block diagram of a communication analysis system according to a second embodiment; FIG. It is an example of connection information according to the second embodiment. FIG. 4 is a schematic configuration diagram of a flow collector according to another embodiment;

Embodiments of the present invention will be described below with reference to the drawings.
[First embodiment]
FIG. 1 is a block diagram of a communication analysis system according to this embodiment. The communication analysis system is a so-called cloud system and includes a host device 10, a host device 20, a switch 30, and a flow collector 40. The host devices 10 and 20 are physical server computers and can construct a virtual network. Although two host devices 10 and 20 are shown in FIG. 1, the communication analysis system may have three or more host devices.

A virtual machine 11 , a virtual machine 12 , and a virtual switch 13 are arranged in the host device 10 . The virtual machine 11 , the virtual machine 12 , and the virtual switch 13 are virtually realized by software executed by the processor of the host device 10 . A virtual router 21 and a virtual switch 23 are arranged in the host device 20 . The virtual router 21 and virtual switch 23 are virtually implemented by software executed by the processor of the host device 20 . One or a plurality of virtual machines can be arranged in the host device 20 as well as in the host device 10 .

The virtual machines 11 and 12 are server computers and can provide various services to users of the cloud system. The virtual switch 13 has interfaces (hereinafter referred to as IF) 101, IF102, and IF103. Virtual machines 11 and 12 are connected to the virtual switch 13 via IFs 101 and 102, respectively. Similarly, the virtual switch 23 has IF201 and IF202. A virtual router 21 is connected to the virtual switch 23 via an IF 201 . Note that the number of IFs that the virtual switches 13 and 23 have is not particularly limited.

The switch 30 is a physical connection device that connects the host device 10, the host device 20, and the flow collector 40, and transfers data between these devices. The switch 30 has IF301 and IF302. The IF 301 is connected to the IF 103 of the virtual switch 13 and the IF 302 is connected to the IF 202 of the virtual switch 23 . The switch 30 has a data relay function of determining the destination of received data (packet) and transmitting the data to the destination network device.

The virtual machines 11 and 12 can communicate with each other via the virtual switch 13 . Communication between virtual machines 11 , 12 may occur via virtual router 21 . For example, data transmitted from the virtual machine 11 passes through the virtual switches 13, 30, and 23, is received by the virtual router 21, and is received from the virtual router 21 via the virtual switches 23, 30, and 13. It may be sent to virtual machine 12 .

The flow collector 40 is a communication analysis device, and can collect and analyze flow information about communication flows passing through the virtual switches 13 and 23, the virtual router 21, and the switch 30. FIG. Each of the virtual switches 13, 23, the virtual router 21, and the switch 30 has a function of collecting flow information. Flow information collection can be performed using a flow aggregation protocol such as NetFlow, IPFIX (Internet Protocol Flow Information Export). In the following description, it is assumed that NetFlow is used as the flow aggregation protocol. The flow collector 40 receives flow information from each of the virtual switches 13 and 23, the virtual router 21, and the switch 30. FIG.

FIG. 2 is a block diagram of the flow collector 40 according to this embodiment. The flow collector 40 has functions of a receiving unit 41 , an identifying unit 42 , a storage unit 43 , an acquiring unit 44 , an analyzing unit 45 and an output unit 46 . The receiving unit 41 receives a plurality of pieces of flow information collected within the network of the communication analysis system. Flow information can be sent from virtual switch 13 , virtual switch 23 , and virtual router 21 . The identification unit 42 can identify a plurality of pieces of flow information received by the reception unit 41 and specify a set of flow information representing the same communication flow between the virtual machines 11 and 12 .

The storage unit 43 includes an ID (Identification) management database 431 and a flow information database 432 . The ID management database 431 stores a plurality of ID records including flow identification keys and flow IDs linked to the flow identification keys. As shown in FIG. 3, the flow identification key is the "source IP address (srcaddr)", "destination IP address (dstaddr)", "source port number (srcport)", "destination port number (dstport)", "IP protocol number (prot)", and "ToS (Type of Service) flag value (tos)". A flow identification key is used to classify a plurality of pieces of flow information for each communication flow. The flow ID is determined by the identification unit 42, and the same flow ID is assigned to a set of flow information representing the same communication flow.

The flow information database 432 stores information included in the received flow information and a plurality of flow records including flow IDs linked to each piece of flow information. For example, as shown in FIG. 4, the flow record includes “collector name”, “flow ID”, “flow collection time”, “VLAN (Virtual Local Area Network) number”, “input interface number”, “output interface number”, “source IP address”, “destination IP address”, “source port number”, “destination port number”, and “traffic volume”.

