JP2002084278A - Traffic analysis method for each route - Google Patents

Abstract

(57) [Summary] [Problem] To analyze traffic for each route. A destination-specific statistical information collection program monitors packets flowing on a line to collect destination-specific statistical information, and extracts a destination list from the collected statistical information. The route analysis program 13 performs a route search for a useful destination based on the destination list, creates a route diagram from the route search results, and derives statistical information for each route from the route diagram and destination-specific statistical information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for collecting and analyzing statistical information for each communication path, and more particularly to an Internet service provider (hereinafter referred to as ISP).
Provider: Internet service provider or equipment)
) Is useful for the operation of the network. The statistical information for each route includes a traffic amount (such as the number of IP bytes and TCP bytes), quality (such as a retransmission rate and throughput), and route stability. The operation of the network includes the determination of a routing policy and the change of routing when a failure occurs.

[0002]

2. Description of the Related Art The following (1) to (3) show conventional techniques. (1) The quality measurement for each route has been performed by a method of actively transmitting a packet from a measuring terminal to a server of each route. However, this prior art (1) cannot measure the traffic volume. Further, in order to perform strict quality measurement, it is necessary to transmit a large number of packets, so that the load on the network increases. (2) As tools having the function of collecting traffic for each destination (IP address), there are analysis tools called Cisco's Netflow and protocol analyzers called Sniffer. However, in the prior art (2), these tools can collect only the traffic amount, and cannot collect information on quality such as retransmission amount and throughput, and information on path stability. In addition, in order to collect such information on quality, it is necessary to collect packets and manage the state transition of the TCP connection inside the measuring terminal. However, the above tools do not have these functions. Further, it is not possible to simply derive information for each route from information for each IP address. (3) As a tool for examining a route for each destination, there is software called a traceroute for dynamically examining a packet route. However, in the prior art (3),
No mechanism is provided to select the traceroute destination. It is not known that the conventional technology (2) and the conventional technology (3) are combined, but even if they are combined, in order to reduce the load on the network, the destination of the trace route is limited. There is a need.

[0003]

SUMMARY OF THE INVENTION An object of the present invention is to provide a traffic analysis method for each route which solves the above-mentioned problems of the prior art.

[0004]

According to a first aspect of the present invention, there is provided a traffic analysis method for each route, wherein statistical information for each route is derived based on a route diagram and statistical information for each destination. In the invention according to claim 2, in claim 1, a plurality of useful destinations are selected from the destination-specific statistical information, a route search is performed for the selected destination, and the route diagram is derived from a plurality of obtained route search results. This is a traffic analysis method for each route.

The invention according to claim 3 is characterized in that, in claim 2, the number of useful destinations is smaller than the number of destinations corresponding to the destination-specific statistical information. The invention according to claim 4 is characterized in that, in claim 2, as the useful destination, a plurality of top destinations having a large traffic amount or a plurality of top destinations having a low quality are selected from the statistical information for each destination. I do. The invention according to claim 5 is the invention according to claim 2, wherein one of the sets of destinations having the same route is one of them.
A route search is performed for only one destination. The invention according to claim 6 is characterized in that, in claim 2, a route search for the destination is performed by sequentially changing the value of the TTL field of the IP header portion of the UDP packet and transmitting the UDP packet to the destination.

According to a seventh aspect of the present invention, in the first aspect, there is provided a communication system in which an Internet service provider uses
Point, one on the line between internet service providers
The statistical information for each destination is collected by monitoring a packet flowing on the line at one of the points and one point on the line within the user. In the invention according to claim 8, in claim 1, the statistical information for each route is:
At least one of traffic volume, quality and route stability
It is a seed.

[0007]

Embodiments of the present invention will be described below with reference to the drawings.

In FIG. 1, when a user 1 accesses servers 8, 9, and 10 on the Internet from an ISP 2 to which the user belongs, various ISs are provided on a route after the ISP 2.
There are P3, 4, 5, 6, and 7. In the example of FIG. 1, the route to the server 8 is ISP3 → ISP4 → ISP5 → server 8, and the route to the server 9 is ISP3 → ISP4 → I
SP6 → server 9 and the route to server 9 is ISP3
→ ISP 7 → server 10.

