JP7315099B2 - Connection count measurement device, connection state detection device, connection state detection method, and connection count measurement program - Google Patents

Description

The present invention relates to a connection detection technique for detecting connection states based on received packets.

Generally, in service operation management in network services such as carrier networks and data centers, it is necessary to monitor the number of server connections in real time in order to grasp the load status of the server. The number of connections can be measured within the server by using the technique described in Non-Patent Document 1, for example, and an accurate number can be obtained. However, since it occupies part of the computational resources of the server in order to monitor the connection, there is a possibility that the processing performance of the server may be degraded.

On the other hand, if the connections on the communication network are monitored using the technique described in Non-Patent Document 2 using network equipment such as network switches, routers, and network monitoring devices that are separate from the server, the number of connections can be measured without imposing a load on the server.

Michael Kerrisk, "Linux System Administrator's Manual NETSTAT(8)", The Linux Programming Interface, [online], 2020-04-30, [searched 2020/05/07], Internet, <URL: http://man7.org/linux/man-pages/man8/netstat.8.html> K. McCloghrie, RFC2012, "SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2", THE INTERNET SOCIETY and THE INTERNET ENGINEERING TASK FORCE, [online], November 1996, [searched 2020/05/07], Internet, <https://www.rfc-editor.org/rfc/rfc2012.txt>

When measuring the number of connections on a network, it is necessary to detect and hold (manage) the states of many connections. Conventionally, a method of searching a connection table for holding the connection state by hash search has been proposed, and high-speed search is enabled by using a hash value corresponding to the field information contained in the header of the input packet as the search key of the connection table. Here, in general hash search, a long hash value is used as a search key in order to avoid search failure due to hash collision. Therefore, the connection table for hash search requires a memory larger than the number of connections that hold the state, resulting in low memory utilization efficiency.

SUMMARY OF THE INVENTION It is an object of the present invention to solve such problems, and to provide a connection state detection technique capable of detecting a connection state with a small amount of memory resources.

In order to achieve such an object, a connection number measuring apparatus according to the present invention acquires a network I/F for performing data communication using packets with a communication network, obtains a preset field value and state control information for controlling the connection state from the header of a received packet received from the communication network via the network I/F, detects the state of a target connection indicating the connection of the received packet based on the field value and the state control information, and measures the number of connections for each connection based on the obtained detection result. and a plurality of state storage circuits configured to hold a state value indicating the state of a connection and a reference value for identifying the connection, the control device comprising: a selection unit configured to select, from among the plurality of state storage circuits, a state storage circuit holding the state value related to the target connection based on the reference value held in each of the state storage circuits; and a state determining unit configured to determine a next state of the target connection and output it as the detection result, and a state updating unit configured to update contents held in the plurality of state storage circuits based on the next state of the target connection obtained by the state determining unit.

A connection state detection apparatus according to the present invention comprises: a plurality of state storage circuits configured to hold a state value indicating a connection state of a received packet and a reference value for identifying the connection; and a controller configured to refer to the state value and the reference value held in the plurality of state storage circuits based on a field value and state control information obtained from a header of the received packet, wherein the control device detects the state of a target connection, which is the connection of the received packet. a state determining unit configured to determine a next state of the target connection based on the state control information obtained from the received packet and the state value selected by the selecting unit and stored in the state storage circuit, thereby detecting the state of the target connection; and based on the next state of the target connection obtained by the state determining unit. and a state update unit configured to update contents held in the plurality of state storage circuits.

A connection state detection method according to the present invention includes: a plurality of state storage circuits configured to store a state value indicating a connection state of a received packet and a reference value for identifying the connection; and a connection controller configured to detect the state of a target connection, which is the connection of the received packet, by referring to the state value and the reference value held in the plurality of state storage circuits based on a field value and state control information obtained from a header of the received packet, and output the obtained detection result. A state detection method used in a state detection device, wherein the control device selects, from among the plurality of state storage circuits, a state storage circuit that holds a state value related to the target connection based on the reference value held in each state storage circuit; and the control device determines the next state of the target connection based on the state control information acquired from the received packet and the state value held in the state storage circuit selected in the selection step, thereby detecting the state of the target connection. and a state update step, wherein the controller updates contents held in the plurality of state storage circuits based on the next state of the target connection obtained in the state determination step.

