JP4912435B2 - IP network failure location visualization apparatus, IP network failure location visualization method, IP network failure location visualization program - Google Patents

Description

  The present invention relates to a technique for visualizing a network failure location from a packet flowing on an IP network.

As is well known, efficient network management is the key to maximizing network performance today. Therefore, as in Non-Patent Document 1, a method has been proposed in which packets flowing on an IP network are acquired and the network configuration diagram and the traffic flowing on the configuration diagram are visualized from a bird's-eye view.

Burns, C.I. M.M. , Kuo, J. et al. and Ng, S .; (2003) “Ecological interface design: a new approach for visualizing network management”, Computer networks, vo. 369-388.

  However, the method of Non-Patent Document 1 does not display a node without packet communication, cannot associate the configuration of the IP network with a physically existing node, and cannot determine the fault location of the network. There is a fear. In particular, there are many environments in which IPv4 communication and IPv6 communication coexist on the current network, and there may be a node that is physically present but is not displayed on the IP network configuration.

  That is, when there is a router functioning as an IPv6 bridge in the network, the MAC address on the home device side (LAN side) such as a personal computer and the MAC address on the Internet side (WAN side) are the same in the router. The existence of a router is not conscious, and the network topology of layer L2 differs between IPv6 and IPv4, and even though the router actually exists, it may not be displayed in the IP network configuration.

  The present invention has been made in order to solve the above-described problems of the prior art, and relates to a technique capable of associating a configuration of an IP network with a physically existing node and finding a fault location in the network. Providing is a solution issue.

Therefore, in the present invention, in order to associate the configuration of the IP network with a physically existing node, a node without packet communication is also displayed. One aspect of the present invention is an apparatus for visualizing a failure location of a network to be monitored from a packet flowing on an IP network, a template storage unit that stores a template indicating a configuration of the network to be monitored, and a monitoring target A packet acquisition unit for acquiring a packet flowing through the network, and a communication network of a route through which the packet communicates is estimated based on information included in the packet acquired by the packet acquisition unit, and the communication network and the template storage unit By comparing the template stored in the network, the network state calculation unit determines whether there is packet communication for each route of the network, and the network state calculation unit determines the template stored in the template storage unit. Communicated packets can be communicated The and an output unit for outputting the display for each path of the network.
When monitoring either the WAN side or the LAN side of an IPv6 bridge existing in the monitored network, this apparatus defines virtual Ether interfaces on the WAN side and the LAN side of the node functioning as the bridge. At the same time, the IPv6 packet is divided into a packet from the transmission source node to the IPv6 bridge and a packet from the IPv6 bridge to the reception destination node, and the node functioning as IPv6 is positively conscious.
Further, when monitoring the WAN side and the LAN side of the IPv6 bridge existing in the network to be monitored, it is determined whether the node that performs IPv6 communication exists on the LAN side or the WAN side of the bridge, The transmission / reception addresses of the packets measured in the partial networks on the LAN side and the WAN side are read, and the node functioning as IPv6 is positively conscious.

Another aspect of the present invention is a method for visualizing a failure location of a monitored network from a packet flowing on an IP network, and a template that stores a template indicating a configuration of the monitored network in a template storage unit Based on information included in the packet acquired in the packet acquisition step, the packet acquisition step in which the packet acquisition unit acquires a packet flowing through the network to be monitored, and the network state calculation unit in the packet acquisition step. A network state calculation step for determining whether or not there is packet communication for each route of the network by estimating a communication network of a route and comparing the communication network and the template stored in the template storage unit; Department is in front The template stored in the template storing step, and an output step of outputting the presence or absence of communication of packets determined by the network state calculating step and displayed for each path of the network.
In this method, when either the WAN side or the LAN side of an IPv6 bridge existing in a monitored network is monitored, a virtual Ether interface is defined on the WAN side and the LAN side of the node functioning as the bridge. The IPv6 packet is divided into a packet from the transmission source node to the IPv6 bridge and a packet from the IPv6 bridge to the reception destination node, and the node functioning as IPv6 is positively conscious.
Further, when monitoring the WAN side and the LAN side of the IPv6 bridge existing in the network to be monitored, it is determined whether the node that performs the IPv6 communication exists on the LAN side or the WAN side of the bridge, and the LAN The transmission and reception addresses of the packets measured in the partial network on the side and the WAN side are read, and the node functioning as IPv6 is positively conscious.