Therefore, in this example, in order to determine the routing policy or change the routing at the time of failure, the ISP 2 sets one point on the line between the ISP 2 and the ISP 3 as the monitoring point 11 and sets the traffic amount (IP byte Number or T
The description will be made assuming that the number of CP bytes), the quality (retransmission rate, throughput, etc.) of each path, or the path stability of each path are analyzed.

In this embodiment, it is assumed that traffic analysis for each route is performed by a computer and computer software operating on the computer. Therefore, as shown in FIG. 2, a destination-specific statistical information collection program 12 and a route analysis program 13 are used as computer software. The destination-specific statistical information collection program 12 has a collection function 12a and an analysis function 12b. The route analysis program 13 includes a search destination management function 13a and a route search function 13a.
b, a route map management function 13c, and a route-specific traffic analysis function 13d. The computer includes a storage unit 14 for storing statistical information for each destination, a storage unit 15 for storing a destination list, a storage unit 16 for storing a route map, and a storage unit 17 for storing statistical information for each route.

The collection function 12 a of the destination-specific statistical information collecting program 12 monitors packets flowing on the line at the monitoring point 11, collects statistical information for each destination, and stores it in the storage unit 14. For example, traffic for each destination IP address of a packet is collected for each destination. Here, the destination is the originating IP
Address or destination IP address.

The analysis function 12b of the destination-specific statistical information collection program 12 analyzes useful (periodical or irregular) statistical information for each destination collected by the collection function 12a according to the purpose (sorting, filtering, etc.), thereby providing a useful plurality of useful information. A destination list including the destinations is created and stored in the storage unit 15. For example, the destinations are rearranged in descending order of the traffic amount (the number of IP bytes or the number of TCP bytes), and only the top n destinations in which the traffic amount is large are selected, or the destinations are arranged in the descending order of the quality (retransmission rate or throughput). In other words, only the top n destinations with poor quality are selected and extracted as a destination list. Here, n is plural, but its value is adjusted according to the allowable amount of the route search traffic at the monitoring point 11. In other words, as the number of destinations increases, more and more accurate route-specific traffic can be obtained, but the route search traffic increases.

When only a destination having a large traffic volume is selected, a traffic analysis is performed on a route that is frequently used by the user. Therefore, a more accurate route analysis result is obtained for a route that is actually used more often.

[0014] On the other hand, when only destinations of poor quality are selected, information on the traffic volume, quality, and route stability in a route that is deteriorating the quality of the user can be analyzed in more detail. In addition, it is possible to estimate a problem in a specific route such as a line having a narrower band than the traffic amount.

The search destination management function 13a of the route analysis program 13 not only performs the search based on the destination list stored in the storage unit 15 but also executes the destination search based on the route diagram stored in the storage unit 16. To determine. The destination is determined according to the following policy. From a set (server group) of (servers) having the same route, only one destination (server) is selected. The management of the servers included in the server group is performed by the route diagram management function 13b.

The route search function 1 of the route analysis program 13
3b executes a route search for a plurality of destinations and manages a state until the search is completed. Trace route for route search
Use the same method as (traceroute). Specifically, the route search for each destination is executed in the following procedures (1) to (10). (1) At first, the value of a TTL (time to live) field of an IP packet is set to 1, and a UDP (User Datagram Protocol) packet is transmitted. Note that the default value of the TTL field is 32. (2) The router that relays the packet sets the TTL field to 1
cut back. At this time, if the TTL field is larger than 0, the next hop is checked by referring to the routing table managed by the router. (3) If the next hop is a router, relay to that router. If the next hop is the host, that is, the final destination, forward the UDP packet to that destination. (4) If the TTL field becomes 0, it is determined that relaying is not possible, and a router having the TTL field set to 0 sends an ICMP (Internet Control Message Protocol) which is a type of error packet to the source. Of time exceeded packets are sent. (5) From the final destination, an ICMP port unreachable packet is transmitted. This is because the UDP packet used in the trace route is
This is because a port number not normally supported by the terminal is used. (6) The value of the TTl field is 0 before reaching the final destination.
If it becomes TTL, return to the above procedure (1)
Is increased by 1 and the UDP packet is transmitted again from the source. (7) The above steps (1) to (6) are repeated until the UDP packet reaches the final destination. (8) By the above procedures (1) to (7), as shown in FIG.
Router 1 from source ISP 2 to destination server 10
Routes 8, 19 and 20 are known. (9) Therefore, a domain search is performed for each of the routers 18, 19, and 20 on the route by using a DNS (Domain Name System), and a domain for managing each of the routers 18, 19, and 20 is examined. That is, each router 18, 19, 2
The respective domain names are searched from the IP address 0. As a domain, a domain that relays between domains and a domain that does not relay are distinguished. These distinctions are made by domain identification. Here, the domain that performs the relay is called an ISP. Generally, .com is the server, .n
et is an ISP. (10) If the same domain exists on the route, they are aggregated. In the example shown in FIG. 4, the router 18 and the router 1
Since 9 is the same domain name as aaa.net, it can be determined that it is a router in the same domain, and it becomes one domain (ISP 3 in FIG. 1). The router 20 corresponds to the ISP 7. If there are domains that do not relay, they are aggregated as the final destination.

The route map management function 13c of the route analysis program 13 creates a route map based on the search results for a plurality of destinations obtained by the route search function 13b, and stores the route map in the storage unit 16.
To accumulate. At this time, a plurality of servers on the same route
Aggregate as a server group. As information of the server group, I
It manages a list of subnet IDs obtained by accumulating P addresses and IP addresses. The route map shows the monitoring point 11
An ISP route (ISP connection) from (one point on a line within an ISP, between ISPs, or within a user) to a plurality of destinations is configured on a tree. FIG. 2 is a path diagram including an ISP tree as shown in FIG. 1. Further, a plurality of destinations are arranged on the list at the end of the tree in the route diagram, that is, at the final destination.

The route-specific traffic analysis function 13d of the route analysis program 13 uses the destination-specific statistical information stored in the storage unit 14 and the route diagram stored in the storage unit 16 to reassemble the statistical information from destinations to destinations. Thus, the statistical information for each route is derived and stored in the storage unit 17.

As for the route stability, since the route is not always stable, the route search is performed for the same destination at different times, and the variation of the route search is monitored to determine the route stability. Path stability can be collected.

In this example, the monitoring point 11 is one point on the line within the Internet service provider, but it can be one point on the line between Internet service providers or one point on the line within the user. .

As described above, the traffic information can be analyzed for each route by deriving the statistical information for each route based on the route diagram and the statistical information for each destination. The route diagram can be derived from a plurality of route search results obtained by selecting a plurality of destinations from the statistical information for each destination and performing a route search for the selected destination. In this case, by selecting only useful destinations for performing the route search, it is possible to perform a route search that is practically sufficient for the traffic analysis for each route, and to reduce the load imposed on the network by the route search traffic. it can. Therefore, usually, the number of useful destinations is made smaller than the destinations corresponding to the destination-specific statistical information. In particular, as useful destinations, a plurality of top destinations with a large traffic volume from statistical information for each destination,
Alternatively, by selecting a plurality of destinations having poor quality, it is possible to perform a practically sufficient route-specific traffic analysis. Further, for a set of destinations having the same route, by performing a route search for only one of the destinations, it is possible to reduce the load imposed on the network by the route search traffic. Any route search tool can be used for route search.
A trace route (t) in which the value of the TL field is sequentially changed and transmitted to the destination to perform a route search for the destination.
By using the same method as that of (raceroute), a route search can be easily performed. Furthermore, at least one of traffic volume, quality, and route stability can be targeted as route-specific statistical information analyzed in the present invention. The traffic amount includes the number of IP bytes and the number of TCP bytes, and the quality includes the retransmission rate and the throughput.

A description will be given of an apparatus configuration for realizing the above-described statistical traffic analysis method of the present embodiment. The statistical traffic analyzing apparatus includes a computer and a destination statistical information collection program 12 in addition to various storage units 14 to 17. It has a destination-specific statistical information collection device that is realized, and a route analysis device that is realized by a computer and a route analysis program 13. The destination-specific statistical information collection device has a collection function unit and an analysis function unit, and the route analysis device has a search destination management function unit,
It has a route search function unit, a route map management function unit, and a traffic analysis function unit for each route.