The collection device name is the name of the network device (node) that collected the flow information, and the flow ID is an identifier for determining whether the communication flows are the same. The collection device name may be an IP address as long as the collection device can be identified. The flow collection time is the time when the communication flow is detected and the flow information is collected. The VLAN number is the number of the VLAN to which the collector belongs. The input interface number is the interface number to which the communication flow is input, and the output interface number is the interface number to which the communication flow is output. The source IP address and destination IP address are the source and destination IP addresses of the communication flow, respectively. The source port number and destination port number are the TCP (Transmission Control Protocol) port number or UDP (User Datagram Protocol) port number of the source and destination of the communication flow, respectively. The amount of communication is the amount of communication of the communication flow, and can be represented by the number of packets, the number of bytes, or the like. A flow record may contain all the information that NetFlow can collect, or it may contain only some information (for example, the information shown in FIG. 4).

The acquisition unit 44 acquires and stores physical connection information of the network that the communication analysis system forms. The acquisition unit 44 can acquire connection information between network devices in the communication analysis system from a network management system (NMS). The connection information includes a pair of the IP address and interface number (ifIndex) of the device (node) at one end of the connection and the IP address and interface number (ifIndex) of the device at the other end of the connection. included as FIG. 5 shows an example of connection information according to this embodiment.

Returning to FIG. 2, the analysis unit 45 can analyze the flow information stored in the storage unit 43 based on the connection information to identify the communication flow path. More specifically, the analysis unit 45 extracts a set of flow information (flow records) representing the same communication flow from the flow information database 432, and based on the set, generates route information of the communication flow. The analysis unit 45 may store analysis results such as route information in the storage unit 43 . The output unit 46 can output the analysis result generated by the analysis unit 45 to an external device or a display device (not shown) of the flow collector 40 .

FIG. 6 is a block diagram showing the hardware configuration of the flow collector 40 according to this embodiment. The flow collector 40 includes a CPU (Central Processing Unit) 401 , a ROM (Read Only Memory) 402 , a RAM (Random Access Memory) 403 , a HDD (Hard Disk Drive) 404 , an input/output IF 405 and a bus 406 . The CPU 401 , ROM 402 , RAM 403 , HDD 404 and input/output IF 405 are connected to bus 406 .

The CPU 401 reads out a predetermined program from the ROM 402 and HDD 404 and executes it, thereby realizing the function of each part of the flow collector 40 . In addition, the CPU 401 can store data obtained by processing in the HDD 404 and exchange data with the outside via the input/output IF 405 . A RAM 403 is used as a working memory for programs executed by the CPU 401 and temporarily stores data being processed, data read from the ROM 402 and the HDD 404, and the like.

The HDD 404 stores a database related to flow information, a program for creating the database, a program for identifying the communication flow path, and other programs and data for implementing the functions of the flow collector 40 . The ID management database 431 and the flow information database 432 described above can be created in the HDD 404 . The input/output IF 405 is connected to the switch 30 and controls data communication with the switch 30 . The input/output IF 405 includes an external output terminal and can output data to an external device connected to the external output terminal.

The hardware configuration of the flow collector 40 is not limited to the configuration described above, and various configurations are possible. For example, the flow collector 40 may include a nonvolatile storage device such as a flash memory in place of or in addition to the HDD 404, or may include a removable storage medium such as a memory card. The flow collector 40 may also include a display device such as a liquid crystal display, and an input device such as a keyboard, mouse, and touch panel.

FIG. 7 is a flowchart of database creation processing according to this embodiment. The database creation process is part of the communication analysis method by the flow collector 40 . First, the CPU 401 determines whether flow information has been received (step S101). That is, the CPU 401 determines whether flow information has been received from any one of the virtual switches 13 and 23, the virtual router 21, and the switch 30. FIG. If flow information is not received (NO in step S101), CPU 401 waits until flow information is received.

When flow information is received (YES in step S101), the CPU 401 creates a flow information key (step S102). Specifically, the CPU 401 generates a flow identification key by concatenating the source IP address, destination IP address, source port number, destination port number, IP protocol number, and ToS flag value included in the received flow information. (See Figure 3).

Subsequently, CPU 401 determines whether or not the same flow identification key exists (step S103). That is, CPU 401 searches ID management database 431 using the flow identification key created in step S102, and determines whether ID records having the same flow identification key are stored in ID management database 431 or not.

