JP5035217B2 - Network system, network monitoring device and integrated monitoring device - Google Patents

Description

  The present disclosure relates to a network system in which an OSPF (Open Shortest Path First) unicast routing protocol operates, a network monitoring device used in the system, and an integrated monitoring device that integrally monitors the network monitoring device.

  As a link state type routing protocol, the OSPF protocol defined by RFC (Request For Comments) 2328 is used. The OSPF protocol incorporates the concept of area. A plurality of areas can exist in an autonomous system (AS) managed by OSPF, but there must always be one backbone area. Each area must be connected to the backbone area. A router connecting an area and a backbone area is called an area border router (ABR). A router connected to the outside of the AS is called an AS Boundary Router (ASBR: Autonomous System Boundary Router).

  In the OSPF protocol, a link state update packet for describing and flooding a plurality of LSA (Link State Advertisement) information is prepared. In the OSPF network, each router creates a link state database (LSDB) by distributing and collecting information about the connected network and information about the route such as the cost of the interface. Reflect in the routing table. The LSA information is synchronized between routers existing in the same OSPF area, and the LSDB is managed for each AS including each area.

  In the OSPF network, if the LSA information to be distributed increases, the LSDB of each router will grow and the routing table will grow accordingly, causing problems in router performance such as memory usage and CPU load. . Examples of a method for reducing the LSA information to be distributed include distribution of the LSDB management range by OSPF area division, suppression of the number of LSAs by LSA aggregation (Aggregation) in ABR or ASBR, and the like.

  In particular, LSA aggregation is effective in that the influence on the existing network configuration at the time of aggregation setting is often minimized. However, as a method of grasping information necessary for implementing LSA aggregation (LSA information in the OSPF network), collection of internal logs of routers operating in the network and operating OSPF (multiple routers depending on the network configuration) And only the method of confirming by analysis. Therefore, there is a problem that it takes time to identify the problem part and determine the solution.

  In addition, as a prior art related to the present invention, a technique is known in which network topology information, routing information, and quality information are acquired by performing passive measurement, and a bottleneck on the network is estimated by combining these. ing. Also, a step of collecting management information base data from the network at time intervals, a step of building a time series of the collected data, a step of decomposing the time series of the collected data, and building an energy plot based on the decomposition time series And a method of detecting network anomalies comprising analyzing the energy plot and determining a sign of a network anomaly event.

JP 2004-032377 A JP 2006-067569 A

  The disclosed technology has been made in view of the above-described problems, and an object thereof is a network system in which the OSPF protocol operates, and monitors an OSPF packet, detects an abnormality, and presents an improvement plan. It is to provide a network system capable of

  In order to achieve the above object, according to one aspect of the present disclosure, an OSPF unicast routing protocol includes at least one network monitoring device and an integrated monitoring device that monitors the network monitoring device in an integrated manner. LSA information distributed by each area border router and each AS border router by each of the network monitoring devices analyzing the LSA information in the link state update packet transmitted by each router. Each of the area boundary routers that detects the area boundary router and AS boundary router that distributes LSA information exceeding a predetermined threshold as threshold excess information and includes the threshold excess information And the number of LSA information distributed by each AS border router, ABR / ASBR information And a means for notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information, and the integrated monitoring device maps the configuration of the network system on the GUI. A means for displaying and managing the notified distribution subnet information and ABR / ASBR information in units of areas, including the threshold excess information, identifying and displaying each area border router and each AS border router on the map; And a means for displaying the distribution subnet information of the identified area border router or AS border router according to a user operation.

  In a preferred aspect, the integrated monitoring device further comprises means for analyzing and displaying a network-aggregable subnet from distribution subnet information of each area border router and each AS border router.

  Furthermore, according to another aspect of the disclosed technology, a network monitoring apparatus and an integrated monitoring apparatus used in the above-described system and a method executed in the above-described system are provided.

  According to the disclosed network system, each router operating as an area border router (ABR) or an AS border router (ASBR) can be easily grasped in the OSPF network. It becomes easy to identify the routers that are the aggregation points. In addition, since it is possible to easily grasp the LSA route information distributed by each router of ABR or ASBR, it is possible to easily grasp the network size, detect subnet information that should not be originally distributed, etc. It becomes.

