JP5035219B2 - Communication path detection method, communication path detection program, and communication path detection apparatus - Google Patents

Description

  The present invention relates to a technology for monitoring a network in an IT (Information Technology) system composed of servers and network devices, and supporting the detection and resolution of network connection problems.

Conventionally, with regard to devices connected to a network, network management techniques for collecting network connection information of devices to be monitored and displaying physical connections between devices on a screen as a topology map have been proposed and become common (for example, , See Patent Document 1). However, in a redundant network, it is insufficient to accurately identify a communication path on the way between one device and another device.
JP 2004-208068 A

  In the prior art, for example, when the devices A and B communicate with each other and the redundancy is ensured for the route, the communication route is not uniquely determined. For this reason, it is difficult for the network administrator to correctly grasp the route through which the devices A and B communicate. In addition, when a network device in the middle of a communication path breaks down, the network path may be switched automatically due to the high reliability function on the network device side. I couldn't.

  When it is desired to monitor the quality or performance of a line in communication between specific devices, it is not clear where to monitor, so eventually it was necessary to monitor the entire network. Therefore, in order to solve the above-described problem, the present invention provides a method in which a network management program detects a communication path between two specific devices (device A and device B) in a redundant network environment.

  The present invention executes a route search command (traceroute command) for searching for a communication route from device A to device B in layer 3 (third layer or network layer) of the OSI (Open Systems Interconnection) reference model, By obtaining the route information of which router was passed, and comparing the route information with the Virtual Router Redundancy Protocol (VRRP) information stored in the memory, the router's IP (Internet Protocol) By identifying the address, the communication path of the redundant layer 3 network is detected, and then, in the layer 2 (second layer or data link layer), the router interface information, the switch previously held in the memory MAC (Media Access Control) address table and topology information to device B If the communication path of the redundant layer 2 network is detected by specifying the switch and the port number of the switch, and no communication path is specified in both the layer 3 and layer 2 networks, 2 By adopting a configuration that applies a route selection algorithm that minimizes the number of nodes that pass between two devices, it is possible to detect a communication route between devices even in a redundant network.

  As described above, according to the present invention, even in a redundant network, a communication path between two specific devices in a layer 2 / layer 3 network is detected, and the network administrator correctly grasps the own terminal. It becomes possible to do.

  In addition, a network management program that implements this method is incorporated in a network that consists of network equipment that is equipped with SNMP (Simple Network Management Protocol) agents and Telnet (Tele-communications Network) servers as standard equipment. No special device or the like for path detection according to the present invention is required.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 shows a basic system configuration for communication path detection in a redundant network according to an embodiment of the present invention.

  This communication path detection system in a redundant network is composed of a network management server 1 and an administrator terminal 3 that manage network information from the monitored network 100, and a network management program 2 that operates on the network management server 1 includes: A communication path detection program 10 that detects a communication path between specific devices from network devices such as servers, routers, and switches that are connected to the network, and a configuration that collects configuration information of the monitored network 100 and stores it in the database 30 And the program 20.

  Further, the communication path detection program 10 includes a first detection unit 11 that detects a communication path of a layer 3 network, a second detection unit 12 that detects a communication path of a layer 2 network, and a first detection unit and a second detection unit. When no communication path is specified, the path estimation unit 13 is configured to apply a path selection algorithm that minimizes the number of nodes passing between the two devices. Yes.

  Here, although not shown, the network management server 1 is a computer having a CPU and a memory, and the network management program 2 stored in a recording medium such as a flexible disk, a hard disk, or a compact disk is stored in the memory at the time of startup. Expanded and executed by the CPU.

It is assumed that the following information is stored in advance in the database 30 by the monitoring program 20 in the network management program 2.
a) Topology information of the monitoring target network 100 Information automatically collected on node-to-node connection information, or information manually input to the monitoring program 20 by the administrator.
b) VRRP information for multiplexing routers collected from VRRP-MIB (Management Information Base: public information based on RFC (Request for Comments)) of routers existing in the monitored network 100 c) Monitored networks Information on interfaces (IP address, MAC address, port number) of all devices existing in 100

FIG. 2 shows an example of a route search command according to the embodiment of the present invention.
The tracert (traceroute in Unix (registered trademark)) command is a command that displays the route from the host to the specified host and its relay time. The part (1) is the host name dep from its own router. It shows that the route to .xyzcorp.com and the server of IP address is searched. The part (2) indicates that a maximum of 30 pieces of route information are displayed, and “30 hops” indicates that a maximum of 30 routers are listed. Further, the part (3) shows a list of route information, and each line sequentially includes “sequence number”, “response time to each router (unit is milliseconds in each result of three trials)”, “ “Host name” and “IP address”.