If the same flow identification key exists (YES in step S103), the CPU 401 acquires the flow ID linked to the flow identification key from the ID management database 431, and assigns the flow ID to the newly created flow record. (step S104).

On the other hand, if the same flow identification key does not exist (NO in step S103), a new ID record is created by associating the newly issued flow ID with the flow identification key and added to the ID management database 431. FIG. Then, the CPU 401 assigns the new flow ID to the newly created flow record (step S105).

Subsequently, the CPU 401 includes the information included in the flow information in the flow record, and stores the flow record in the flow information database 432 (step S106). The CPU 401 returns to step S101 and waits for new flow information.

FIG. 8 is a flowchart of route identification processing according to this embodiment. The route identification process is part of the communication analysis method by the flow collector 40. FIG. First, the CPU 401 acquires network connection information from the NMS (step S201). The CPU 401 may temporarily store the acquired connection information in the RAM 403 or may store it in the HDD 404 . Alternatively, the CPU 401 may periodically acquire the connection information and store it in the HDD 404, and read it from the HDD 404 in step S201.

Subsequently, the CPU 401 acquires a set of flow information to be used for route identification (step S202). That is, the CPU 401 searches the flow information database 432 and acquires flow records that match predetermined conditions specified by the user. The user can specify, as predetermined conditions, a virtual machine name (IP address) whose communication flow is to be analyzed, a collection time range, and the like. It is assumed that the CPU 401 acquires a set of flow records shown in FIG. 9 in step S202. Note that the processing order of steps S201 and S202 is arbitrary, and the processing may be executed in parallel.

Next, the CPU 401 selects arbitrary flow information from the set of flow information (step S203). That is, the CPU 401 selects one flow record from the plurality of flow records acquired in step S202. For example, CPU 401 selects flow record 501 in FIG.

Subsequently, the CPU 401 obtains the interface number to which the communication flow is output (step S204). That is, the CPU 401 acquires the output interface number 103 of the flow record 501 . Then, the CPU 401 determines whether the connection destination of the acquired interface number is a communication endpoint, that is, whether it is a virtual machine (step S205).

For example, the CPU 401 determines that the connection destination of the interface 103 is the switch 30 from the connection information shown in FIG. In this case (NO in step S205), the CPU 401 acquires the interface number of the connection destination (step S206). That is, the CPU 401 acquires the interface number 301 of the switch 30 .

Subsequently, CPU 401 identifies the input communication flow from the interface number acquired in step S206 (step S207). That is, the CPU 401 searches the set of flow records in FIG. 9 and acquires the flow record 506 whose input interface number is 301 .

The CPU 401 returns to step S204 and acquires the interface number to which the communication flow specified in step S207 was output. That is, the CPU 401 acquires the output interface number 302 of the flow record 506 . Then, the CPU 401 determines that the connection destination of the interface 302 is the virtual switch 23 from the connection information shown in FIG. At this point, CPU 401 can identify that the communication flow represented by flow ID 1 passes through virtual switch 13 , switch 30 , and virtual switch 23 .

The CPU 401 can identify the path of the communication flow up to the virtual machine 12 by repeatedly executing such interface number matching processing (the processing of steps S204 to S207). That is, the route is specified in the order of the virtual switch 13, switch 30, virtual switch 23, virtual router 21, virtual switch 23, switch 30, virtual switch 13, and virtual machine 12. FIG. When CPU 401 determines that the connection destination of the interface number is a virtual machine (YES in step S205), CPU 401 stores the specified route information in HDD 404. FIG.

Further, the CPU 401 repeats the same processes as steps S204 to S207 to specify the input-side route of the flow information selected in step S203. That is, in step S204, CPU 401 acquires the interface number to which the communication flow is input, and in step S207, identifies the output communication flow from the acquired interface number. As a result, the route of the communication flow from the virtual machine 11 to the virtual switch 13 is identified. The CPU 401 stores the entire route from the virtual machine 11 to the virtual machine 12 in the HDD 404 and outputs it to a display device, a storage medium, or the like (step S208).

According to this embodiment, flow information related to the same communication flow is identified from flow information collected by a plurality of network devices, and the path of the communication flow is specified based on the flow information and network connection information. It becomes possible to This makes it possible to visualize information such as the route of the communication flow flowing through the system and the statistics related to the route. In addition, identification of flow information is performed based on items related to IP headers, TCP headers, or UDP headers included in the flow information. can be uniquely identified.

[Second embodiment]
Although the communication analysis system in the above-described embodiments is configured so that flow information can be collected from all network devices (nodes) on the system, some nodes may not collect flow information. A communication analysis system according to the present embodiment will be described with a focus on the configuration different from that of the communication analysis system according to the first embodiment.