  Furthermore, by presenting network information that can be aggregated from the LSA information of each router, it is possible to reduce the number of LSA distributions and prevent the routing table from becoming too large in each router. As a result, it is possible to easily reduce the memory usage and CPU load in each router.

  Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. FIG. 1 is a diagram illustrating a configuration example of a network to which the disclosed technique is applied. The network shown in FIG. 1 is an IP network in which the OSPF unicast routing protocol operates, and includes a plurality of networks N1, N2, N3, N4, N5, and N6. A plurality of routers R1-1, R1-2, R1-3, R1-4, and R1-5 are connected to the network N1. As shown in FIG. 1, a plurality of routers are similarly connected to each of the networks N2, N3, N4, N5, and N6.

  Also, the routers R1-4, R2-5, and R3-2 are first hop routers (FHRs) of the terminal devices 102, 104, and 106 each having a camera mechanism. In addition, monitor terminal devices are appropriately arranged like the monitor terminal device 110 connected to the router R4-2. Also, each of the routers R1-4, R1-5, R3-2, and R3-3 is an area border router (ABR). Furthermore, the router R2-4 is an AS boundary router (ASBR).

  A network monitoring device NM1 is provided between the router R1-5 and the router R2-2. Similarly, each of the network monitoring devices NM2, NM3, NM4, and NM5 is disposed between two routers. The router R1-2 is connected to a manager device 100 as an integrated monitoring device that integrally monitors the network monitoring devices NM1 to NM5.

  FIG. 2 is a diagram illustrating a configuration of a network system according to an embodiment of the disclosed technology. The network configuration shown in FIG. 2 substantially corresponds to the network configuration shown in FIG. However, the plurality of networks N1, N2, N3, N4, N5, and N6 shown in FIG. 1 are respectively the head office, the A office, the B office, the C office, the D office, and the E in FIG. Shown as each network of offices. Also, the name of the router has been changed to one using “L3SW” meaning a layer 3 switch. Also, the area border router (ABR) and the AS border router (ASBR) are changed. Reference numerals 202 and 204 denote terminal devices including a camera mechanism.

  FIG. 3 is a diagram illustrating a functional configuration of a network monitoring apparatus according to an embodiment of the disclosed technique. FIG. 4 is a diagram showing various tables in the network monitoring apparatus. The network monitoring device is implemented as a computer system including a processor, a memory, an interface mechanism, and the like. Then, the function shown in FIG. 3 is realized by the processor operating according to the program stored in the memory. In the following description, the functional configuration of the network monitoring device NM1 disposed between L3SW_103 and L3SW_201 in FIG. 2 will be described as an example.

  The network monitoring device NM1 receives an IP (Internet Protocol) packet flowing between L3SW_103 and L3SW_201 from the interface IF # 1 or IF # 2. Then, the data transmission / reception unit 302 analyzes the received data and stores predetermined data in the OSPF routing information storage unit 304. Thereafter, the data transmission / reception unit 302 transfers the packet to the interface on the opposite side to the interface on the receiving side (for example, transfers the packet to IF # 2 when received from IF # 1).

  By the way, there are several types of LSA (Link State Advertisement) in a Link State Update packet. The type 3 LSA is called a network summary LSA (Network-Summary-LSA). The network summary LSA has a network address of an inter-area route in the Link State ID field, an area border router (ABR) router ID in the Advertising Router field, and an area in the Network Mask field. Including the subnet mask of the inter-path route.

  The type 5 LSA is called an AS external LSA (AS-External-LSA). The AS external LSA has an external route network address in the Link State ID field, an AS border router (ASBR) router ID in the Advertising Router field, and an external route in the network mask field. Including the subnet mask. Further, the type 7 LSA includes the same information as the type 5 LSA.

  The data transmission / reception unit 302 collects and analyzes each of type 3, type 5 and type 7 LSA information, thereby creating a distribution subnet information table shown in FIG. 4 in the OSPF routing information storage unit 304. That is, this table is an accumulation of LSA type, subnet information, mask information, and advertisement source router ID.

  On the other hand, the network monitoring device receives, from the interface IF # 3, the LSA number threshold information for each router serving as an area border router (ABR) or AS border router (ASBR) from the manager device 100. Then, the data transmission / reception unit 302 constructs the threshold information table shown in FIG. 4 in the OSPF-LSA threshold information storage unit 306 and registers the reception information. The manager communication unit 308 transmits the response information from IF # 3 to the manager device 100.