  In addition, this invention is good also as an aspect of the program for functioning a computer as said apparatus. This program may be provided via a network or a recording medium.

  According to the present invention, since the configuration of the IP network and the physically existing node are associated with each other, a fault location in the network can be found.

The block diagram which shows the structural example of the visualization part of the failure location of the IP network which concerns on embodiment of this invention. The network block diagram of the example of a template which the template memory | storage part memorize | stores. The connection state figure which shows the example of a connection to the monitoring object network of the visualization apparatus. The connection state figure which shows the other example of a connection to the monitoring object network of the visualization apparatus. The figure which shows the example of a display of the output part. The figure which shows the other example of a display of the output part. The use image figure of IPv6 bridge. The connection state figure which shows the example of a connection which monitors the one side of an IPv6 bridge. The figure which shows the example of a display of an output part when not being aware of existence of an IPv6 bridge. The connection state figure which shows the example of a connection which monitors the both sides of an IPv6 bridge. The block diagram which shows the example of a computer which performs the program recorded on the recording medium.

  Hereinafter, a failure point visualization apparatus for an IP network according to an embodiment of the present invention will be described. According to this visualization apparatus, a communication network of a path through which a packet communicates is estimated based on information included in a packet flowing on the network, and the communication network and the template of the network configuration stored in the template storage unit are compared, The presence / absence of packet communication is determined for each network route, and the presence / absence of packet communication is displayed for each network route in the template.

  Since nodes that do not communicate packets (elements that make up the network) are also displayed here, the user can associate the IP network configuration with the physically existing nodes, making it easier to find faults. To do. At this time, if the existence of an IPv6 bridge such as a video distribution service is recognized, the network topology in IPv6 is matched with the actual wiring.

  That is, when the presence of an IPv6 bridge is recognized, the visualization device assumes a temporary Ethernet (registered trademark) interface at both ends of the bridge, receives an IPv6 packet from the source node to the IPv6 bridge, and receives from the bridge. The network topology (network connection form) in IPv6 is matched with the actual wiring by being divided into packets to the destination node and being aware of the actual router functioning as an IPv6 bridge.

  Further, if the router functions as an IPv6 bridge while monitoring packets on the WAN side and LAN side of the router, the same packet is observed on both sides of the router. Therefore, by rereading the transmission / reception addresses of the packets observed in the respective partial networks, the IPv6 bridge is made conscious of it and the network topology in IPv6 is matched with the actual wiring.

  As a result, even if there is a router functioning as an IPv6 bridge, the existence of the router is visualized in the same manner as the actual network configuration. In this respect also, the configuration of the IP network is associated with the physically existing node.

≪Configuration example≫
FIG. 1 shows a configuration example of the visualization device, and the visualization device 301 is connected to a network 101. Here, the visualization device 301 monitors the network 101 and visualizes the failure location of the network 101 to be monitored.

  Specifically, as shown in FIG. 1, the visualization apparatus 301 includes a packet acquisition unit 11 that acquires a packet that flows through the network 101 to be monitored, and a template storage unit 12 that stores a template indicating the configuration of the network 101. And the communication network and the template stored in the template storage unit 12 are estimated based on the information included in the packet acquired by the packet acquisition unit 11, and the communication network and the template stored in the template storage unit 12 are compared. The network state calculation unit 13 that determines the presence or absence of packet communication for the route, and the template stored in the template storage unit 12 display the presence or absence of packet communication determined by the network state calculation unit 13 for each route of the network 101. And an output unit 14 for outputting.

  Here, as an example, the network 101 uses a network configuration using the Internet 100 at home as a template, as shown in FIG. This network configuration is set as the initial setting of the monitoring target. The network 101 to be monitored has a path between the Internet 100 and the router 201 (partial network 101a) and a path between the router 201 and the personal computer 203 (partial network 101b). Hereinafter, a description will be given based on a case where the initial setting is displayed as an initial screen of the visualization device 301. Here, it is assumed that the test packet is transmitted through the network 101.