FIG. 10 is a block diagram of a communication analysis system according to this embodiment. FIG. 10 shows a portion of the network of the communication analysis system, flow collector 40 and other network devices are not shown. The communication analysis system includes a virtual machine 14, a virtual switch 15, a virtual machine 16, a virtual switch 17, and switches 31-33.

The virtual switch 15 has IFs 151 to 153, and the IFs 151 to 153 are connected to the switch 31, the virtual machine 14, and the switch 33, respectively. The virtual switch 17 has IFs 171 to 173, and the IFs 171 to 173 are connected to the switch 32, the virtual machine 16, and the switch 33, respectively. The virtual switches 15 and 17 are connected by two routes, a route via the switch 33 and a route via the switches 31 and 32 . Note that the IFs of the switches 31 to 33 are omitted from the illustration.

In the switches 31 to 33, the flow aggregation protocol is not operating and flow information cannot be acquired. In this case, the acquisition unit 44 rewrites the connection information acquired from the NMS so that the virtual switches 15 and 17 are directly connected without going through the switches 31-33. This makes it possible to analyze the portions of the switches 31 to 33 as black boxes. An example of connection information regarding the virtual switches 15 and 17 is shown in FIG.

According to the connection information in FIG. 11, the detailed route between the virtual switches 15 and 17, that is, the connection information of the switches 31 to 33 is unknown, but the flow route of the entire network excluding the parts of the switches 31 to 33 is analyzed. be able to. In this way, the connection information of this embodiment can be information that is sufficiently useful for understanding the flow path of the entire network. Further, by applying the method of the present embodiment, even in the analysis of communication tunneling in the middle of a communication path such as VxLAN (Virtual eXtensible Local Area Network), it is possible to visualize the path other than the detailed path in the tunnel. It is possible.

[Other embodiments]
FIG. 12 is a schematic configuration diagram of the flow collector (communication analysis device) 40 in the above embodiment. The communication analysis device 40 includes a reception section 41 , an identification section 42 and an analysis section 45 . The receiving unit 41 receives a plurality of pieces of flow information collected within a network including a plurality of virtual machines. The identifying unit identifies a set of pieces of flow information representing the same communication flow between virtual machines from a plurality of pieces of flow information. The analysis unit 45 identifies the route of the communication flow based on the set of flow information and the network connection information.

The present invention is not limited to the above-described embodiments, and can be modified as appropriate without departing from the gist of the present invention. For example, the flow identification key is not limited to the six values of source IP address, destination IP address, source port number, destination port number, IP protocol number, and ToS flag value. good. This makes it possible to eliminate duplication of IP addresses that may occur when the virtual machine 11 and the virtual machine 12 belong to different VLANs. Also, when identifying flow information using the flow identification key, the collection time may be considered. For example, if the difference in collection times is not within a predetermined communication delay time range, it can be determined that the communication flows are not the same.

A program for operating the configuration of the embodiment so as to realize the functions of the above-described embodiment (more specifically, a program for causing a computer to execute the methods shown in FIGS. 7 and 8) is recorded on a recording medium, A processing method of reading a program recorded on a recording medium as a code and executing it on a computer is also included in the category of each embodiment. That is, a computer-readable recording medium is also included in the scope of each embodiment. In addition to the recording medium on which the above program is recorded, the program itself is also included in each embodiment.

For example, a floppy (registered trademark) disk, hard disk, optical disk, magneto-optical disk, CD-ROM, magnetic tape, nonvolatile memory card, and ROM can be used as the recording medium. Further, not only the program recorded on the recording medium alone executes the process, but also the one that operates on the OS and executes the process in cooperation with other software and functions of the expansion board. included in the category of

Some or all of the above-described embodiments can also be described as the following additional remarks, but are not limited to the following.

(Appendix 1)
a receiving unit for receiving a plurality of flow information collected in a network including a plurality of virtual machines;
an identification unit that identifies, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines;
and an analysis unit that identifies a route of the communication flow based on the set of flow information and the connection information of the network.

(Appendix 2)
The flow information includes items related to an IP (Internet Protocol) header, a TCP (Transmission Control Protocol) header, or a UDP (User Datagram Protocol) header, and the identification unit identifies the set of flow information based on the items. The communication analysis device according to appendix 1.

(Appendix 3)
The identifying unit determines that flow information matching a set of a source IP address, a destination IP address, a source port number, a destination port number, an IP protocol number, and a ToS (Type of Service) flag value is the same communication flow. The communication analysis device according to appendix 2.