  Next, the OSPF routing information analysis unit 310 creates the ABR / ASBR information table shown in FIG. 4 based on the distribution subnet information table and the threshold information table, and stores the table in the ABR / ASBR information storage unit 312. To do. This table includes the router type and the number of LSAs for each router ID obtained from the distribution subnet information table. The number of LSAs includes the number of network summary LSAs, the number of AS external LSAs (including the number of type 7), and the total value thereof.

  Further, the table of ABR / ASBR information also includes threshold excess information that is a result of comparing the number of LSAs (total value) with the threshold for the corresponding router ID. Then, the data transmitting / receiving unit 302 transmits the distribution subnet information and the ABR / ASBR information shown in FIG. 4 to the manager device, triggered by the update of the information by receiving the link state update packet.

  FIG. 5 is a diagram showing a GUI (Graphical User Interface) display screen in the manager device. The manager device is an integrated monitoring device capable of IP communication with each network monitoring device, and is implemented as a computer system including a processor, a memory, a display, an interface mechanism, and the like. And an integrated monitoring function is implement | achieved when a processor operate | moves according to the program stored in memory. The user can register the IP address and network configuration of each router in the manager device, and the manager device can display an IP network configuration diagram as shown in FIG. 5 on the GUI.

  Regarding the monitoring range of each network monitoring device, one network monitoring device is essential for one OSPF area of each autonomous system (AS). The AS number and OSPF area ID are shared between each network monitoring device and the manager device, and the correspondence between the area and the network monitoring device can be specified. As described above, the manager device manages distribution subnet information and ABR / ASBR information notified from the network monitoring device by IP communication in units of router IDs, that is, in units of AS numbers and area numbers.

  Then, the manager device gives identification information “ABR” or “ASBR” to the router device on the GUI corresponding to the router ID of the area border router (ABR) or the AS border router (ASBR) from the ABR / ASBR information. . For example, as shown in FIG. 5, “ABR” identification information is additionally displayed on the router devices L3SW_103 and L3SW_104 corresponding to the router ID of the area border router (ABR). Further, “ASBR” identification information is additionally displayed on the router devices L3SW_204, L3SW_302, and L3SW_303 corresponding to the router ID of the AS border router (ASBR).

  FIG. 6 is a diagram showing an area border router detailed information screen in the manager device. When the user clicks the identification information “ABR” or “ASBR” shown in FIG. 5, the manager device distributes the area border router (ABR) or AS border router (ASBR) as shown in FIG. The “distribution subnet list” indicating the distribution subnet information being displayed is displayed on the GUI. Further, the manager device enables the user to set the LSA number threshold information (that is, the distribution upper limit value of the number of LSAs for each OSPF area) on the GUI by this “distribution subnet list”. This LSA number threshold information is notified from the manager device to the network monitoring device as described above.

  When the user presses a “display” button provided in the “details” column of this “distribution subnet list” screen, the manager device displays the “distribution subnet details” screen shown in FIG. The manager device can determine LSA information that can aggregate (integrate) network subnet information from the distribution subnet information. As shown in FIG. 6, the manager device presents “route aggregation example” in “distribution subnet details”. The aggregation algorithm will be described later.

  FIG. 7 is a diagram showing a detailed information screen for an over-threshold LSA distribution router in the manager device. As described above, when the network monitoring device detects an area that manages the LSA exceeding the LSA threshold number, the network monitoring device adds the excess information to the ABR / ASBR information and notifies the manager device. Based on the ABR / ASBR information, the manager device can identify a router that is in an over-threshold state.

  As shown in FIG. 7, the manager device assigns abnormality identification information to the router device on the GUI corresponding to the IP address of the router that is in the threshold excess state. In the example of FIG. 7, an abnormality icon 702 is assigned to the router L3SW_103. When the user selects the abnormality identification information by clicking the abnormality icon 702 on the GUI, the manager device confirms the user by displaying the detailed information about the over-threshold LSA distribution router as shown in FIG. Let This information includes the date and time of occurrence, router ID, area ID, threshold, and number of subnet distributions.