Further, a connection number measuring program according to the present invention is a program for causing a computer to function as each part constituting the above connection number measuring apparatus.

According to the present invention, it is possible to detect the connection state with less memory resources than in the prior art.

FIG. 1 is a block diagram showing the configuration of the number-of-connections measuring device. FIG. 2 is a block diagram showing the details of the state detector. FIG. 3 is a state transition diagram of a TCP connection. FIG. 4 is an explanatory diagram showing the state update operation. FIG. 5 is an explanatory diagram showing the operation at the time of conflict with the storage destination. FIG. 6 is a flow chart of the method for measuring the number of connections. FIG. 7 is a flowchart of a connection state detection method. FIG. 8 is an explanatory diagram showing a configuration example of the number of connections measurement result.

Next, one embodiment of the present invention will be described with reference to the drawings.
[Connection number measuring device]
First, a connection number measuring device 10 and a connection state detecting device 10A according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of the number-of-connections measuring device.

The connection number measuring device 10 is a device that receives packets to be monitored from a communication network NW such as the Internet or a LAN, and measures connections detected based on the obtained received packets. The measured number of connections is used, for example, to grasp the load status of servers used in network services such as carrier networks and data centers.

The number-of-connections measuring device 10 may be configured as a single device, or may be implemented in a network monitoring device or network monitoring system that monitors the communication status of a network by measuring the number of flows and connections based on packets. The apparatus of the present invention can also be implemented by a computer and a program, and the program can be recorded on a recording medium or provided through a network.

As shown in FIG. 1, the connection number measuring device 10 includes a network I/F 11, an operation input device 12, a screen display device 13, a storage device 14, a control device 15, and a state storage circuit 16 as main components.

[Network I/F11]
The network I/F 11 is configured to perform data communication using packets with the communication network NW.
[Operation input device]
The operation input device 12 includes an operation input device such as a keyboard, a mouse, and a touch panel, and is configured to detect operator's operations and output them to the control device 15 .
[Screen display device]
The screen display device 13 is composed of a screen display device such as an LCD, and is configured to display various screens output from the control device 15, such as a menu screen, a setting screen, and a monitoring result screen.

[Storage device]
The storage device 14 is composed of a storage device such as a hard disk or a semiconductor memory, and is configured to store processing data and a program 14P used for connection number measurement processing executed by the control device 15 .
The program 14P is a program that cooperates with the CPU of the control device 15 to realize various processing units that execute connection number measurement processing. The program 14P is read in advance from the connected external device or recording medium and stored in the storage device 14 .

[Control device]
The control device 15 is composed of a combination of a general server device and an FPGA (Field-Programmable Gate Array) accelerator. Since high-speed packet processing can be performed by using an FPGA accelerator, it can also be applied to traffic monitoring in high-speed networks such as 40 Gbps (Gigabits per second) and 100 Gbps. On the other hand, since high-speed packet processing is not required in low-speed networks, it is possible to configure a single server in which all processing is implemented by software.

In the following description, the control device 15 has a CPU and its peripheral circuits (including an FPGA accelerator), reads the program 14P in the storage device 14, and cooperates with the CPU to implement various processing units that execute the number of connections counting process.
As main processing units realized by the control device 15, there are a packet receiving unit 15A, a header analyzing unit 15B, a state detecting unit 15C, and a connection counting unit 15D.

[Packet receiver]
The packet receiver 15A is configured to receive packets to be monitored from the communication network NW via the network I/F 11 . The packet received by the packet receiver 15A may be a packet sent to the connection number measuring device 10, or may be a packet copied (captured) by a network device such as a switch, router, or network tap.