  The template storage unit 12 performs a template storage step of storing a template indicating the network configuration 101. Here, it is assumed that the template storage unit 12 stores a network configuration template shown in FIG. The network configuration to be stored is configured by a path connecting nodes. 2, the node corresponds to the Internet 100, the router 201, and the personal computer 203, and the route includes the partial networks 101a. 101b corresponds.

  The packet acquisition unit 11 performs a packet acquisition step of acquiring a packet flowing through the network 101 to be monitored. That is, the packet acquisition unit 11 acquires a packet flowing on the network 101 to be monitored. The acquired packet information is transferred to the network state calculation unit 13. As a means for acquiring a packet at this time, as shown in FIG. 3, a switching hub 202 having a port mirroring function is connected to the monitoring target network 101, and a packet flowing on the monitoring target port is connected to the switching hub 202. Means for copying to a port connected to the visualization device 301 can be mentioned. As shown in FIG. 3, on-site maintenance is preferably performed by connecting the switching hub 202 to the monitoring target network 101 and using the packet acquisition unit 11.

  As another means for acquiring the packet, as shown in FIG. 4, the router 201 which is a terminal (node) constituting the monitored network 101 has a built-in port mirroring function, and passes through the router 201. It is also possible to use means for transferring a packet to be transmitted to the failure point visualization device 301 of the IP network via the network. For remote maintenance, it is preferable that the packet acquisition unit 11 is configured to transfer a packet from the router 201 as shown in FIG.

  The network state calculation unit 13 estimates a communication network of a route through which the packet communicates based on information included in the packet transferred from the packet acquisition unit 11, and the communication network and the storage template of the template storage unit 12 And a network state calculation step for determining whether or not a packet is communicated to each route (partial networks 101a and 101b) of the monitoring target network 101 is performed.

  Specifically, the network state calculation unit 13 measures a route on the network 101 from the packet information acquired by the packet acquisition unit 11 and estimates a communication network. At this time, the network state calculation unit 13 accesses the template storage unit 12 and refers to the storage template of the network configuration. Here, the storage template is compared with the estimated communication network, and it is determined whether there is communication in each path (partial networks 101a and 100b) of the storage template. The determination result is transferred to the output unit 14.

  The output unit 14 determines the presence / absence of communication of packets transferred from the network state calculation unit 13 to the storage template of the template storage unit 12 for each path of the network 101, that is, the partial networks 101a. An output step of displaying and outputting every 101b is performed. Specifically, the output unit 14 determines each partial network 101a... In the storage template of the template storage unit 12 based on the determination result of the network state calculation unit 13. Whether or not there is packet communication is output to 101b. This output result is displayed on a display provided in the visualization device 301. The display may be connected to the video output terminal of the visualization device 301 or may be integrated with the visualization device 301.

  FIG. 5 shows a display example after test packet transmission. Here, it is displayed that there is packet communication on the route of the partial network 101a, but there is no packet communication on the route of the partial network 101b. As described above, according to the visualization device 301, nodes without packet communication are also displayed, so that the configuration of the IP network can be associated with a physically existing node, and the failure location can be easily found. .

  FIG. 6 shows another display example after test packet transmission. Here, the personal computer 204 is a node newly added to the router 201. According to the display example of FIG. 6, although there is no packet communication in the partial network 101b, it is displayed that there is a packet communication in the path (partial network 101c) to the personal computer 204.

  Therefore, according to the visualization device 301, if there is a node that does not exist in the storage template of the template storage unit 12 as a result of the communication status of each route calculated by the network state calculation unit 13, the node is added to the storage template. Then, the storage template is updated, and the updated storage template is displayed on a display or the like.

  As a result, it is possible to grasp nodes that are temporarily connected to the network and nodes that are sequentially added to the network. Further, when a new node is physically added to the network, the node is quickly reflected in the IP network, and in this respect as well, it is possible to associate the IP network with a physically existing node.