  FIG. 8 is a flowchart showing an aggregation example calculation algorithm in the manager device. Route aggregation, that is, aggregation of the number of LSAs, can be performed for type 3 and type 5 (including type 7) LSAs having subnet information. For type 3 LSAs, aggregation setting is possible for LSAs managed by an area border router (ABR). For type 5 LSAs, aggregation settings can be made for LSAs managed by the AS border router (ASBR). Aggregation is performed during LSA distribution between OSPF areas or ASs.

  The manager device calculates a network-aggregable subnet as an example of aggregation from the ABR / ASBR information and the distribution subnet information managed by the manager device. In the following, the algorithm will be described by taking the case of using Type 3 LSA as an example.

  First, the manager device acquires subnet information and mask information for each of the target area and the non-target router of the aggregation target router from the distribution subnet information shown in FIG. 4 (step 802). These pieces of information are “aggregated address information”, and an example of the acquisition is shown in FIG.

  Next, the manager device increases the mask width of the mask information by one bit in one of the aggregate address information for the target router, and calculates the aggregate subnet information by AND operation of the expanded mask information and the subnet information (step) 804). An example of the calculation is shown in FIG.

  Next, the manager device searches whether the subnet information included in the aggregated subnet information exists in the aggregated address information of the target area of the target router (step 806). An example of the search is shown in FIG.

  When the subnet information included in the aggregate subnet information exists in the aggregate address information of the target area of the target router, the manager device has the subnet information included in the aggregate subnet information in the aggregate address information of the non-target router. Whether or not is searched (step 808).

  As illustrated in FIG. 12, when the subnet information included in the aggregate subnet information does not exist in the aggregate address information of the non-target router, the manager device returns to Step 804. Then, the manager device continues the process of acquiring further aggregated subnet information by further expanding the mask width of the mask information by 1 bit.

  On the other hand, as illustrated in FIG. 13, when the subnet information included in the aggregated subnet information exists in the aggregated address information of the non-target router, the subnet related to the non-target router is aggregated. . Therefore, the manager device sets the aggregated subnet information up to the previous mask width, that is, the mask width before 1 bit wide as an aggregation example, and ends the aggregation example search (step 810). Then, the manager device searches for an aggregation example for the next subnet information.

  In step 806, if the subnet information included in the aggregated subnet information does not exist in the aggregated address information of the target area of the target router, the manager device determines whether the aggregated subnet information has already been acquired (step 812). ). If the aggregate subnet information has not yet been acquired, the manager device returns to step 804 and continues processing. On the other hand, if the aggregate subnet information has already been acquired, the manager device uses the aggregate subnet information as an aggregation example, and ends the search for the aggregation example (step 814). Then, the manager device searches for an aggregation example for the next subnet information.

  Regarding the above embodiment, the following supplementary notes are disclosed.

(Supplementary note 1) A network system including at least one network monitoring device and an integrated monitoring device that monitors the network monitoring device in an integrated manner and that operates the OSPF unicast routing protocol, each of the network monitoring devices But,
Means for periodically monitoring LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router;
Area boundary routers and AS boundary routers that distribute LSA information exceeding a predetermined threshold are detected as threshold excess information, and the number of LSA information that each area boundary router and each AS boundary router includes is included. Means for obtaining as ABR / ASBR information;
Means for notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
The integrated monitoring device comprises:
Means for displaying the configuration of the network system as a map on the GUI;
The notified distribution subnet information and ABR / ASBR information are managed for each area, and each area border router and each AS border router are identified and displayed on the map including the threshold excess information. Means for displaying distribution subnet information of an area border router or AS border router according to a user operation;
A network system comprising:

  (Supplementary note 2) The network system according to supplementary note 1, wherein the integrated monitoring device further includes means for analyzing and displaying a subnet that can be aggregated from the distribution subnet information of each area border router and each AS border router.