[Header analysis part]
The header analysis unit 15B is configured to extract one or more field values specified in advance from the header of the received packet received by the packet reception unit 15A.
A connection is a virtual communication path set between processes in order to accurately transfer packets used for data transfer. Field values (identifiers) such as MAC addresses, protocols, IP addresses, and port numbers are generally used to identify connections. In particular, a combination (5-tuple) of source IP address, destination IP address, source port number, destination port number, and protocol is often used for connection identification. Also, field values such as VLAN ID and VXLAN ID may be used in the virtual network.

The header analysis unit 15B also acquires state control information used for connection control from the header or payload of the packet. For example, there are six types of control flags, which are state control information used in TCP (Transmission Control Protocol) communication: a URG (Urgent) flag, an ACK (Acknowledgment) flag, a PSH (Push) flag, a RST (Reset) flag, a SYN (Synchronize) flag, and a FIN (Finish) flag, each consisting of 1-bit width information.

[Status detector]
The state detection unit 15C is configured to identify the connection based on the field value obtained by the header analysis unit 15B, and to detect the next state of the connection from changes in the state control information. The details of the state detector 15C will be described later.

[Number of connections counter]
The connection number counting unit 15D is configured to increase or decrease the count number of the corresponding connection based on the detection result obtained by the state detection unit 15C, and output the obtained count result as the number of connections of the network to be monitored to the screen display device 13 or a host device (not shown) connected via the network I/F 11. Further, the obtained count result may be used for monitoring or traffic control processing separately executed by the control device 15 .

[State memory circuit]
The state storage circuit 16 is composed of a semiconductor memory as a whole, and has a plurality of storage areas each assigned to an arbitrary connection, and is configured to hold (manage) a state value State indicating the state of the corresponding connection and a reference value Ref for identifying the connection in any one of the storage areas. In this embodiment, two state memory circuits 16A and 16B (first and second state memory circuits) are used as the state memory circuit 16. However, the present invention is not limited to this, and three or more state memory circuits 16 may be used.

[Connection state detector]
In the above configuration, the connection state detection device 10A can be configured from the state detection section 15C and the state storage circuit 16. FIG. The connection state detection device 10A receives field values and state control information obtained from the header of the received packet, and refers to the state value State and the reference value Ref held in the state storage circuit 16 based on these field values and state control information to detect the state of the target connection, which is the connection of the received packet. This connection state detection device 10A may be mounted in a network monitoring device or a network monitoring system that monitors the flow of packets and the state of connections, in addition to the number of connections measurement device 10 .

[Details of status detector]
Next, the details of the state detector 15C will be described with reference to FIG. FIG. 2 is a block diagram showing the details of the state detector.
The state detection unit 15C includes a hash value calculation unit 21, a search key generation unit 22, a selection unit 24, a state determination unit 25, and a state update unit 23 as processing units that execute state detection processing. Although FIG. 2 shows a case where two state memory circuits 16A and 16B are used as the state memory circuit 16, the present invention is not limited to this, and three or more state memory circuits may be used.

[Hash value calculator]
The hash value calculation unit 21 is configured to calculate a hash value Hash from the field value Field acquired by the header analysis unit 15B based on a preset hash function. The hash value needs to have a length that can uniquely identify the connection to be measured. For example, 32 bits to 64 bits is a realistic length. A known algorithm such as MurmurHash3 may be used as the hash function used to calculate the hash value.

[Search key generator]
The search key generator 22 is configured to extract a portion of the hash value Hash obtained by the hash value calculator 21 and generate a search key Key for each state storage circuit 16 . For example, as shown in FIG. 2, when using two state storage circuits 16A and 16B, two Keys #0 and #1 are generated. As a method of extracting the hash value Hash, for example, there is a method of dividing into upper bits and lower bits. This division method is suitable for hardware and can be implemented with a very simple circuit configuration. If part of the hash value Hash is used as a search key, an incorrect connection state may be output from the state storage circuits 16A and 16B due to hash collision, but an appropriate output can be selected by a method described later.