(Appendix 4)
4. The communication analysis device according to any one of appendices 1 to 3, wherein the identification unit assigns the same identifier to the set of flow information.

(Appendix 5)
a storage unit that stores the plurality of pieces of flow information to which the identifiers are assigned;
5. The communication analysis device according to appendix 4, wherein the analysis unit extracts the set of flow information from the storage unit based on the identifier.

(Appendix 6)
the flow information is collected in each of a plurality of nodes that relay communication between the virtual machines, and includes the IP address and interface number of the node where the collection was performed;
6. The communication analysis device according to any one of appendices 1 to 5, wherein the connection information includes an IP address and an interface number of each of the connected pair of nodes or the pair of the node and the virtual machine.

(Appendix 7)
7. The communication analysis device according to appendix 6, wherein the analysis unit identifies the path of the communication flow by matching an interface number included in the flow information and an interface number included in the connection information.

(Appendix 8)
8. The communication analysis device according to appendix 6 or 7, wherein the node is a virtual switch or a virtual router.

(Appendix 9)
receiving a plurality of flow information collected in a network including a plurality of virtual machines;
identifying, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines;
and identifying a route of the communication flow based on the set of flow information and the connection information of the network.

(Appendix 10)
receiving a plurality of flow information collected in a network including a plurality of virtual machines;
identifying, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines;
and identifying a route of the communication flow based on the set of flow information and the connection information of the network.

10 host devices 11, 12 virtual machine 13 virtual switches 101, 102, 103 interface 20 host device 21 virtual router 23 virtual machine 23 virtual switches 201, 202 interface 30 switches 301, 302 interface 40 flow collector 41 receiver 42 identifier 43 storage Part 431 ID management database 432 Flow information database 44 Acquisition part 45 Analysis part 46 Output part 501 to 507 Flow record

Claims (10)

a receiver that receives a plurality of flow information collected in a network that includes a plurality of virtual machines;
an identification unit that identifies, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines;
an analysis unit that identifies a route of the communication flow based on the set of flow information and the connection information of the network;
a flow identification key, wherein a flow ID is assigned to the set of flow information, and the flow ID includes at least a concatenated value of a source IP address, a destination IP address, and a virtual local area network ID; Linked communication analysis device. The flow information includes items related to an IP (Internet Protocol) header, a TCP (Transmission Control Protocol) header, or a UDP (User Datagram Protocol) header, and the identification unit identifies the set of flow information based on the items. The communication analysis device according to claim 1. The identifying unit determines that flow information matching a set of a source IP address, a destination IP address, a source port number, a destination port number, an IP protocol number, and a ToS (Type of Service) flag value is the same communication flow. 3. The communication analysis device according to claim 2. 4. The communication analyzing apparatus according to any one of claims 1 to 3, wherein the identification unit assigns the same flow ID to the set of flow information. A storage unit that stores the plurality of flow information to which the flow ID is assigned,
5. The communication analysis device according to claim 4, wherein the analysis unit extracts the set of flow information from the storage unit based on the flow ID . the flow information is collected in each of a plurality of nodes that relay communication between the virtual machines, and includes the IP address and interface number of the node where the collection was performed;
6. The communication analyzing apparatus according to any one of claims 1 to 5, wherein said connection information includes an IP address and an interface number of each of said connected pair of nodes or said pair of said node and said virtual machine. 7. The communication analysis device according to claim 6, wherein the analysis unit identifies the route of the communication flow by matching an interface number included in the flow information and an interface number included in the connection information. 8. The communication analysis device according to claim 6, wherein said node is a virtual switch or a virtual router. receiving a plurality of flow information collected in a network including a plurality of virtual machines;
identifying, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines using a flow ID associated with a flow identification key;
determining a route of the communication flow based on the set of flow information and the network connection information;
a flow identification key, wherein a flow ID is assigned to the set of flow information, and the flow ID includes at least a concatenated value of a source IP address, a destination IP address, and a virtual local area network ID; tied up,
Communication analysis method. receiving a plurality of flow information collected in a network including a plurality of virtual machines;
identifying, from among the plurality of pieces of flow information, a set of flow information representing the same communication flow between the virtual machines using a flow ID associated with a flow identification key;
A program for causing a computer to execute a step of identifying a route of the communication flow based on the set of flow information and the connection information of the network,
a flow identification key, wherein a flow ID is assigned to the set of flow information, and the flow ID includes at least a concatenated value of a source IP address, a destination IP address, and a virtual local area network ID; tied up,
program .

Images