(Supplementary Note 3) In a network system in which the OSPF unicast routing protocol operates, a network monitoring device that is integrally monitored by an integrated monitoring device,
Means for periodically monitoring LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router;
Area boundary routers and AS boundary routers that distribute LSA information exceeding a predetermined threshold are detected as threshold excess information, and the number of LSA information that each area boundary router and each AS boundary router includes is included. Means for obtaining as ABR / ASBR information;
Means for notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
A network monitoring apparatus comprising:

(Supplementary Note 4) In a network system in which the OSPF unicast routing protocol operates, an integrated monitoring device that integrally monitors at least one network monitoring device,
ABR / ASBR information that is the number of LSA information distributed by each area border router and each AS border router, including distribution subnet information that is LSA information delivered by each area border router and each AS border router, and threshold excess information; Means for receiving as a notification from each network monitoring device;
Means for displaying the configuration of the network system as a map on the GUI;
The notified distribution subnet information and ABR / ASBR information are managed for each area, and each area border router and each AS border router are identified and displayed on the map including the threshold excess information. Means for displaying distribution subnet information of an area border router or AS border router according to a user operation;
An integrated monitoring device.

  (Supplementary note 5) The integrated monitoring device according to supplementary note 4, further comprising means for analyzing and displaying a subnet that can be aggregated from the distribution subnet information of each area border router and each AS border router.

(Supplementary Note 6) A method of monitoring a unicast routing packet, comprising: at least one network monitoring device and an integrated monitoring device for monitoring the network monitoring device in a network system in which the OSPF unicast routing protocol operates. Because
A step in which each network monitoring device periodically monitors LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router. When,
Each network monitoring device detects an area border router and an AS border router that deliver LSA information exceeding a predetermined threshold as threshold excess information, and each area border router and each AS border router including the threshold excess information delivers Acquiring the number of LSA information to be performed as ABR / ASBR information;
Each network monitoring device notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
The integrated monitoring device displaying the configuration of the network system on a GUI as a map;
The integrated monitoring apparatus manages the notified distribution subnet information and ABR / ASBR information for each area, and displays each area border router and each AS border router on the map, including the threshold excess information. Displaying the distribution subnet information of the identified area border router or AS border router according to a user operation;
A method comprising:

  (Supplementary note 7) The method according to supplementary note 6, further comprising the step of the integrated monitoring device analyzing and displaying a network-aggregable subnet from distribution subnet information of each area border router and each AS border router.

(Supplementary Note 8) In a network system in which the OSPF unicast routing protocol operates, a program for causing a computer to function as a network monitoring device that is integrally monitored by the integrated monitoring device,
Periodically analyzing LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router;
Area boundary routers and AS boundary routers that distribute LSA information exceeding a predetermined threshold are detected as threshold excess information, and the number of LSA information that each area boundary router and each AS boundary router includes is included. Obtaining as ABR / ASBR information;
Notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
A program for running

(Supplementary Note 9) In a network system in which the OSPF unicast routing protocol operates, a program for causing a computer to function as an integrated monitoring device that monitors at least one network monitoring device in an integrated manner,
ABR / ASBR information that is the number of LSA information distributed by each area border router and each AS border router, including distribution subnet information that is LSA information delivered by each area border router and each AS border router, and threshold excess information; Receiving as a notification from each network monitoring device;
Displaying the configuration of the network system as a map on the GUI;
The notified distribution subnet information and ABR / ASBR information are managed for each area, and each area border router and each AS border router are identified and displayed on the map including the threshold excess information. Displaying the distribution subnet information of the area border router or AS border router according to the user operation;
A program for running

  (Supplementary note 10) The program according to supplementary note 9, further causing the computer to execute a step of analyzing and displaying a network-aggregable subnet from distribution subnet information of each area border router and each AS border router.

It is a figure which shows the structural example of the network to which this indication technique is applied. It is a figure which shows the structure of the network system which concerns on one Embodiment of this indication technique. It is a figure which shows the function structure of the network monitoring apparatus which concerns on one Embodiment of this indication technique. It is a figure which shows the various tables in a network monitoring apparatus. It is a figure which shows the GUI display screen in a manager apparatus. It is a figure which shows the area border router detailed information screen in a manager apparatus. It is a figure which shows the threshold value excess LSA delivery router detailed information screen in a manager apparatus. It is a flowchart which shows the aggregation example calculation algorithm in a manager apparatus. It is a figure which illustrates acquisition of the aggregate address information in a manager apparatus. It is a figure which illustrates calculation of the aggregate subnet information in a manager apparatus. It is a figure which shows the example which searches aggregate subnet information in the address information of a target router in a manager apparatus. It is a figure which shows the 1st example which searches aggregate subnet information in the address information of a non-target router in a manager apparatus. It is a figure which shows the 2nd example which searches aggregate subnet information in the address information of a non-target router in a manager apparatus.