Also, the search key generator 22 generates a comparison value Comp. To generate the comparison value Comp, it is only necessary to cut out a part of the hash value Hash. At this time, the comparison value Comp needs to be extracted from a portion different from the search key Key#0, but may be extracted from a portion partially or wholly overlapping with the search key Key#1.

[State memory circuit]
The state storage circuits 16A and 16B are small-scale connection tables that allow hash collision, and are configured to hold (manage) the state value State indicating the next state of the connection determined by the state determination unit 25. FIG. For example, in the case of a TCP connection, a SYN state 30, an ACK state 31, and a FIN/RST state 32 in FIG. 3, which will be described later, may be held as the state value State.
When two state storage circuits 16A and 16B are used, the state storage circuit 16A is configured to hold the reference value Ref#0 together with the state value State#0, but the state storage circuit 16B may or may not hold the reference value Ref#1 in addition to the state value State#1.

The reference value Ref according to the present invention is information for identifying the connection held in the state storage circuit 16, and is composed of the comparison value Comp calculated when the state storage circuit 16 newly starts holding the connection state. This makes it possible to determine which of the state values State output from each state storage circuit 16 indicates the state value State related to the connection of the received packet.
In this case, memory resources required to hold the reference value Ref increase. Therefore, for example, if it is expected that hash collisions are unlikely to occur in the state storage circuit 16B, the reference value Ref#1 may not be retained, and the output of the state storage circuit 16B may be selected when it is determined that the state value State of a different connection has been output from the state storage circuit 16A.

[Selection part]
The selection unit 24 compares the reference value Ref output from the state storage circuit 16 with the comparison value Comp regarding the received packet, selects the state storage circuit 16 corresponding to the reference value Ref that matches the comparison value Comp, outputs the state value State held in the selected state storage circuit 16 to the state determination unit 25, and if none of the reference values Ref matches the comparison value Comp, the connection of the received packet is new, and each state storage circuit 1 6 is configured to be output to the state updating unit 23 .

[Status determination part]
The state determination unit 25 is configured to determine the next state of the connection from a preset state transition diagram based on the state value State output from the selection unit 24 and the state control information Flag included in the received packet. FIG. 3 is a state transition diagram of a TCP connection. By using this state transition diagram, the next state of the TCP connection can be determined based on the current state value State and the newly notified state control information Flag.

As shown in FIG. 3, the main states of a TCP connection are SYN state 30, ACK state 31, and FIN/RST state 32. A SYN state 30 indicates a state in which one process notifies the other of a connection establishment request (SYN flag). The ACK state 31 indicates a state in which an establishment response (ACK flag) is sent from the other to the other when permitting the establishment request. The FIN/RST state 32 indicates a state in which one or the other has notified the partner of a disconnection request (FIN flag) or suspension (RST flag) of the connection.

[Status update part]
The state update unit 23 updates the state value State and the reference value Ref held in the state storage circuit 16 based on the contents held in the state storage circuit 16 output from the selection unit 24 when the state of the connection held by the state determination unit 25 changes or when the establishment of a new connection is detected, and the new connection is newly stored (updated) only when there is an empty state storage circuit 16 that does not hold the state value State. It is

By selecting an appropriate value based on the reference value Ref held in the state memory circuit 16 using the above configuration, occurrence of hash collision in each state memory circuit 16 can be allowed. Therefore, in this configuration, a small-scale state storage circuit 16 with high memory utilization efficiency can be employed, and memory resources can be reduced as compared with the conventional configuration.

[Operation of this embodiment]
Next, the operation of the number-of-connections measuring device 10 according to this embodiment will be described. Here, the state update operation and storage destination collision operation in the state storage circuits 16A and 16B, the connection count operation in the control device 15, and the state detection operation in the state detection unit 15C will be individually described.

[Status Update Action]
First, referring to FIG. 4, the state update operation in the state storage circuits 16A and 16B will be described. FIG. 4 is an explanatory diagram showing the state update operation, and shows the process of updating the state value State held in the state storage circuit 16 along the horizontal axis of time. Here, an example will be described in which the connection state is updated using the state storage circuits 16A and 16B each provided as a storage area for storing the connection state value State and the reference value Ref. In this example, the state storage circuit 16A holds the state value State#0 and the reference value Ref#0, and the state storage circuit 16B holds only the state value State#1.