≪Support for IPv6≫
In recent years, with the spread of the Internet, the number of IPv4 IP addresses has been depleted, and in order to cope with this, there is an urgent need to move to IPv6. However, although IPv6 communication exists as a part of video distribution services and the like, since most of the Internet is IPv4 communication, a situation exists in which both are mixed.

  Therefore, at present, an IPv6 bridge is used as shown in FIG. According to this IPv6 bridge, although the router needs to support IPv6, packets of IPv6 communication can be exchanged with the provider side without being converted by the router. Accordingly, a terminal such as a PC (personal computer) using IPv4 and a terminal (PC or STB “Set Top Box”) that needs to be connected to IPv6 can be used simultaneously.

However, the use of IPv6 bridge, so that the network topology is different IPv6 and IPv4. Meanwhile, in order to display the presence or absence of communication of packets from the output unit 14 in the visualization device 301, it is desirable network topology is the same regardless of the packet type.

  Therefore, the visualization device 301 performs the following processing on the IPv6 bridge in the packet acquisition step. Here, the router 201 is an Ipv6-compatible router.

(1) When monitoring one side of the router 201 First, as shown in FIG. 8, a case will be described in which a switching hub 202 is used to monitor one side of the router 201 to acquire a packet. Here, the Internet 100 side (partial network 101a) of the router 201 is called the WAN side, and the personal computer 203 side (partial network 101b) is called the LAN side. The direct measurement range of IPv4 is limited only to the WAN side or LAN side of the router 201 depending on the monitoring point. FIG. 8 shows a state in which the LAN side of the router 201 is monitored.

  Here, when an IPv6 bridge exists, that is, when the router 201 is used as an IPv6 bridge, the IPv6 packet is not converted by the router 201 and is exchanged with the provider side. For IPv6, the router 201 does not appear explicitly, and the state of direct communication between the WAN-side Internet 100 and the LAN-side personal computer 203 will be monitored. When this state is displayed on the output unit 14 as it is, as shown in FIG. 9, the personal computer 203 on the LAN side under the router 201 and the Internet 100 are directly connected.

  However, in actual wiring, the personal computer 203 and the like are accommodated on the LAN side of the router 201, and only the WAN port of the router 201 is connected to the WAN side. In this case, the output information of the output unit 14 does not match the actual wiring, which is not preferable from the viewpoint of intuitive understanding.

Therefore, the packet acquisition unit 11 performs a process for matching the output of the output unit 14 with the actual wiring. As long recognized the existence of I IPv6 bridge here, first, both sides of the bridge, i.e. to define a virtual Ether interface on the LAN side and the WAN side of the router 201, the respective MAC address "00: 00: V6: BR: ID: GE ". This may be set in the router 201 in advance.

  Next, a node on the LAN side beyond the router 201 as viewed from the actual monitoring point is a node in a virtual Ether segment (vwan or vlan), and an IPv6 packet is transmitted from the source node to the IPv6 bridge and the bridge. Divide into two sections of the receiving node.

  For example, when an IPv6 packet flows from the WAN side when the LAN side is a monitoring point, a packet from a router existing in the Internet 100 to a Mac address “00: 00: V6: BR: ID: GE” The analysis is performed separately for packets from the Mac address “00: 00: V6: BR: ID: GE” to the personal computer 203.

  By defining the virtual Ether interface in this manner, the packet acquisition unit 11 is actually aware of the IPv6 bridge that is actually the router 201 in a situation where IPv6 and IPv4 coexist, and is shown in FIG. As described above, the network topology in the IPv6 bridge is made to coincide with the physical wiring situation, thereby improving intuitive comprehension.

(2) When both sides of the router 201 are monitored As shown in FIG. 10, when two sides of the router 201 are monitored using two switching hubs 202, that is, the LAN side and the WAN side of the router 201 are monitored. Let us describe the case of acquiring packets for each point.

  In this case, if there is an IPv6 bridge, the same packet is observed on the LAN side and the WAN side of the router 201. Therefore, by executing the following processing, the IPv6 bridge is positively conscious and the output information of the output unit 14 matches the actual wiring state.