Explanation of symbols

N1 to N6 network R1-1 to R6-3 router NM1 to NM5 Network monitoring device 100 Manager device (integrated monitoring device)
102, 104, 106 Terminal device 110 Monitor terminal device 202, 204 Terminal device 302 Data transmission / reception unit 304 OSPF routing information storage unit 306 OSPF-LSA threshold information storage unit 308 Manager communication unit 310 OSPF routing information analysis unit 312 ABR / ASBR information storage Part 702 Abnormal icon

Claims (7)

A network system comprising at least one network monitoring device and an integrated monitoring device that monitors the network monitoring device in an integrated manner, wherein the OSPF unicast routing protocol operates, and each of the network monitoring devices includes:
Means for periodically monitoring LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router;
Area boundary routers and AS boundary routers that distribute LSA information exceeding a predetermined threshold are detected as threshold excess information, and the number of LSA information that each area boundary router and each AS boundary router includes is included. Means for obtaining as ABR / ASBR information;
Means for notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
The integrated monitoring device comprises:
Means for displaying the configuration of the network system as a map on the GUI;
The notified distribution subnet information and ABR / ASBR information are managed for each area, and each area border router and each AS border router are identified and displayed on the map including the threshold excess information. Means for displaying distribution subnet information of an area border router or AS border router according to a user operation;
A network system comprising:   The network system according to claim 1, wherein the integrated monitoring device further comprises means for analyzing and displaying a network aggregateable subnet from distribution subnet information of each area border router and each AS border router. In a network system in which the OSPF unicast routing protocol operates, a network monitoring device that is integrally monitored by an integrated monitoring device,
Means for periodically monitoring LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router;
Area boundary routers and AS boundary routers that distribute LSA information exceeding a predetermined threshold are detected as threshold excess information, and the number of LSA information that each area boundary router and each AS boundary router includes is included. Means for obtaining as ABR / ASBR information;
Means for notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
A network monitoring apparatus comprising: In a network system in which the OSPF unicast routing protocol operates, an integrated monitoring device that monitors at least one network monitoring device in an integrated manner,
ABR / ASBR information that is the number of LSA information distributed by each area border router and each AS border router, including distribution subnet information that is LSA information delivered by each area border router and each AS border router, and threshold excess information; Means for receiving as a notification from each network monitoring device;
Means for displaying the configuration of the network system as a map on the GUI;
The notified distribution subnet information and ABR / ASBR information are managed for each area, and each area border router and each AS border router are identified and displayed on the map including the threshold excess information. Means for displaying distribution subnet information of an area border router or AS border router according to a user operation;
An integrated monitoring device.   5. The integrated monitoring apparatus according to claim 4, further comprising means for analyzing and displaying a network aggregateable subnet from distribution subnet information of each area border router and each AS border router. In a network system in which the OSPF unicast routing protocol operates, a method for monitoring unicast routing packets, comprising: at least one network monitoring device; and an integrated monitoring device that monitors the network monitoring device in an integrated manner,
A step in which each network monitoring device periodically monitors LSA information distributed by each area border router and each AS border router as distribution subnet information by analyzing LSA information in a link state update packet transmitted by each router. When,
Each network monitoring device detects an area border router and an AS border router that deliver LSA information exceeding a predetermined threshold as threshold excess information, and each area border router and each AS border router including the threshold excess information delivers Acquiring the number of LSA information to be performed as ABR / ASBR information;
Each network monitoring device notifying the integrated monitoring device of the distribution subnet information and the ABR / ASBR information;
The integrated monitoring device displaying the configuration of the network system on a GUI as a map;
The integrated monitoring apparatus manages the notified distribution subnet information and ABR / ASBR information for each area, and displays each area border router and each AS border router on the map, including the threshold excess information. Displaying the distribution subnet information of the identified area border router or AS border router according to a user operation;
A method comprising:   7. The method according to claim 6, further comprising the step of analyzing and displaying a network-aggregable subnet from the distribution subnet information of each area border router and each AS border router.

Images