At time T1, neither of the state storage circuits 16A and 16B holds the state value State. When a new connection 1 (Con1) is detected at the next time T2, the state storage circuit 16A holds the state "Con1 State" of the connection 1 as the state value State#0 and the comparison value Comp of the connection as the reference value Ref#0.
At subsequent time T3, when another new connection 2 (Con2) is detected, since connection 1 (Con1) is already held in the state storage circuit 16A, the state "Con2 State" of connection 2 is held as the state value State#1 in the state storage circuit 16B. At this time, the connection comparison value Comp is not held as the reference value Ref#1.

After that, when the termination (disconnection) of connection 1 is detected at time T4, the state update unit 23 transfers the state value State#1 of connection 2 held in the state storage circuit 16B to the state storage circuit 16A. At this time, the reference value Ref#0 that has been held in the state storage circuit 16A is updated to a value indicating connection 2. FIG. As a result, at subsequent time T5, the state value and reference value of connection 2 are held in state storage circuit 16A as state value State#0 and reference value Ref#0. At the time of transfer, the state value State#0 of the state storage circuit 16A and the state value State#1 of the state storage circuit 16B may be exchanged.

On the other hand, at time T4, if the transfer processing is not performed, the state storage circuit 16A has already disconnected the connection and has finished holding the state. Therefore, if it is determined that the connection has started for some reason (for example, retransmission of the SYN flag) in the packet related to connection 2 received thereafter, the state is held in the state storage circuit 16A. Subsequently, when the connection 2 is disconnected, the reference value Ref#0 and the comparison value Comp match, so the state holding of the state storage unit 16A ends. On the other hand, the state storage unit 16B continues to hold the state of connection 2 until the state is overwritten by the third connection. In order to avoid such inappropriate connection management, it is necessary to transfer the connection state values and reference values held in the state storage circuit 16B to the state storage circuit 16A. The update processing of these state storage circuits 16A and 16B is controlled by the state update unit 23. FIG.

[Action when save destination conflicts]
Next, referring to FIG. 5, the operation of the state memory circuits 16A and 16B at the time of storage destination collision will be described. FIG. 5 is an explanatory diagram showing the operation at the time of conflict with the storage destination. Here, it is assumed that two storage areas are provided in each of the state storage circuits 16A and 16B, and a packet of connection 2 is received in a situation where the state value (Con1 State) of connection 1 is held in the storage area of address "0" of the state storage circuit 16A. The search keys Key #0 and #1 (first search key and second search key) are generated by dividing the hash value Hash into the lower 1 bit and the upper 1 bit, and the comparison value Comp uses the upper 1 bit of the hash value Hash that is different from the search key Key #0.

When a new received packet is received, the hash value calculator 21 calculates a hash value Hash “2” (=“10”: binary number) based on the field value obtained from the header of the received packet. Based on this hash value Hash, the search key generator 22 generates "0" and "1" as the search keys Key #0 and #1, respectively, and "1" as the comparison value Comp. In this case, in the state storage circuit 16A corresponding to Key#0, the reference value Ref#0 held in the storage area of the address Addr corresponding to the value "0" of Key#0 is "0" and does not match the value "1" of the comparison value Comp. As a result, the selection unit 24 determines that the connection held in the state storage circuit 16A is a different connection for the received packet.

At this time, the selector 24 simply compares Ref#0 and Comp in the state storage circuit 16A, and determines whether the connections match or disagree based on the obtained comparison result. For this reason, when it is determined that they do not match, it is not possible to specify which connection the received packet is. Therefore, if it is determined that they do not match, the state value (Con2 State) of connection 2 is stored in the storage area corresponding to the value "1" (address value) of Key #1 that can identify the connection of the received packet in the state storage circuit 16B corresponding to Key #1.