  In the embodiment, routers existing on the communication path to the server name dep.xyzcorp.com (IP address 10.90.141.124) by executing the command are w10002.bs.joy.xyzcorp.com and w10005. Indicates bs.joy.xyzcorp.com.

  FIG. 3 shows a data configuration example of the VRRP information table of the router according to the embodiment of the present invention. The VRRP information of the virtual router acquired from the monitoring target network 100 by the monitoring program 20 of the network management program 2 and held in the database 30 is shown.

  The VRRP information table includes a plurality of records including items of “INDEX (item number)”, “virtual IP address”, “real IP address”, and “management IP address”, and the “virtual IP address” of the virtual router. And “real IP address” are associated with each other. For example, in INDEX 1 and 2, the real IP addresses are two routers, aaa.bbb.ccc.1 and aaa.bbb.ccc.2, which are virtual routers with a virtual IP address aaa.bbb.ccc.0. It shows that. Even if one router fails, a communication path is secured by the other router. This VRRP information is obtained by logging into the router and executing a command, or obtained from VRRP-MIB defined in RFC2787.

  FIG. 4 shows a data structure of the topology information table of the monitoring target network according to the embodiment of the present invention. The topology information is automatically collected by connection information between nodes, or is manually input to the monitoring program 20 by the administrator. FIG. 4 shows that the interface indicated by the port L of the device having the IP address of the node L of each record is connected to the interface indicated by the port R of the device having the IP address of the node R. .

  FIG. 5 shows a data configuration example of the MAC address table of the layer 2 switch according to the embodiment of the present invention. The MAC address table associates a physical address (MAC address) for identifying a switch of the layer 2 network with a port number. For example, in the first record, the MAC address is 00− before the port 4 of this switch. This indicates that a device having an interface of 0C-13-24-44-44 is connected.

  FIG. 6 shows a data configuration example of a routing table possessed by the router according to the embodiment of the present invention. The routing table records the destinations of packets to be transmitted and received. The “destination network address” expressed in a mask format (range from the first 24 bits), the number of via routers “METRIC” as a unit of the distance to the destination network. ”,“ NextHop ”, which is the destination of the next router, and“ output interface port number ”.

  For example, in the third record, a packet whose destination IP address is 10.90.162.3 is received from the interface of FastEthernet0 / 2 (Ethernet (registered trademark) port number) 172. It is forwarded to the router at 16.2.254. The output interface can be specified by the destination IP address. Note that “direct” of the item “NextHop” indicates a network with which the router itself is in contact.

  FIG. 7 shows an overall flow of communication path detection processing in the network management server according to the embodiment of the present invention. In the embodiment, an example in which a plurality of network devices are connected between two devices (device A and device B) via a redundant layer 3 network and layer 2 network will be taken.

  First, in step S11, the communication path detection program 10 detects a communication path of the layer 3 network. Log in to the device A, execute a traceroute command for the device B, and specify a router through which the device A communicates with the device B. If the router is made redundant with VRRP, the information obtained here may be the IP address of the virtual router, so it is compared with the VRRP information of the router existing in the monitored network stored in the database in advance. Thus, the management IP address of the actual router constituting the VRRP is specified.

  Subsequently, the routing table information of the router on the way is collected, and the IP addresses of the devices A and B are matched to identify the input / output interface of the router. As a result, even in a redundant configuration based on VRRP, it is possible to accurately detect the route of the layer 3 network.

  Next, in step S12, the communication path detection process is performed for the number of networks for the layer 2 network. When a layer 2 network including a layer 2 switch exists in the communication path from the device A to the device B, the interface information of the router (or the device A or B) at both ends of the network is stored in the database in advance. By referring to the topology information of the monitored network, it is possible to limit the layer 2 switches that are candidates for the intermediate route.