  That is, when the existence of an IPv6 bridge is recognized, the packet acquisition unit 11 first determines whether a node that performs IPv6 communication actually exists on the LAN side or the WAN side. Next, for the IPv6 packet, each partial network 101a. The transmission / reception address of the packet observed in 101b is reread. Here, both partial networks 101a. In the partial network 101b, the partial Mac address is set to “00: 00: V6: BR: ID: GE” as the destination Mac address. The partial network observing the relayed packet sets the source Mac address to “00: 00: V6: BR: ID: GE”.

  By translating the transmission / reception address in this way, the packet acquisition unit 11 can be aware of the IPv6 bridge that is actually the router 201, and match the network topology in IPv6 with the actual wiring as shown in FIG. In this respect, intuitive comprehension improves.

≪Programs≫
The present invention can also be configured as a failure location visualization program for causing a computer to function as all or part of each of the units 11 to 14 constituting the visualization device 301. According to this program, the template storage step, the packet acquisition step, the network status computing step, among said output step, all the steps or part of the step, causes the computer to execute.

  This program can be provided through a network such as a website or e-mail. The program is stored in a recording medium such as a CD-ROM, DVD-ROM, CD-R, CD-RW, DVD-R, DVD-RW, MO, HDD, Blu-ray Disk (registered trademark), or a semiconductor memory. It is also possible to record, save and distribute. This recording medium is read using a recording medium driving device, and the program code itself realizes the processing of the above embodiment, so that the recording medium also constitutes the present invention.

  FIG. 11 shows an example of a computer 300 for executing a program recorded on the recording medium 90. The computer 300 includes a recording medium reader 111 for reading a recording medium 90 such as a flexible disk, a CD-ROM, and a DVD, a working memory (RAM) 112, and a program for storing a program recorded on the recording medium 90. A memory 113, a display 114, a mouse 115 and a keyboard 116 as input devices, a CPU 117 for controlling program execution, a hard disk drive 118 for storing data, and a router (not shown) that functions as the packet acquisition unit 11 201, and a cable 119 for connecting to the switching hub 202. In FIG. 10, each of the working memory 112, the program memory 113, the CPU 117, and the hard disk drive device 118 is indicated by a broken line because it is built in the casing of the computer 300.

  When the recording medium 90 is inserted into the recording medium reader 111, the computer 300 installs the visualization program stored in the recording medium 90 from the recording medium reader 111 into the program memory 113. Here, after the installation in the program memory 113 is completed, the CPU 117 can access the visualization program, and the program enables the computer 300 to operate as the visualization device 301 according to the present embodiment.

  As described above, when the computer 300 operates as the visualization device, the CPU 117 functions as the network state calculation unit 13. The hard disk drive 118 functions as the template storage unit 12. The display 114 functions as an output unit. The CPU 117 estimates the communication network by analyzing the packet acquired by the packet acquisition unit 11 (not shown) as described above. Further, the CPU 117 collates the network configuration template stored in the hard disk drive 118 with the estimated communication network, and determines which part of the template has communication. The determination result can be displayed on the display 114 as described with reference to FIGS.

  In addition, this invention is not limited to the said embodiment, It can deform | transform into various within the range described in each claim. For example, the network to be monitored is not limited to a home LAN but may be a corporate LAN. Further, the computer 300 is not limited to the personal computer of FIG. 10, and may be a DVD player, a game machine, a mobile phone, or the like that performs processing and control by software as long as the CPU 117 can access the visualization program.

DESCRIPTION OF SYMBOLS 11 ... Packet acquisition part 12 ... Template memory | storage part 13 ... Network state calculating part 14 ... Output part 90 ... Recording medium 100 ... Internet 101 ... Network 101a-101c ... Partial network 111 ... Recording medium reader 112 ... Working memory (RAM)
113 ... Program memory 114 ... Display 115 ... Mouse 116 ... Keyboard 117 ... CPU
DESCRIPTION OF SYMBOLS 118 ... Hard disk drive device 119 ... Cable 201 ... Router 202 ... Switching hub 203.204 ... Personal computer 300 ... Computer 301 ... Visualization apparatus of failure location of IP network

Claims (5)