When the connection of the new received packet is different from the connection held by the arbitrary state storage circuit 16, that is, when the storage destinations of the state values collide between different connections, the state value related to the connection of the received packet can be held by using the other state storage circuit 16B. As a result, the number of unused storage areas can be reduced, and the state detection section 15C can be configured using a small-scale state storage circuit 16. FIG.

[Number of connections measurement operation]
Next, referring to FIG. 6, the operation of measuring the number of connections in the control device 15 will be described. FIG. 6 is a flow chart of the method for measuring the number of connections.
The control device 15 first checks whether a packet has been received from the communication network NW via the network I/F 11 by the packet receiving unit 15A (step S100), and waits until a new packet is received (step S100: NO).

When a new packet is received (step S100: YES), the control device 15 causes the header analysis unit 15B to extract a preset field value from the header of the received packet (step S101), and extracts state control information for controlling the state of the connection (step S102).
Next, the control device 15 uses the state detection unit 15C to check the next state of the connection of the received packet based on the state value of the connection being held and the extracted state control information (step S103).

Here, if the next state indicates the start of a connection (step S103: start), the count value indicating the number of connections is incremented (+1) by the connection count unit 15D (step S104), the connection state held by the state detection unit 15C is updated (step S106), and the process proceeds to step S107, which will be described later.
If the next state indicates termination (disconnection) of the connection (step S103: termination), the count value indicating the number of connections is decremented (-1) by the connection number counting unit 15D (step S105), and the process proceeds to step S106.

If the next state is other than start or end (step S103: ELSE), the process proceeds to step S107, which will be described later.
Thereafter, the control device 15 confirms whether or not it is time to end the counting operation (step S107) based on the operator operation detected by the operation input device 12 and the preset counting operation end time (step S107). If it is time to end the counting operation (step S107: YES), the series of connection count processing ends.

[Status detection operation]
Next, referring to FIG. 7, the state detection operation of the state detector 15C will be described. FIG. 7 is a flowchart of a connection state detection method.
Here, it is assumed that the state storage circuit 16A holds the state value State#0 and the reference value Ref#0, and the state storage circuit 16B holds only the state value State#1, as described above.

The state detection unit 15C calculates a hash value Hash from the field value obtained by the header analysis unit 15B (step S110), divides the obtained hash value Hash to generate search keys Key #0 and #1 related to the connection of the received packet (step S111), and generates a comparison value Comp (step S112).
Next, the state detection unit 15C acquires the connection state value State#0 and the reference value Ref#0 held in the storage area corresponding to the value (address value) of Key#0 from the state storage circuit 16A associated with Key#0 (step S113).

Subsequently, the state detection unit 15C causes the selection unit 24 to compare the obtained reference value Ref#0 with the comparison value Comp (step S114), and if the two values match (step S114: YES), selects the state storage circuit 16A as the state storage circuit 16 that should hold the connection of the received packet.
As a result, the state detection unit 15C determines the next state of the connection based on the state value State#0 (current state) obtained from the state storage circuit 16A and the state control information Flag extracted by the header analysis unit 15B by the state determination unit 25 (step S115), and proceeds to step S118, which will be described later.

On the other hand, if the two values do not match in step S114 (step S114: NO), the selection unit 24 selects the state storage circuit 16B as the state storage circuit 16 that should hold the connection of the received packet.
As a result, the state detection unit 15C acquires the connection state value State#1 held in the storage area corresponding to the value (address value) of Key#1 from the state storage circuit 16B associated with Key#1 by the state determination unit 25 (step S116).

Subsequently, the state detection unit 15C determines the next state of the connection based on the state value State#1 (current state) obtained from the state storage circuit 16B and the state control information Flag extracted by the header analysis unit 15B (step S117), and proceeds to step S118 described later.

Thereafter, when the state updating unit 23 detects a change in the connection state held in one of the state storage circuits 16, or when the establishment of a new connection is detected, the state detection unit 15C updates the contents held in the corresponding state storage circuits 16A and 16B (step S118), and ends the series of state detection processing. At this time, when the state value State#0 of the connection held in the state storage circuit 16A transitions from established to terminated (disconnected) and the state value State#1 of the connection held in the state storage circuit 16B indicates establishment, the state update unit 23 transfers the state value State#1 held in the state storage circuit 16B as the state value State#0 of the state storage circuit 16A.

FIG. 8 is an explanatory diagram showing a configuration example of the number of connections measurement result. In FIG. 8, the number of connections obtained by measurement is output in association with a rule for identifying the connection.
Each rule is information for identifying a connection to be monitored, and is preset by an operator using the operation input device 12 and the screen display device 13, for example. Here, as a rule, specific setting values are set for field values consisting of a source IP address, a destination IP address, and a protocol type.

For example, if the field value extracted from the header of the received packet matches the set value of any rule, the number of connections associated with that rule is incremented (+1) or decremented (-1).
This allows the operator to monitor the number of connections simply by setting a field value related to a connection to be monitored as a setting value of a rule.

[Effects of this embodiment]
As described above, the connection number measuring device 10 and the connection state detecting device 10A according to the present embodiment include a plurality of state storage circuits 16 that hold the state value state and the reference value Ref. Based on the state control information and the state value State held in the state storage circuit 16, the next state regarding the state of the object connection is discriminated, and the state updating unit 23 updates the contents held in the state storage circuit 16 based on the next state concerning the object connection.

More specifically, each of the state storage circuits 16 has a plurality of storage areas assigned to arbitrary connections as storage areas for holding the state value state and the reference value Ref. In the control device 15, the search key generation unit 22 generates a plurality of search keys different from each other from the hash value Hash calculated based on the field value of the received packet as a search key for searching the storage area corresponding to the target connection from the state storage circuit 16 for each of the state storage circuits 16. , a comparison value Comp for identifying the target connection is generated, and the selection unit 24 selects the state storage circuit 16 by comparing the reference value Ref output from the state storage circuit 16 based on these retrieval keys Key with the comparison value Comp output from the retrieval key generation unit 22.

When storing the state value state related to the target connection of the received packet in the state storage circuit 16, the storage destinations of the state value state conflict with each other in the state storage circuit 16 that holds the state value state of the connection different from the target connection. According to the present embodiment, the selection unit 24 selects the state storage circuit 16 to hold the state value State related to the target connection from among the state storage circuits 16 based on the reference value Ref held in each state storage circuit 16 .

Thus, in the state memory circuit 16, it is possible to allow hash collision of the search key Key, so that the search key Key with a relatively small number of bits can be used, and the address space, that is, the storage area of the state memory circuit 16 can be reduced.
According to the conventional technology, a long hash value is used as a search key in order to avoid search failures due to hash collisions. Therefore, a memory larger than the number of connections is required as a memory to hold the state, resulting in a problem of low memory utilization efficiency. However, according to the present embodiment, compared to the conventional technology, it is possible to detect the connection state with less memory resources, and it is also possible to measure the number of connections.

Further, in the present embodiment, the search key generation unit 22 may generate a plurality of search keys Key by dividing the bit string forming the hash value Hash into a plurality of pieces, and cut out a part of the bit string to generate the comparison value Comp. This makes it possible to generate a search key Key and a comparison value Comp with few hash collisions by extremely simple processing.

[Expansion of Embodiment]
Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

REFERENCE SIGNS LIST 10 connection count device 10A connection state detection device 11 network I/F 12 operation input device 13 screen display device 14 storage device 14P program 15 control device 15A packet reception unit 15B header analysis unit 15C state detection unit 15D number of connections count unit 16, 16A, 16B state storage circuit 21 hash value calculation unit 22 search key generation unit , 23 state update unit 24 selection unit 25 state determination unit NW communication network Hash hash value Key, Key#0, Key#1 search key State, State#0, State#1 state value Ref, Ref#0, Ref#1 reference value Comp comparison value.

Claims (8)

a network I/F that performs data communication using packets with a communication network;
a control device that acquires a field value set in advance from a header of a received packet received from the communication network via the network I/F and state control information for controlling the state of a connection, detects a state related to a target connection indicating a connection of the received packet based on the field value and the state control information, and measures the number of connections related to each connection based on the obtained detection result;
a plurality of state storage circuits configured to hold a state value indicating the state of a connection and a reference value for identifying the connection;
The control device is
a selection unit configured to select, from among the plurality of state storage circuits, a state storage circuit holding a state value related to the target connection based on the reference value held in each state storage circuit;
a state determination unit configured to determine a next state related to the state of the target connection based on the state control information acquired from the received packet and the state value held in the state storage circuit selected by the selection unit, and to output the result as the detection result;
and a state update unit configured to update contents held in the plurality of state storage circuits based on the next state of the target connection obtained by the state determination unit. In the connection number measuring device according to claim 1,
each of the plurality of state storage circuits includes a plurality of storage areas assigned to arbitrary connections as storage areas for holding the state value and the reference value;
The control device further comprises a search key generation unit configured to generate, for each of the plurality of state storage circuits, a plurality of search keys different from each other from hash values calculated based on field values of the received packet as search keys for searching storage areas corresponding to the target connection in the state storage circuits, and to generate a comparison value for identifying the target connection,
The connection number measuring device, wherein the selection unit selects the state storage circuit by comparing the reference value output from the plurality of state storage circuits based on the plurality of search keys and the comparison value output from the search key generation unit. In the connection number measuring device according to claim 2,
The number-of-connections measuring device, wherein the search key generation unit generates each of the plurality of search keys by dividing a bit string forming the hash value into a plurality of pieces, and cuts out a part of the bit string to generate the comparison value. In the connection number measuring device according to claim 2,
comprising first and second state memory circuits as the state memory circuits;
the first state storage circuit holds the state value and the reference value;
the second state storage circuit holds only the state value;
The selection unit compares the reference value held in the first state storage circuit with the comparison value, and selects the first state storage circuit as the state storage circuit when the two match, and selects the second state storage circuit as the state storage circuit when the two do not match. In the connection number measuring device according to claim 4,
The number-of-connection measuring device, wherein the search key generation unit generates first and second search keys corresponding to the first and second state storage circuits by dividing a bit string forming the hash value into two or more, and generates the comparison value from a portion of the bit string other than the first search key. a plurality of state storage circuits configured to hold a state value indicating a state of a connection of a received packet and a reference value for identifying the connection; and a controller configured to detect the state of a target connection, which is the connection of the received packet, by referring to the state value and the reference value held in the plurality of state storage circuits based on the field value and the state control information obtained from the header of the received packet,
The control device is
a selection unit configured to select, from among the plurality of state storage circuits, a state storage circuit holding a state value related to the target connection based on the reference value held in each state storage circuit;
a state determination unit configured to detect the state of the target connection by determining the next state of the target connection based on the state control information obtained from the received packet and the state value held in the state storage circuit selected by the selection unit;
a state update unit configured to update contents held in the plurality of state storage circuits based on the next state of the target connection obtained by the state determination unit. A connection state detection method for use in a connection state detection device, comprising: a plurality of state storage circuits configured to hold a state value indicating a connection state of a received packet and a reference value for identifying the connection; and a controller configured to detect the state of a target connection, which is the connection of the received packet, by referring to the state value and the reference value held in the plurality of state storage circuits based on field values and state control information obtained from a header of the received packet, and output the obtained detection result. so,
a selection step, wherein the control device is configured to select, from among the plurality of state storage circuits, a state storage circuit that holds a state value related to the target connection based on the reference value held in each state storage circuit;
a state determination step configured to detect the state of the target connection by the control device determining the next state of the target connection based on the state control information acquired from the received packet and the state value held in the state storage circuit selected in the selection step;
A connection state detection method, wherein the control device is configured to update contents held in the plurality of state storage circuits based on the next state of the target connection obtained in the state determination step. A connection number measuring program for causing a computer to function as each part constituting the connection number measuring device according to any one of claims 1 to 5.

Images