  Subsequently, by collecting the information of the MAC address table of the layer 2 switch that is a candidate for the midway route and comparing it with the MAC address information of the router (or device A or B) that is the both ends of the layer 2 network, A layer 2 switch that passes through the layer 2 network and its input / output interface (port number) are specified, and a communication path in the layer 2 network is specified.

  Next, in step S13, it is determined whether there is a communication path that is not specified in the communication path detection processing in steps S11 and S12.

  For example, in a layer 2 network, when the network device uses link aggregation that increases the number of lines connecting the network devices and treats it as a single logical line, the port number is determined from the information in the MAC address table. There are cases where the number cannot be specified.

  If there is an unknown communication path that is not specified as a result of the determination, in step S14, unknown path estimation processing by an SPF (Shortest Path Find) algorithm is performed. For example, when the route between the node C and the node D is unknown, the route that reaches the node D from the node C in the shortest (the fewest number of nodes that pass through) is selected. This can be obtained by applying the SPF algorithm to the topology information held by the network management program. The SPF algorithm is used in OSPF (Open Shortest Path Find) which is a routing protocol in layer 3, but in the layer 2 network, the present invention is characterized in that it is used for estimating a communication path.

  As described above, by combining the above-described layer 3 route detection processing and layer 2 route detection processing with unknown route estimation processing, the communication route from device A to device B can be specified (or estimated). .

  FIG. 8 shows a configuration example of a redundant network that is a route search target according to the embodiment of the present invention. In this embodiment, as shown in FIG. 8, it is assumed that devices A and B are communicating in a network in which communication paths are made redundant.

Hereinafter, a process in which the communication path detection program 10 operating on the network management server 1 obtains a communication path from the device A to the device B will be described.
1. The communication path detection program 10 logs in to the device A and executes a command equivalent to traceroute on the device B. As a result, a layer 3 route is obtained: device A → router with IP address V1 → router with IP address V2 → device B.
Since the IP addresses V1 and V2 acquired in 2.1 are virtual IP addresses by routers made redundant by VRRP, the routers cannot be identified as they are. Therefore, the network management program uses the VRRP information of the router stored in advance to make sure that the virtual IP address V1 has a VRRP configuration consisting of routers RI and R2, and that the virtual IP address V2 is R3 and R4. It understands that it is the VRRP structure which consists of.
3. Next, the communication path detection program 10 accesses the VRRP-MIBs of the routers R1 and R2, and acquires the value of vrrpOperState representing the VRRP state. Among R1 and R2, when this value is a specified value defined by RFC (Request for Comments) (value 3 = master state), it is determined that the router is actually operating (in this example, , Assuming R1 was in the master state).

  Similarly, the VRRP-MIBs of the routers R3 and R4 are accessed, and the value of vrrpOperState representing the VRRP state is acquired (in this example, it is assumed that R4 is in the master state).

With the above processing, a router through which communication from the device A to the device B is determined in the VRRP configuration network. In this example, the layer 3 route of device A → R1 → R4 → device B is determined.
4). Since it is found that the routed routers are R1 and R4, the communication path detection program 10 accesses R1 and R4 and acquires information on the routing table.
The input interface from the device A can be specified by the IP address of the device A and the information of the routing table. In this example, it can be seen that the input interface of R1 is P1, and the input interface of R4 is P1.
Further, the output interface toward the device B can be specified by the IP address of the device B and the information of the routing table. In this example, it can be seen that the output interface of R4 is P3 and the output interface of R4 is P3. By the processing so far, the route of layer 3 can be specified as follows.
Device A → P1 of R1 → P3 of R1 → P1 of R4 → P3 of R4 → Device B

Next, an example of route search in the layer 2 network existing between the layer 3 devices on the communication route will be described. In this example, the communication path of the layer 2 network 2 located between R1 and R4 is specified.
5. The communication path detection program 10 can specify that the P1 interface of the layer 2 switch SW2 is connected to the P3 interface of R1 based on the topology information held in advance. Therefore, the communication path detection program 10 accesses SW2 and acquires information of the MAC address table.
6). Here, when R3 and R4 have a VRRP configuration, the transmission destination MAC address of a frame flowing through the layer 2 network 2 is a virtual MAC address of VRRP. The communication path detection program 10 can specify the virtual MAC address on the interface P1 side of R4 from the VRRP information held in advance. Therefore, the interface (port) where the virtual MAC address of the interface P1 of R4 is learned in the MAC address table of SW2 is specified as P3.
7). The communication path detection program 10 can specify that the P2 interface of the L2 switch SW5 is connected to the P3 interface of SW2 based on the topology information held in advance. Therefore, next, the communication path detection program 10 accesses the SW 5 and acquires information of the MAC address table. Similarly to the above, it can be identified from the information in the MAC address table that the interface (port) from which the virtual MAC address of the interface P1 of R4 is learned is P4, and therefore the output interface of SW5 is P4.

