KR101589616B1 - First tunnel apparatus and second tunnel apparatus constituting network tunnel, and method for forwarding verification packet thereby - Google Patents

Abstract

The present invention relates to a method for forwarding a verification packet by a first tunnel apparatus and a second tunnel apparatus constituting a network tunnel, in an environment where a network test is carried out by a header space analysis (HSA) technique. According to an embodiment of the present invention, the method for forwarding a verification packet comprises the following steps of: allowing the first tunnel apparatus to receive a verification packet and a test message for the test of a network from a first external apparatus; allowing the first tunnel apparatus to accumulate, in the test message, identification information of the network tunnel and a depth value of the verification packet in the network and to record the same; allowing the first tunnel apparatus to transmit the test message and the verification packet to a different tunnel apparatus or the second tunnel apparatus; allowing the second tunnel apparatus to accumulate information, which has been recorded in the test message by the first external apparatus, in the test message received from the first tunnel apparatus or the different tunnel apparatus, and to record the same; and allowing a second network apparatus to transmit the test message to a second external apparatus.

Description

TECHNICAL FIELD [0001] The present invention relates to a first tunnel device and a second tunnel device constituting a network tunnel, and a verification packet transmission method using the same. BACKGROUND OF THE INVENTION 1. Field of the Invention [0002]

The present invention relates to a first tunnel device and a second tunnel device constituting a network tunnel, and a verification packet delivery method therefor. More particularly, the present invention relates to a first tunnel device and a second tunnel device for determining a reachability of a packet, and a method of transmitting a verification packet by the first tunnel device and the second tunnel device.

As networks grow in size today, network administrators are burdened with managing various types of network equipment. As the size of the network grows, the network environment becomes fragile, and hosts become isolated or unable to communicate with each other.

In order to facilitate the management of the network, a software defined network (SDN) and an HSA (header space analysis) method for inspection of a general network are used. HSA is a method for confirming whether any packet can reach network equipment (that is, reachability). For example, "HSA" Labs, and Nick McKeown (Stanford University). The content of "Header Space Analysis: Static Checking For Networks" is incorporated herein by reference.

In a typical HSA, the central server knows the pattern processing rules of all the network devices, and determines the packet reachability using known pattern processing rules. However, this approach can place an excessive load on the central server, and may not be suitable in an SDN environment where pattern processing rules may change frequently.

Also, depending on the network, there may be a network tunnel inside the network. In this case, there is a problem that it is not easy for the central server to determine the reachability of the packet.

A first tunnel device and a second tunnel device constituting a network tunnel according to an embodiment of the present invention and a verification packet delivery method by the first tunnel device and the second tunnel device are intended to reduce the load of the central server due to network inspection.

In addition, the first tunnel equipment and the second tunnel equipment constituting the network tunnel according to the embodiment of the present invention, and the verification packet delivery method by the same, are intended to accurately perform the network inspection even if the pattern processing rule of the network equipment is changed. .

The first tunnel device and the second tunnel device constituting the network tunnel according to the embodiment of the present invention and the verification packet delivery method by the same are intended to accurately check the network even in the presence of a network tunnel in the network .

A verification packet delivery method according to an embodiment of the present invention includes:

A method for transmitting a verification packet by a first tunnel device and a second tunnel device constituting a network tunnel in an environment where a network inspection is performed according to a header space analysis (HSA) technique, the method comprising: Receiving a verification packet and an inspection message for inspection of the network; The first tunnel device accumulating the identification information of the network tunnel and the depth value of the verification packet in the network in the check message; The first tunnel device transmitting the inspection message and the verification packet to another tunnel device or the second tunnel device; Accumulating and recording information recorded in the inspection message by the first external equipment in an inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment; And transmitting the inspection message to the second external equipment by the second network equipment.

Wherein the step of accumulating and storing the identification information of the network tunnel and the depth value of the verification packet in the inspection message of the first tunnel equipment comprises the steps of: And accumulating and recording information related to the information.

Wherein the inspection message received by the first tunnel device includes at least one of a spatial information of a header recorded in the inspection message by the first external equipment and a header information of the first external equipment when the verification packet is transmitted from the first external equipment to the first tunnel information And may include path information.

Wherein the step of accumulating and recording the identification information of the network tunnel and the depth value of the verification packet in the inspection message of the first tunnel equipment comprises the step of verifying the verification of the network equipment by the first tunnel equipment or the second tunnel equipment The path information of the verification packet when the packet is transmitted, and the spatial information of the header after the verification packet is processed by the first tunnel device, in an inspection message.