An apparatus for visualizing a failure location of a monitored network from a packet flowing on an IP network,
A template storage unit for storing a template indicating a configuration of a network to be monitored;
A packet acquisition unit for acquiring packets flowing through the monitored network;
Based on information included in the packet acquired by the packet acquisition unit, estimating a communication network of a route through which the packet communicates, and comparing the communication network and the template stored in the template storage unit, A network state calculation unit for determining whether or not a packet is communicated for each route of the network;
The template stored in the template storage unit includes an output unit that displays and outputs the presence / absence of packet communication determined by the network state calculation unit for each path of the network ,
When the packet acquisition unit monitors either the WAN side or the LAN side of the IPv6 bridge existing in the monitored network,
A virtual Ether interface is defined on the WAN side and LAN side of the node functioning as the bridge, and
The IPv6 packet is divided into a packet from the source node to the IPv6 bridge and a packet from the IPv6 bridge to the destination node.
A device for visualizing a failure point of an IP network, characterized by being aware of nodes functioning as IPv6 . An apparatus for visualizing a failure location of a monitored network from a packet flowing on an IP network,
A template storage unit for storing a template indicating a configuration of a network to be monitored;
A packet acquisition unit for acquiring packets flowing through the monitored network;
Based on information included in the packet acquired by the packet acquisition unit, estimating a communication network of a route through which the packet communicates, and comparing the communication network and the template stored in the template storage unit, A network state calculation unit for determining whether or not a packet is communicated for each route of the network;
The template stored in the template storage unit includes an output unit that displays and outputs the presence / absence of packet communication determined by the network state calculation unit for each path of the network ,
When the packet acquisition unit monitors the WAN side and the LAN side of the IPv6 bridge existing in the monitored network,
Determining whether the node performing IPv6 communication exists on either the LAN side or the WAN side of the bridge;
Read the packet send / receive addresses measured in the LAN and WAN partial networks,
A device for visualizing a failure point of an IP network, characterized by being aware of nodes functioning as IPv6 . A method for visualizing a failure location of a monitored network from a packet flowing on an IP network,
A template storage step of storing a template indicating the configuration of the network to be monitored in the template storage unit;
A packet acquisition step in which the packet acquisition unit acquires a packet flowing through the monitored network;
Based on the information included in the packet acquired in the packet acquisition step, the network state calculation unit estimates a communication network of a route through which the packet communicates, and the communication network and the template stored in the template storage unit are stored. A network state calculation step for determining whether or not there is communication of a packet for each route of the network by comparing;
The output unit has an output step for displaying the template stored in the template storage step and displaying the presence / absence of communication of the packet determined in the network state calculation step for each route of the network , and
In the packet acquisition step, when monitoring either the WAN side or the LAN side of the IPv6 bridge existing in the network to be monitored,
A virtual Ether interface is defined on the WAN side and LAN side of the node functioning as the bridge,
The IPv6 packet is divided into a packet from the source node to the IPv6 bridge and a packet from the IPv6 bridge to the destination node.
A method for visualizing a failure point of an IP network, characterized by being aware of nodes functioning as IPv6 . A method for visualizing a failure location of a monitored network from a packet flowing on an IP network,
A template storage step of storing a template indicating the configuration of the network to be monitored in the template storage unit;
A packet acquisition step in which the packet acquisition unit acquires a packet flowing through the monitored network;
Based on the information included in the packet acquired in the packet acquisition step, the network state calculation unit estimates a communication network of a route through which the packet communicates, and the communication network and the template stored in the template storage unit are stored. A network state calculation step for determining whether or not there is communication of a packet for each route of the network by comparing;
The output unit has an output step for displaying the template stored in the template storage step and displaying the presence / absence of communication of the packet determined in the network state calculation step for each route of the network , and
In the packet acquisition step, when the WAN side and the LAN side of the IPv6 bridge existing in the monitored network are monitored,
Determine whether the node that performs IPv6 communication exists on the LAN side or WAN side of the bridge,
Read the packet send / receive addresses measured in the LAN and WAN partial networks,
A method for visualizing a failure point of an IP network, characterized by being aware of nodes functioning as IPv6 . A program for visualizing a fault location of an IP network for causing a computer to function as each unit constituting the visualization device according to claim 1 .

Images