The following communication paths in the layer 2 network 2 are determined by the processes 5 to 7 described above.
R1 P3 → SW2 P1 → SW2 P3 → SW5 P2 → SW5 P4 → R4 P1
Although description is omitted, the communication path can be similarly specified for the layer 2 network 1 and the layer 2 network 3. As described above, all communication paths from the device A to the device B can be specified.

  Next, the operation when the communication path is estimated will be described with reference to FIGS.

  9 and 10 are diagrams for explaining the communication path estimation operation according to the embodiment of the present invention. FIG. 9 shows estimation results (1) to (3), and FIG. 10 shows estimation results (4) and (5).

  In the network of FIG. 8, when the communication path from the device A to the device B is obtained, the layer 3 route can be obtained by the processes 1 to 4 described above, but now exists in the layer 2 network 2. Assume that the route between the router R1 and the router R4 is unknown from the contents of the MAC address table of the switch. At this time, the route between the router R1 and the router R4 is estimated as follows.

In the route estimation, the distance from R1 is considered as a cost, and the route that reaches R4 from R1 at the lowest cost is obtained.
(1) A node having a cost of 1 from R1 (a node directly connected to R1) is determined from topology information held in advance. The nodes directly connected to R1 are SW1, R2, and SW2, but SW1 is excluded because it is a device that has passed through the route from device A to R1. Therefore, R2 and SW2 become nodes that can be reached from R1 at cost 1.
(2) Next, a node that can be reached from R1 at cost 2 is obtained. Consider the node ahead of the nodes R2 and SW2 of cost 1 obtained in (1). The nodes connected to R2 are SW1, R1, and SW3, but SW1 and R1 are excluded because they overlap with the route so far. Therefore, the route R1-R2-SW3 is obtained.

The nodes connected to SW2 are R1, SW3, SW4, and SW5, but R1 is excluded because it overlaps with the route so far. Therefore, three paths of R1-SW2-SW3, R1-SW2-SW3, and R1-SW2-SW5 are obtained. These SW3, SW4, and SW5 become nodes that can be reached from R1 at cost 2.
(3) Next, a node that can be reached from R1 at cost 3 is obtained. Consider the node ahead of the nodes SW3, SW4, and SW5 of cost 2 obtained in (2).

The nodes connected to SW3 are R2, SW2, SW4, and SW5, but are excluded because they overlap with the route so far or are reachable at a cost lower than cost 3. Therefore, there is no node that can be reached at cost 3 via SW3.
(4) The nodes connected to SW4 are SW2, SW3, SW5, and R3, but SW2, SW3, and SW5 are excluded because they are reachable at a cost lower than cost 3. Therefore, R3 is a node that can be reached from R1 at cost 3.
(5) The nodes connected to SW5 are SW2, SW3, SW4, and R4, but SW2, SW3, and SW4 are excluded because they are reachable at a cost lower than cost 3. Therefore, R4 is a node that can be reached from R1 at cost 3.

  From the above (3) to (5), the nodes that can be reached from R1 at cost 3 can be determined as R3 and R4. As a result, the shortest path from R1 to R4 is determined as R1-SW2-SW5-R4.

  As described above, it is possible to estimate the passage route by obtaining the route with the minimum cost from R1 to R4.

  Next, FIGS. 11 to 13 show examples of screens for displaying the result of the communication path detection described above on the administrator terminal.

  FIG. 11 shows an example of a screen for displaying a route detection result according to the embodiment of the present invention (part 1: highlighting of a specified route). In the embodiment, the path from the node of 192.168.1.43 to which the communication path is specified to the node of 192.168.2.234 is highlighted by a bold line.