As described above, the collecting function unit monitors the packets flowing on the line at the monitoring point 11, collects the statistical information for each destination, and stores the information in the storage unit 14, as described above. As described above, the analysis function unit periodically or irregularly analyzes (sorts, filters, etc.) the statistical information for each destination collected by the collection function unit according to the purpose, thereby forming a destination list including a plurality of useful destinations. Create and store 1
Store in 5

The search destination management function unit determines a destination to be searched for a route not only based on the destination list stored in the storage unit 15 but also based on the route diagram stored in the storage unit 16. The destination is determined according to the above-described policy. The management of the servers included in the server group is performed by the route diagram management function unit. The route search function unit executes the above-described procedures (1) to (10) using the same method as the trace route (traceroute), thereby executing a route search for a plurality of destinations, and performing a search until the search is completed. Manage state. The route map management function unit creates a route map based on search results for a plurality of destinations obtained by the route search function unit and stores the route map in the storage unit 16. At this time, a plurality of servers having the same route are aggregated as a server group as described above.
The traffic analysis function unit for each route uses the statistical information for each destination stored in the storage unit 14 and the route diagram stored in the storage unit 16 to rearrange the statistical information from the destination to the destination for each route. The information is derived and stored in the storage unit 17.

[0025]

As described above, the present invention has the following effects. (1) One point on a line in a certain ISP, one point on a line between ISPs, or one point on a line in a certain user
By monitoring at a point, it is possible to measure the traffic volume (such as the number of IP bytes and the number of TCP bytes), the quality (such as the retransmission rate and the throughput), and the route stability to the server group having the same packet route at the monitoring point. (2) In addition, by collecting such information for each path, it is possible to estimate the quality within a certain ISP or between specific ISPs. (3) Therefore, it is useful for network operations such as determining a routing policy and changing routing in the event of a failure.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a route map and information analyzed for each route as an embodiment of the present invention.

FIG. 2 is a diagram showing a configuration example of software for realizing a traffic analysis method for each route as an embodiment of the present invention.

FIG. 3 is a diagram showing an example of a route search as an embodiment of the present invention.

FIG. 4 is a diagram showing an example of aggregation of domains as an embodiment of the present invention.

[Explanation of symbols]

 Reference Signs List 1 user 2-7 ISP 8-10 server 11 monitoring point 12 destination-specific statistical information collection program 12a collection function 12b analysis function 13 route analysis program 13a search destination management function 13b route search function 13c route map management function 13d route-specific traffic analysis function 14 Statistical information storage unit by destination 15 Destination list storage unit 16 Route diagram storage unit 17 Statistical information storage unit by route 18, 19, 20 Router

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Koji Nakao 2-1-1-15 Ohara, Kamifukuoka-shi, Saitama F-term in Kaididi Laboratory Co., Ltd. 5K019 BB22 DB08 DC01 DC06 5K030 HA08 JA10 MB04 MB09 MC03 MC07

Claims (8)

[Claims] 1. A traffic analysis method for each route, wherein statistical information for each route is derived based on a route diagram and statistical information for each destination. 2. The method according to claim 1, wherein a plurality of useful destinations are selected from the destination-specific statistical information, a route is searched for the selected destination, and the route diagram is derived from a plurality of obtained route search results. Characteristic traffic analysis method for each route. 3. The traffic analysis method according to claim 2, wherein the number of useful destinations is smaller than the number of destinations corresponding to the destination-specific statistical information. 4. The route according to claim 2, wherein, as the useful destination, a plurality of top destinations having a large traffic volume or a plurality of top destinations having a low quality are selected from the statistical information for each destination. Traffic analysis method. 5. The traffic analysis method according to claim 2, wherein a set of destinations having the same route is searched for only one of the destinations. 6. The traffic analysis for each route according to claim 2, wherein a route search for the destination is performed by sequentially changing a value of a TTL field of an IP header portion of the UDP packet and transmitting the UDP packet to the destination. Method. 7. The method according to claim 1, wherein one of a point on the line within the Internet service provider, a point on the line between the Internet service providers, and a point on the line within the user. A route-specific traffic analysis method, wherein the destination statistical information is collected by monitoring a flowing packet. 8. The traffic analysis method according to claim 1, wherein the statistical information for each route is at least one of a traffic amount, a quality, and a route stability.