The step of accumulating and recording the information recorded in the inspection message by the first external equipment in the inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment comprises the steps of: Accumulating and recording spatial information of a header recorded in the inspection message by the first external equipment in the inspection message; And accumulating and recording path information when the second tunnel equipment transmits the inspection message to the second external equipment in the inspection message.

Wherein the step of accumulating the identification information of the network tunnel and the depth value of the verification packet in the inspection message by the first tunnel equipment comprises the steps of: And accumulating the added depth value and recording the accumulated depth value in the inspection message.

The step of cumulatively recording the information recorded in the inspection message by the first external equipment in the inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment comprises the steps of: Subtracting the depth value of the verification packet recorded in the inspection message, and accumulating and recording the subtracted depth value in the inspection message.

The first external equipment, the first tunnel equipment, the second tunnel equipment, and the second external equipment may constitute the same network.

In a tunnel system according to another embodiment of the present invention,

1. A tunnel system for configuring a network tunnel in an environment in which a network inspection is performed according to a header space analysis (HSA) technique, comprising: receiving a verification packet from the first external equipment and an inspection message for inspection of the network; A first tunnel device for accumulating identification information of the network tunnel and a depth value of the verification packet in the network and transmitting the inspection message and the verification packet to another tunnel device; And a second tunnel device for accumulating information recorded in the inspection message by the first external device in an inspection message received from the other tunnel device and transmitting the inspection message to a second external device have.

The central server according to an embodiment of the present invention and the network inspection method and the network equipment and the verification packet delivery method according to the present invention can reduce the load of the central server due to the network inspection.

Also, the central server and the network inspection method, and the network equipment and the verification packet delivery method according to an embodiment of the present invention can accurately perform the network inspection even if the pattern processing rules of the network equipment are changed.

In addition, the first tunnel device and the second tunnel device constituting the network tunnel according to an embodiment of the present invention, and the verification packet delivery method using the first tunnel device and the second tunnel device can precisely perform the network check even when a network tunnel exists in the network .

1 is a diagram illustrating a network environment including a central server and a plurality of network devices according to an embodiment of the present invention.
2 is a diagram for explaining a general HSA method.
3 is a flowchart illustrating a network testing method according to an embodiment of the present invention.
4 is a view for explaining an inspection message transmitted through a plurality of network devices according to an embodiment of the present invention.
5 is a flowchart illustrating a verification packet delivery method according to another embodiment of the present invention.
6 is a flowchart illustrating a verification packet delivery method according to another embodiment of the present invention.
7 is a view for explaining an inspection message according to another embodiment of the present invention.
8 (a) to 8 (c) are diagrams showing the configuration of an exemplary tunnel included in a network.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

The term " part " used in this embodiment means a hardware component such as software, FPGA, or ASIC, and 'part' performs certain roles. However, 'minus' is not limited to software or hardware. The " part " may be configured to reside on an addressable storage medium and may be configured to play back one or more processors. Thus, by way of example, and by no means, the terms " component " or " component " means any combination of components, such as software components, object- oriented software components, class components and task components, Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functions provided in the components and parts may be combined into a smaller number of components and parts or further separated into additional components and parts.

1 is a diagram illustrating a network environment including a central server 100 and a plurality of network devices 200 according to an embodiment of the present invention.

The central server 100 checks the status of a network including a plurality of network devices 200 and can be controlled by a network administrator. The central server 100 can communicate with each of a plurality of network devices 200.

The plurality of network devices 200 are middle boxes for processing received packets. The network device 200 may include a router, a firewall, a network address translator (NAT) . ≪ / RTI > The network equipment 200 processes the received packet according to a predetermined packet processing rule. For example, the router forwards a packet to another network device 200 through a port determined according to the analysis result of the header of the received packet. The firewall also analyzes the header of the received packet to determine whether to block the received packet or forward it to another network device 200.

2 is a diagram for explaining a general HSA method.

In a general HSA scheme, a central server (not shown) first defines a space of {0, 1} ^L (L is a header length of a verification packet) (hereinafter referred to as a header space). The header space may refer to a set of bit strings arranged by 0 or 1 L's. The header of any validation packet may be mapped to a point or region of the header space. Information about a point or an area mapped to the header space is called spatial information of the header.

The central server defines each packet processing rule of the various network equipments as a transform function Ti (h, p). The spatial information of the header can be changed according to the conversion function of each network equipment.

Referring to FIG. 2, in order to check which type of packet can reach from the S network equipment to the D network equipment, the central server sets a header having 8 x values, which can be either 0 or 1, To the conversion function of FIG. Since x can be either 0 or 1, the header that the central server applies to the conversion function of the M1 network equipment can be mapped to all spaces in the header space. For example, when the header is 8 bits, the x-axis corresponds to the first 4 bits of 8 bits from 0000 to 1111, and the x- and the y-axis may correspond to 0000 to 1111 corresponding to the last four bits of the 8 bits.

The header changes spatial information by the transformation function of each network equipment. If we look at the spatial information of the header processed by the conversion function of D network equipment, we can see that D network equipment can receive 11001xx0 and 101111x1 headers from S network equipment. In addition, the central server may check whether any header can reach the M1 network equipment or the M5 network equipment through the conversion function of the M1 network equipment or the M5 network equipment.

The central server can check the reachability, forwarding loops, traffic isolation, and leakage problems of arbitrary packets through the HSA technique.

As described above, in a general HSA, a central server stores pattern processing rules of all network equipment, and determines the reachability of a packet using stored pattern processing rules. However, this approach can place an excessive load on the central server. In addition, when the pattern processing rule of the network equipment is changed after the pattern processing rule of the network equipment is stored in the central server, the changed pattern processing rule can not be reflected quickly.

3 is a flowchart illustrating a network testing method according to an embodiment of the present invention.

In step S310, the central server 100 transmits a request command for the inspection of the network to the first network equipment so that the first network equipment included in the network can transmit the verification packet and the inspection message including the header to the next network equipment. send. Herein, the verification packet means a packet transmitted from each network device 200 to each other in order to inspect the network according to the HSA scheme according to the present invention.

The first network device receiving the request command transmits the verification packet and the inspection message to the next network equipment. The central server 100 according to an embodiment of the present invention does not need to store the pattern processing rules of each of the plurality of network devices 200 in advance and instead the first network device 200a is the next network device To send an inspection message. Here, the first network equipment 200a refers to the network equipment 200 that receives the request command transmitted from the central server 100 for the first time.

The first network device 200a records information related to a packet processing rule of the first network device 200a in an inspection message and then transmits the information to the next network device 200. [

In step S320, the central server 100 transmits a verification message from the second network device 200b, which has received the verification packet and the inspection message, via the first network device 200a among the plurality of network devices 200 . Here, the second network device 200b refers to the network device 200 that has finally received the verification packet and the inspection message transmitted by the first network device 200a.

The second network device 200b records information related to a packet processing rule of the second network device 200b in an inspection message, and then transmits the information to the central server 100. [

In step S330, the central server 100 determines the reachability of a packet to any of the plurality of network devices 200 based on the check message received from the second network device 200b You can decide. After the first central server 100 sends a request command to the first network equipment 200a the inspection message is transmitted by the first network equipment 200a, the intermediate network equipment 200 and the second network equipment 200b, respectively Since the information related to the packet processing rules is cumulatively recorded, the central server 100 can determine the reachability of a packet through an inspection message received from the second network equipment 200b. In the present specification, the predetermined information is accumulated in the inspection message, which means that predetermined information is recorded in the inspection message in addition to the information previously recorded in the inspection message.

The central server 100 and the network inspection method according to an embodiment of the present invention can perform distributed processing of the central server 100 and the network devices 200 instead of the central processing method of the central server 100, The load of the central server 100 can be reduced and the packet processing rules of the network equipment 200 changed in real time can be accurately reflected.

 Hereinafter, an inspection message transmitted through the network equipment 200 will be described in detail with reference to FIG.

4 is a view for explaining an inspection message 400 transmitted through a plurality of network equipments (S, M1 to M4) according to an embodiment of the present invention.

The inspection message 400 transmitted by the S network equipment receiving the request command from the central server may include the request message 410, the spatial information of the header, and the path information of the verification packet. The spatial information of the header means information on a space in which the header is mapped. The path information of the verification packet means information on which port the verification packet is transmitted to which network device.

4, since the verification packet is transmitted to the M1 network equipment through the Ps / 1 port of the S network equipment and the P1 / 1 port of the M1 network equipment, the S network equipment transmits Ps / 1 and P1 / 1 is cumulatively recorded.

The request message 410 causes the network device that has received the check message 400 to transmit the path information when the verification packet is delivered to the next network device and the space information of the header after the verification packet is processed, ). Each network equipment can accumulate and record the route information and the space information only when the check message 400 includes the request message 410. [

Since the header of the verification packet transmitted to the M1 network equipment has been changed to B by the M1 network equipment and transferred to the M2 network equipment through the P1 / 2 port of the M1 network equipment and the P2 / 1 port of the M2 network equipment, The M1 network equipment can record [B, P1 / 2] and [B, P2 / 1] in the inspection message 400 as spatial information and path information. As shown in FIG. 4, each of the M2 network equipment and the M3 network equipment can accumulate the spatial information and the path information of the header in the inspection message (400).

After receiving the verification packet and the inspection message 400, if there is no network device to transmit the verification packet and the inspection message 400, the M4 network device records only the space information of the header in the inspection message 400 and transmits the inspection message 400 to the central server . The M4 network equipment may send the inspection message 400 to the central server over a separate connection line.

Since the spatial information of the header and the path information of the verification packet reflect the packet processing rules of each network equipment, the central server can determine the reachability of an arbitrary packet through the inspection message 400 received from the M4 network equipment.

5 is a flowchart illustrating a verification packet delivery method according to another embodiment of the present invention.

In step S510, the network device 200 receives the verification message for checking the verification packet and the network from the previous network device 200. [ The inspection message received by the network device 200 may include spatial information to which a header of the verification packet in the header space is mapped.

In step S520, the network device 200 processes the verification packet according to the packet processing rule of the network device 200. [

In step S530, the network device 200 records information related to a packet processing rule in an inspection message. As described above, the information related to the packet processing rule includes information on the space of the header after the verification packet is processed by the network device 200, and information on the transmission of the verification packet to the next network device 200 And may include path information.

The network device 200 may check whether the request message is included in the check message before updating the check message and may update the check message only when the request message is included in the check message.

In step S540, the network equipment 200 delivers the processed verification packet and the updated inspection message to the central server 100 or the next network equipment 200. [

On the other hand, depending on the network, a network tunnel may exist inside the network. The network tunnel may include a first tunnel device at a point where the tunnel starts and a second tunnel device at a point where the tunnel ends. The first tunnel device and the second tunnel device may correspond to any one of the plurality of network devices 200 and one network device 200. [

The first tunnel device encapsulates a header of a packet received from the first external device and transmits the encapsulated header to another tunnel device or a second tunnel device in the tunnel. Here, the first external equipment may refer to the network equipment 200 located outside the tunnel.

The second tunnel device decapsulates the header of the packet received from the other tunnel device or the first tunnel device and transmits a packet including the original header transmitted from the first external device to the first tunnel device, To external equipment. The header transmitted from the first external equipment to the first tunnel equipment is encapsulated by the first tunnel equipment and then decapsulated by the second tunnel equipment so that the header transmitted from the first external equipment to the first tunnel equipment The headers transmitted by the second tunnel equipment to the second external equipment are the same. Here, the second external equipment may refer to the network equipment 200 located outside the tunnel.

The network tunnel may include, for example, a tunnel for encrypting the header, a tunnel to which a different protocol (e.g., IPv4) is applied than a protocol applied to the network (e.g., IPv6).

Since the header encapsulated by the first tunnel device is located in the payload of the packet, the second tunnel device can not confirm the spatial information of the header, and the second tunnel device can record the relevant information in the inspection message There is a problem. Therefore, if there is a tunnel in the network, additional information for the second tunnel equipment should be included in the inspection message.

6 is a flowchart illustrating a verification packet delivery method according to another embodiment of the present invention.

In step S610, the first tunnel device receives a verification message for checking the verification packet and the network from the first external device. As described above, the inspection message may include spatial information of the header recorded in the inspection message by the first external equipment, and path information when the verification packet is transferred from the first external equipment to the first tunnel information.

In step S620, the first tunnel device accumulates the identification information of the network tunnel and the depth value of the verification packet in the network, and records the accumulated value in the inspection message. Unlike the embodiment described with reference to FIG. 4, if there is a network tunnel in the network, the identification information of the network tunnel and the depth value of the verification packet may be further recorded in the inspection message. The first tunnel device can know the identification information of the tunnel in advance, and the depth value of the verification packet can be determined at a certain depth in the network, for example, outside the tunnel, in the tunnel, Position. A method for the first tunnel device to record the depth value of the verification packet in the inspection message will be described later with reference to FIG.

Also, the first tunnel device can accumulate information related to the packet processing rule of the first tunnel device in an inspection message. Specifically, the first tunnel device transmits path information of the verification packet when the verification packet is transmitted to another tunnel device or the second tunnel device, and the space information of the header after the verification packet is processed by the first tunnel device to the inspection message Can be recorded in a cumulative manner.

In step S630, the first tunnel device transmits the inspection message and the verification packet to the other tunnel device or the second tunnel device.

In step S640, the second tunnel equipment accumulates information recorded in the inspection message by the first external equipment in the inspection message received from the first tunnel equipment or other tunnel equipment. As described above, since the second tunnel device can not confirm the spatial information of the header, the second tunnel device records the identification information identical to the identification information of the tunnel, which is previously known to the second tunnel device, by the first external device immediately before the first tunnel device The spatial information of the header can be accumulated and recorded in the inspection message. However, with respect to the path information of the verification packet, the path information when the verification packet is transmitted to the second external equipment can be recorded in the inspection message without referring to the path information recorded by the first external equipment.

In step S650, the second tunnel device transmits an inspection message to the second external equipment.

Hereinafter, an inspection message 700 that can be used when a tunnel 750 exists in the network will be described in detail with reference to FIG.

7 is a view for explaining an inspection message 700 according to another embodiment of the present invention.

7, the S network equipment is the first external equipment, the M1 network equipment 710 is the first tunnel equipment, the M2 network equipment is the other tunnel equipment, the M3 network equipment 730 is the second tunnel equipment, the M4 network equipment is And can correspond to the second external equipment. In addition to the spatial information of the header and the path information of the verification packet, the inspection message 700 shown in FIG. 7 may further include the identification information of the network tunnel and the depth value of the verification packet.

S network equipment records the spatial information A and the path information Ps / 1 and P1 / 1 of the header in the inspection message. The S network equipment is located outside the tunnel 750 and the verification packet is also located outside the tunnel 750 so that the S network equipment can record the identification information and the depth value of the tunnel 750 as zero.

The M 1 network equipment 710 receiving the verification packet and the inspection message 700 from the S network equipment records the spatial information and the routing information of the header and additionally records N 1 which is the identification information of the network tunnel 750, A value of 1 can be recorded. The M1 network equipment 710 may add the depth value of the verification packet recorded in the inspection message 700 by the S network equipment and write the added depth value into the inspection message 700. [ The M1 network equipment 710 records 1 as the depth value of the verification packet so that the central server (not shown) can confirm that the tunnel 750 has been started from the M1 network equipment 710. [ If another tunnel is started before the tunnel 750 containing the M1 network equipment 710 is started, the network equipment located at the point where the other tunnel starts is 2 (10 in binary number) as the depth value of the verification packet. ).

The M2 network equipment accumulates the space information of the header and the path information of the verification packet in the inspection message 700. Since the M2 network equipment and the M1 network equipment 710 are located in the same tunnel 750, the M2 network equipment accumulates and records the identification information N1 and the depth value 1 of the tunnel 750 in the inspection message 700.

The M3 network equipment 730 confirms the M1 network equipment 710 in which the identification information identical to the identification information of the tunnel 750 that the M3 network equipment 730 knows in advance in the inspection message 700 is located before the M1 network equipment 710 S network equipment accumulates and records the space information of the header recorded in the inspection message 700 in the inspection message 700. 7, it can be seen that the A recorded by the S network equipment in the inspection message 700 is rewritten by the M3 network equipment 730. The M3 network equipment 730 records the path information at the time of transmitting the verification packet to the M4 network equipment and records the identification information of the tunnel as 0 since the tunnel 750 has been last terminated. The M3 network equipment 730 subtracts the depth value of the verification packet recorded in the inspection message 700 by the M1 network equipment 710 and accumulates the subtracted depth value 0 in the inspection message 700 do.

After receiving the verification packet and the inspection message 700, if there is no network equipment to transmit the verification packet and the inspection message 700, the M4 network equipment records only the space information of the header in the inspection message 700 and transmits the inspection message 700 to the central server .

The central server 100 can confirm the reachability of an arbitrary packet even when a tunnel exists through the inspection message 700 received from the M4 network equipment.

Also, the central server 100 can check whether the tunnel is configured properly through the inspection message 700 received from the M4 network equipment. This will be described with reference to FIGS. 8 (a) to 8 (c) Explain.

8 (a) to 8 (c) are diagrams showing the configuration of an exemplary tunnel included in a network.

8A shows a case where the M1 network equipment as the first tunnel equipment and the M5 network equipment as the second tunnel equipment constitute a tunnel having the same identification information. In this case, the M5 network equipment is the same as the M1 network equipment As the space information of the header to be recorded in the inspection message, spatial information of the header recorded by the S network equipment can be accumulated and recorded in the inspection information because it has the identification information of the tunnel.

8B shows a case where the M1 network equipment and the M5 network equipment have identification information of a tunnel different from each other. Since the M5 network equipment does not record the identification information of the tunnel that the M5 network equipment knows in the received inspection message, Can not be recorded in the inspection message. Accordingly, the central server 100 can check the configuration of the tunnel by viewing the identification information of the tunnel recorded in the inspection message by the M1 network equipment and the identification information of the tunnel recorded in the inspection message by the M5 network equipment.

8C shows a case where only the M1 network equipment as the first tunnel equipment exists in the network, and the central server 100 transmits, through the depth information of the packet recorded in the inspection message and the identification information of the tunnel, You can see that the tunnel has been started from the equipment but the tunnel has not ended.

The first tunnel equipment and the second tunnel equipment constituting the network tunnel according to an embodiment of the present invention and the verification packet delivery method thereby can reduce the load of the central server due to the network inspection, Even if the rule changes, the network scan can be performed correctly. In addition, even if there is a network tunnel in the network, the network check can be accurately performed.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The computer readable recording medium may be a magnetic storage medium such as a ROM, a floppy disk, a hard disk, etc., an optical reading medium such as a CD-ROM or a DVD and a carrier wave such as the Internet Lt; / RTI > transmission).

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It will be understood. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

100: central server
200: Network equipment
710: First tunnel equipment
730: Second tunnel equipment

Claims (9)

A method for transmitting a verification packet by a first tunnel device and a second tunnel device constituting a network tunnel in an environment in which a network inspection is performed according to a header space analysis (HSA)
The first tunnel device receiving a verification message from the first external device and an inspection message for inspection of the network;
The first tunnel device accumulating the identification information of the network tunnel and the depth value of the verification packet in the network in the check message;
The first tunnel device transmitting the inspection message and the verification packet to another tunnel device or the second tunnel device;
Accumulating and recording information recorded in the inspection message by the first external equipment in an inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment; And
And transmitting the verification message to a second external device by the second network device.
The method according to claim 1,
Wherein the first tunnel device accumulates the identification information of the network tunnel and the depth value of the verification packet in the check message,
And accumulating and recording information related to a packet processing rule of the first tunnel equipment in the inspection message by the first tunnel equipment.
The method according to claim 1,
Wherein the inspection message received by the first tunnel device comprises:
Wherein the verification information includes path information of a header recorded in the inspection message by the first external equipment and path information when the verification packet is transferred from the first external equipment to the first tunnel information. Way.
The method of claim 3,
Wherein the first tunnel device accumulates the identification information of the network tunnel and the depth value of the verification packet in the check message,
The path information of the verification packet when the first tunnel device transfers the verification packet to the other tunnel device or the second tunnel device and the space information of the header after the verification packet is processed by the first tunnel device And accumulating the verification message in the verification message.
The method of claim 3,
The step of accumulating and recording the information recorded in the inspection message by the first external equipment in the inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment comprises the steps of:
Accumulating and recording the spatial information of the header recorded in the inspection message in the inspection message by the second external equipment by the second tunnel equipment; And
And accumulating and recording path information when the second tunnel equipment transmits the inspection message to the second external equipment in the inspection message.
The method according to claim 1,
Wherein the first tunnel device accumulates the identification information of the network tunnel and the depth value of the verification packet in the check message,
And adding the depth value of the verification packet recorded in the inspection message by the first external equipment and accumulating the added depth value in the inspection message.
The method according to claim 6,
The step of accumulating and recording the information recorded in the inspection message by the first external equipment in the inspection message received from the first tunnel equipment or the other tunnel equipment by the second tunnel equipment comprises the steps of:
And subtracting the depth value of the verification packet recorded in the inspection message by the first tunnel device, and accumulating and recording the subtracted depth value in the inspection message.
The method according to claim 1,
Wherein the first external equipment, the first tunnel equipment, the second tunnel equipment, and the second external equipment constitute the same network.
In a tunnel system constituting a network tunnel in an environment where a network inspection is performed according to a header space analysis (HSA) technique,
Receiving a verification packet from the first external equipment and an inspection message for inspection of the network, accumulating the identification information of the network tunnel and the depth value of the verification packet in the network in the inspection message, And a first tunnel device for transmitting the verification packet to another tunnel device; And
And a second tunnel equipment for accumulating information recorded in the inspection message by the first external equipment in an inspection message received from the other tunnel equipment and transmitting the inspection message to a second external equipment .

Images