  FIG. 12 shows a screen example (part 2: display of a failure occurrence route) for displaying a route detection result according to the embodiment of the present invention. In the embodiment, a route in which a failure has occurred in the middle of a route from the node of 192.168.1.43 to the node of 192.168.2.234 is expressed by highlighting with a dotted line or coloring. is doing.

  FIG. 13 shows an example of a screen (part 3: display of an estimated route) for displaying a route detection result according to the embodiment of the present invention. Of the paths from the 192.168.1.43 node to the 192.168.2.234 node, the path from the 192.168.1.43 node to the 192.168.1.3 node is estimated. The route is highlighted by multiple lines.

  As shown in the above screen example, by highlighting the path between specific nodes on the topology map, it is possible to make it clear at a glance that a failure has occurred on the communication path. In addition, the route obtained by estimation can be distinguished from the estimated route by devising such as displaying the route with a dotted line.

It is a figure which shows the basic system structure of a communication path | route detection in the redundant network which becomes embodiment of this invention. It is a figure which shows the example of the route search command which becomes embodiment of this invention. It is a figure which shows the data structural example of the VRRP information table of the router which becomes embodiment of this invention. It is a figure which shows the example of a data structure of the topology information table of the monitoring object network which becomes embodiment of this invention. It is a figure which shows the data structural example of the MAC address table of the layer 2 switch which becomes embodiment of this invention. It is a figure which shows the example of a data structure of the routing table which the router which becomes embodiment of this invention has. It is a figure which shows the whole flow of the communication path | route detection process in the network management apparatus which becomes embodiment of this invention. It is a figure which shows the example of a communication path | route between two apparatuses in the redundant network which becomes embodiment of this invention. It is FIG. (1) explaining the estimation operation | movement of the communication path which becomes embodiment of this invention. It is FIG. (2) explaining the communication path estimation operation | movement which becomes embodiment of this invention. It is a figure which shows the example of a screen (the 1: highlighting of the specified path | route) which displays the path | route detection result which becomes embodiment of this invention. It is a figure which shows the example of a screen which displays the path | route detection result which becomes embodiment of this invention (the part 2: display of a failure path | route). It is a figure which shows the example of a screen (the 3rd: display of an estimated path | route) which displays the path | route detection result which becomes embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network management server 2 Network management program 3 Manager terminal 10 Communication path detection program 11 1st detection part 12 2nd detection part 13 Path | route estimation part 20 Monitoring program 30 Database 100 Monitoring object network

Claims (5)

A communication path detection method in a network management server that manages a redundant network in which a switch and a router are connected between two devices,
The route information of the router obtained by executing the route search command is checked against the virtual router redundancy protocol information stored in the memory, and the IP address of the router is specified to detect the communication route of the redundant layer 3 network. A first detection step to:
The communication path of the layer 2 network made redundant by specifying the transit switch and the port number of the switch from the interface information of the router, the MAC address table of the switch, and the topology information stored in the memory in advance. A second detection step to detect;
A communication path detection method comprising:   If a communication path is not specified in both the first detection step and the second detection step, a path detection process is performed by a path selection algorithm that minimizes the number of nodes passing between the two devices. The communication path detection method according to claim 1.   The communication according to claim 1 or 2, wherein a result of a communication path between two specific devices obtained by detection processing in the layer 2 and layer 3 redundant network is highlighted as a topology map. Route detection method. A communication path detection program in a network management server that manages a redundant network in which a switch and a router are connected between two devices,
On the computer,
The route information of the router obtained by executing the route search command is checked against the virtual router redundancy protocol information stored in the memory, and the IP address of the router is specified to detect the communication route of the redundant layer 3 network. A first detection step to:
The communication path of the layer 2 network made redundant by specifying the transit switch and the port number of the switch from the interface information of the router, the MAC address table of the switch, and the topology information stored in the memory in advance. A second detection step to detect;
Communication path detection program that executes A communication path detection device in a network management server that manages a redundant network in which a switch and a router are connected between two devices,
The route information of the router obtained by executing the route search command is checked against the virtual router redundancy protocol information stored in the memory, and the IP address of the router is specified to detect the communication route of the redundant layer 3 network. First detecting means to
The communication path of the layer 2 network made redundant by specifying the transit switch and the port number of the switch from the interface information of the router, the MAC address table of the switch, and the topology information stored in the memory in advance. A second detection means for detecting;
A communication path detection device comprising: