JP5862385B2 - COMMUNICATION MONITORING DEVICE, COMMUNICATION MONITORING METHOD, AND COMMUNICATION MONITORING PROGRAM - Google Patents

Description

  The present invention relates to a communication monitoring apparatus, a communication monitoring method, and a communication monitoring program.

  When checking the quality of an audio stream such as RTP (Real-Time Transfer Protocol) that transfers audio in real time, it is necessary to capture RTP packets and RTCP (RTP Control Protocol) packets used in combination with RTP. .

  A communication monitoring device such as a probe device that collects packets flowing on the IP network collects RTP packets and RTCP packets. Then, the communication monitoring device acquires communication quality information such as a round trip time (RTT), an abnormal number of packets, and a jitter value based on the collected RTP packet and RTCP packet.

  Although the communication monitoring device does not collect RTP packets and RTCP packets, a technique is known in which the address of a specific packet is set in advance as a filter condition and the specific packet is extracted with the set filter condition.

  The communication monitoring apparatus collects all packets flowing through the IP network, and temporarily stores all collected packets in the storage unit. In the communication monitoring device, a technique for searching for a specific packet from all packets stored in a storage unit is known.

JP 2008-219127 A JP 2000-112852 A

  However, in the communication monitoring apparatus, it is necessary to set the addresses of specific packets such as RTP packets and RTCP packets as filter conditions in advance.

  In addition, in the communication monitoring device, there is no provision for the transmission interval of RTCP packets, so RTP packets are sequentially stored in the storage unit before acquisition of RTCP packets, and the storage capacity of the storage unit is exhausted only by RTP packets There is. In this case, since the RTCP packet cannot be acquired, there is a possibility that the RTT value cannot be obtained.

  An object of one aspect is to provide a communication monitoring apparatus, a communication monitoring method, and a communication monitoring program that can automatically set filter conditions and extract specific data reliably.

  An aspect of the disclosure includes a collection unit that collects traffic information including at least transmission source information, destination information, and destination port information related to communication data communicated on a network. Furthermore, the aspect of an indication has the production | generation part which produces | generates the filter conditions which extract specific data based on the said transmission source information in the said traffic information collected by the said collection part, the said destination information, and the said destination port information. Further, the disclosed aspect includes a capture unit that captures the specific data for a predetermined time from communication data communicated on the network based on the filter condition generated by the generation unit.

  In the disclosed aspect, it is possible to extract specific data reliably by automatically setting filter conditions.

FIG. 1 is an explanatory diagram illustrating an example of a transmission system according to the present embodiment. FIG. 2 is a block diagram illustrating an example of the configuration of the probe apparatus. FIG. 3 is an explanatory diagram illustrating an example of the contents stored in the statistical information storage unit. FIG. 4 is an explanatory diagram illustrating an example of the stored contents of the aggregate statistical information storage unit. FIG. 5 is an explanatory diagram showing an example of parameters in the statistical information and aggregate statistical information used for the filter condition. FIG. 6 is an explanatory diagram illustrating an example of the filter condition stored in the filter condition storage unit. FIG. 7 is an explanatory diagram illustrating an example of an operation image of the filter unit and the capture unit. FIG. 8 is an explanatory diagram showing an example of the contents stored in the quality confirmation information storage unit. FIG. 9 is a flowchart illustrating an example of the processing operation of the probe apparatus related to the traffic management process. FIG. 10 is a flowchart showing an example of the processing operation of the probe apparatus related to the voice quality confirmation process. FIG. 11 is a flowchart illustrating an example of a processing operation of the manager device related to the traffic aggregation process. FIG. 12 is an explanatory diagram illustrating an example of a communication device that executes a communication monitoring program.

  Hereinafter, embodiments of a communication monitoring device, a communication monitoring method, and a communication monitoring program disclosed in the present application will be described in detail based on the drawings. The disclosed technology is not limited by the present embodiment. Moreover, you may combine suitably each Example shown below in the range which does not cause contradiction.

  FIG. 1 is an explanatory diagram illustrating an example of a transmission system according to an embodiment. A transmission system 1 shown in FIG. 1 includes a PC (Personal Computer) device 2, a plurality of server devices 3, a plurality of L3 switches 4, a plurality of probe devices 5, and a manager device 6. The L3 switch 4 includes a routing table (not shown) and routes packets according to the destination in the transmission system 1. The probe device 5 is a communication monitoring device that monitors the state of the network connected between the L3 switch 4 and the L3 switch 4. Furthermore, the probe device 5 has a built-in function for monitoring packets communicating on the network and confirming the communication quality of the packets. The manager device 6 is a device that collects and integrally manages the monitoring results of the plurality of probe devices 5. Each probe device 5 communicates with other probe devices 5 and manager devices 6 using a network different from the network monitored by itself, for example.

  FIG. 2 is a block diagram illustrating an example of the configuration of the probe device 5. The probe device 5 illustrated in FIG. 2 includes a reception unit 11, a traffic management unit 12, a filter control unit 13, a filter unit 14, a capture unit 15, and a quality management unit 16. Further, the probe device 5 includes a traffic storage unit 20, a filter condition storage unit 30, a capture storage unit 40, and a quality confirmation information storage unit 50.

  The receiving unit 11 receives a packet communicating on the network connected between the L3 switch 4 and the L3 switch 4, copies the received packet, and returns the packet to the network. The traffic management unit 12 collects traffic information of each packet received by the reception unit 11 and stores the collected traffic information in the traffic storage unit 20. The traffic information is composed of a plurality of parameters in each packet. The traffic storage unit 20 includes a statistical information storage unit 21 and an aggregate statistical information storage unit 22. FIG. 3 is an explanatory diagram showing an example of the stored contents of the statistical information storage unit 21. The statistical information storage unit 21 shown in FIG. 3 includes a protocol type 20A, a VLAN (Virtual Local Area Network) 20B, a COS (Class Of Service) 20C, a TOS (Type Of Service) 20D, and a protocol number 20E. It is registered. Registered in the statistical information storage unit 21 are an IPDA (Destination Address: Internet Protocol Destination Address) 20F, an IPSA (Source Protocol: Internet Protocol Source Address) 20G, and a DA (Destination Address) port number 20H. Further, the statistical information storage unit 21 includes an SA (Source Address) port number 20I, a received packet number 20J, a received byte number 20K, an RTP / RTCP 20L, a jitter value 20M, an SSRC (Synchronization Source) 20N, and the like. Is registered.

  The protocol type 20A is an ID that identifies the protocol type of the packet. The VLAN 20B is an ID for identifying the VLAN of the packet. The COS 20C is an identifier that specifies the priority order of transmission / reception of the VLAN tag of the packet. The TOS 20D is an identifier that designates the transmission / reception priority set in the header of the IPv4 packet. The protocol number 20E is an identifier that identifies the protocol of the packet. The IPDA 20F is an address that identifies the destination of the packet. The IPSA 20G is an address that identifies the transmission source of the packet. The DA port number 20H is a port number that identifies the destination service of the packet. The SA port number 20I is a port number for identifying the service of the packet transmission source. The received packet number 20J is the number of received packets. The number of received bytes 20K is the data amount of the received packet. The RTP / RTCP 20L identifies an audio stream such as an RTP packet or an RTCP packet. The jitter value 20M indicates an average value and a maximum value of packet fluctuations. The SSRC 20N is an identifier indicating the same participant in the RTP session.

  FIG. 4 is an explanatory diagram illustrating an example of the stored contents of the aggregate statistical information storage unit 22. In the aggregated statistical information storage unit 22 shown in FIG. 4, statistical information obtained by consolidating a part of the statistical information by mask setting is registered. The parameter for mask setting can be specified by the user. Protocol type 20A, VLAN 20B, COS 20C, TOS 20D, protocol number 20E, IPDA 20F, IPSA 20G, and the like are registered in the aggregate statistical information storage unit 22. Further, in the aggregated statistical information storage unit 22, a DA port number 20H, an SA port number 20I, a received packet number 20J, a received byte number 20K, and the like are registered.

  The traffic management unit 12 generates an entry based on the packet information received by the reception unit 11 and determines whether the entry has been registered in the statistical information storage unit 21. If the entry has already been registered in the statistical information storage unit 21, the traffic management unit 12 updates and registers the entry in the corresponding statistical information.

  Further, when the entry is not registered in the statistical information storage unit 21 and there is a free area in the statistical information storage unit 21, the traffic management unit 12 newly registers the entry as statistical information in the statistical information storage unit 21. To do.

  Further, when there is no free area in the statistical information storage unit 21, the traffic management unit 12 determines whether or not the entry has been registered in the aggregate statistical information storage unit 22. Note that whether or not the entry has been registered in the aggregate statistical information storage unit 22 by the traffic management unit 12 is, for example, a value other than the value of the DA port 20H when the entry with the DA port number 20H masked is registered. Is determined as a search key. If the entry has already been registered in the aggregate statistical information storage unit 22, the traffic management unit 12 updates and registers the entry in the corresponding aggregate statistical information. Further, when the entry is not registered in the aggregate statistical information storage unit 22, the traffic management unit 12 newly registers the entry in the aggregate statistical information storage unit 22 as aggregate statistical information.

  The traffic management unit 12 automatically deletes the statistical information from the statistical information storage unit 21 when the statistical information is not registered for update for a predetermined time from the time when the statistical information is registered in the statistical information storage unit 21. To do. In addition, when the aggregate statistical information is not updated and registered for a predetermined time from the time when the aggregate statistical information is registered in the aggregate statistical information storage unit 22, the traffic management unit 12 stores the aggregate statistical information in the aggregate statistical information storage unit 22. Remove automatically from.

  The filter control unit 13 determines whether the statistical information of the audio stream or the aggregated statistical information is based on the RTP / RTCP 20L in the statistical information storage unit 21 and the aggregated statistical information storage unit 22. FIG. 5 is an explanatory diagram showing an example of parameters in the statistical information and aggregate statistical information used for the filter condition. The filter control unit 13 generates an audio stream filter condition based on the audio stream statistical information or the aggregated statistical information illustrated in FIG. 5. Note that the filter control unit 13 generates a filter condition for extracting, for example, a packet of an audio stream related to the audio stream in the statistical information and the aggregate statistical information, for example, relating to the IPDA 20F, IPSA 20G, and DA port number 20H. The audio stream is, for example, an RTP packet that transfers an audio packet and an RTCP packet that is an RTP control packet.

  The filter control unit 13 generates a filter condition for the audio stream, and stores the generated filter condition in the filter condition storage unit 30. FIG. 6 is an explanatory diagram showing an example of the contents stored in the filter condition storage unit 30. The filter condition storage unit 30 illustrated in FIG. 6 stores a filter condition for each filter target 30A. The filter conditions include IPDA 30B, IPSA 30C, and DA port number 30D.

  The filter control unit 13 sets the filter condition stored in the filter condition storage unit 30 in the filter unit 14. Based on the set filter condition, the filter unit 14 extracts packets of the audio stream to be filtered from the packet information received by the receiving unit 11.

  The capture unit 15 captures a packet to be filtered extracted by the filter unit 14 in accordance with a regular capture instruction for a certain period of time. FIG. 7 is an explanatory diagram illustrating an example of an operation image of the filter unit 14 and the capture unit 15. As shown in FIG. 7, for example, the reception unit 11 receives and copies RTP “2”, RTCP “2”, RTP “1”, RTCP “1”, and HTTP packets on the network. Then, the filter unit 14 extracts specific packets of RTP “1”, RTCP “1”, RTP “2”, and RTCP “2” based on the filter condition of FIG. Then, the capture unit 15 starts the capture operation of the specific packet extracted by the filter unit 14, and stops the capture operation after a predetermined time has elapsed. As a result, the capture unit 15 stores the specific packets of RTP “1”, RTCP “1”, RTP “2”, and RTCP “2” for a predetermined time in the capture storage unit 40 as capture data.

  The quality management unit 16 includes an RTP / RTCP search unit 16A and a quality confirmation unit 16B. The RTP / RTCP search unit 16A searches for capture data of the same session from the capture data stored in the capture storage unit 40 based on SSRC. The quality confirmation unit 16B calculates the round trip time (RTT: Round Trip Time), the number of packet abnormalities, and the jitter value of the audio stream based on the RTP packet and the RTCP packet in the retrieved capture data.

  Furthermore, the quality confirmation unit 16B calculates an RTT value using the RTCP packet. Further, the quality confirmation unit 16B detects the number of abnormalities such as packet loss, duplication and inversion based on the sequence number of the RTP packet. For example, the quality confirmation unit 16B calculates the difference D between the two RTP packets i and j by D (i, j) = (Rj−Ri) − (Sj−Si) = (Rj−Sj) − (Ri -Si). Note that the time stamp of the RTP packet i is Si, the reception time of the RTP packet i is Ri, the time stamp of the RTP packet j is Sj, and the reception time of the RTP packet j is Rj. The jitter value J is calculated by J = J + (| D (i−1, i) | −J) / 16 using the difference D between the RTP packet i and the previous RTP packet i−1. The RTP packet i and the RTP packet i-1 are RTPs of the same SSRC. Let MAX (Di) be the jitter maximum value and J be the jitter average deviation. The quality confirmation unit 16B calculates the jitter value using RFC1889 “RTP: A Transport Protocol for Real-Time Applications”.

  Furthermore, the quality confirmation unit 16B calculates the total voice quality (R value) based on the RTT value, the number of packet abnormalities, and the jitter value. The R value is an ITU-T recommendation G. 1079, for example, an index that can be calculated by substituting 20 parameters of the IP telephone network into the E-model calculation formula. The quality confirmation unit 16B calculates the R value by substituting the RTT, the packet abnormality number, and the jitter value into the E-model calculation formula. Further, the quality confirmation unit 16B determines the quality class by comprehensively determining the R value and the RTT value. The quality class has four levels A to D. For example, R value [> 80] and RTT value [<100 msec] are quality class A. The R value [> 70] and the RTT value [<150 msec] are quality class B. The R value [> 50] and the RTT value [<400 msec] are quality class C. The R value [≦ 50] and [≧ 400 msec] is the quality class D.

  The quality confirmation unit 16B stores the RTT value, the number of packet abnormalities, the jitter value, the R value, the quality class, and the like for each specific packet of the audio stream as quality confirmation information in the quality confirmation information storage unit 50. FIG. 8 is an explanatory diagram showing an example of the contents stored in the quality confirmation information storage unit 50. The quality confirmation information storage unit 50 shown in FIG. 8 stores quality confirmation information such as the RTT value 51D, the packet abnormality number 51E, and the jitter value 51F for each of the IPDA 51A, IPSA 51B, and SSRC 51C. Furthermore, the quality confirmation unit 16B stores the storage contents of the quality confirmation information storage unit 50 in the statistical information storage unit 21 together with the statistical information. The quality confirmation information includes R value, class quality, communication rate, and the like.

  The manager device 6 periodically requests statistical information and aggregate statistical information from each probe device 5. Each probe device 5 reads the statistical information and the aggregated statistical information stored in the statistical information storage unit 21 and the aggregated statistical information storage unit 22 in response to a request from the manager device 6, and the read statistical information and the aggregated statistical information Is transmitted to the manager device 6. The manager device 6 stores statistical information and aggregate statistical information received from each probe device 5.

  For each piece of statistical information, the manager device 6 determines whether the comparison target of statistical information is less than a reference threshold value. Note that the reference threshold is a threshold for removing statistical information traffic from the management target. For example, the manager device 6 calculates the traffic rate as a comparison target by dividing the difference between the number of received bytes 20K at the current collection and the number of received bytes 20K at the previous collection in the statistical information by the collection interval time. Then, the manager device 6 determines whether or not the comparison target traffic rate is less than the reference threshold. When the comparison target is less than the reference threshold, the manager device 6 sets the statistical information out of management because the traffic volume of the statistical information is small. Then, the manager device 6 requests the probe device 5 to delete the statistical information that is not managed. Each probe device 5 deletes statistical information that is not managed from the statistical information storage unit 21.

  Further, the manager device 6 determines, for each aggregated statistical information, whether or not the comparison target of the aggregated statistical information is less than the reference threshold value. Set. Then, the manager device 6 requests the probe device 5 to delete the aggregate statistical information that is not managed. Each probe device 5 deletes the aggregate statistical information that has been excluded from management from the aggregate statistical information storage unit 22.

  Next, the operation of the transmission system 1 of this embodiment will be described. FIG. 9 is a flowchart illustrating an example of processing operation of the probe device 5 related to traffic management processing. In the traffic management process shown in FIG. 9, statistical information or aggregate statistical information is generated based on the received packet information, and the statistical information is registered in the statistical information storage unit 21, and the aggregate statistical information is registered in the aggregate statistical information storage unit 22. It is processing to do. In FIG. 9, the traffic management unit 12 collects packet information received by the receiving unit 11 (step S11). The traffic management unit 12 generates an entry based on the collected packet information (step S12).

  The traffic management unit 12 searches the statistical information in the statistical information storage unit 21 using the generated entry as a search key (step S13). Based on the search result, the traffic management unit 12 determines whether the entry has been registered in the statistical information storage unit 21 (step S14). If the entry has been registered (Yes at Step S14), the traffic management unit 12 updates and registers the entry in the corresponding statistical information (Step S15), and ends the processing operation illustrated in FIG. The traffic management unit 12 updates and registers, for example, by adding the number of received packets and the number of received bytes of the entry to the number of received packets and the number of received bytes in the statistical information.

  If the entry is not registered in the statistical information storage unit 21 (No at Step S14), the traffic management unit 12 determines whether there is a free area in the statistical information storage unit 21 (Step S16). If there is a free area in the statistical information storage unit 21 (Yes at Step S16), the traffic management unit 12 registers the entry as statistical information in the statistical information storage unit 21 (Step S17), and ends the processing operation shown in FIG. To do.

  If there is no free area in the statistical information storage unit 21 (No at Step S16), the traffic management unit 12 searches the aggregate statistical information in the aggregate statistical information storage unit 22 using the entry as a search key (Step S18). Based on the search result, the traffic management unit 12 determines whether the entry has been registered in the aggregate statistical information storage unit 22 (step S19).

  If the entry has been registered (Yes at Step S19), the traffic management unit 12 aggregates the entry, updates and registers the aggregated entry in the corresponding aggregate statistical information (Step S20), and ends the processing operation illustrated in FIG. To do.

  Further, when the entry is not registered in the aggregate statistical information storage unit 22 (No at Step S19), the traffic management unit 12 aggregates the entries. The traffic management unit 12 aggregates entries by mask setting some setting values in the entries. Furthermore, the traffic management unit 12 registers the aggregated entry as aggregated statistical information in the aggregated statistical information storage unit 22 (step S21), and ends the processing operation illustrated in FIG.

  In the traffic management processing shown in FIG. 9, traffic information, for example, statistical information and aggregate statistical information is generated based on packet information communicated on the network, and the generated statistical information and aggregate statistical information are collected in the statistical information storage unit 21 and aggregated. Update and register in the statistical information storage unit 22. As a result, each probe device 5 can manage traffic information of packets that communicate on the arranged network.

  FIG. 10 is a flowchart showing an example of the processing operation of the probe device 5 related to the voice quality confirmation processing. The voice quality confirmation process shown in FIG. 10 sets the filter condition of the voice stream based on the statistical information in the statistical information storage unit 21, captures the voice packet extracted by the filter condition for a certain time, This is a process for obtaining voice quality confirmation information based on this.

  In FIG. 10, the filter control unit 13 designates the statistical information of the audio stream based on the RTP / RTCP 20L in the statistical information stored in the statistical information storage unit 21 (step S31). The filter control unit 13 generates a filter condition for the filter unit 14 based on the designated statistical information (step S32). The filter control unit 13 stores the filter condition of the generated audio stream in the filter condition storage unit 30 (step S33). The filter control unit 13 sets the stored filter condition in the filter unit 14 (step S34).

  And the capture part 15 starts the capture operation of the received packet extracted by the filter part 14 (step S35). The capture unit 15 sequentially stores the captured packets as capture data in the capture storage unit 30 (step S36). The capture unit 15 determines whether or not a certain time has elapsed since the start of capture (step S37).

  If the predetermined time has not elapsed since the start of capture (No at Step S37), the capture unit 15 proceeds to Step S36 to sequentially store the captured packets in the capture storage unit 30.

  The capture unit 15 stops the capture operation when a certain time has elapsed from the start of capture (Yes at Step S37) (Step S38). The RTP / RTCP search unit 16A in the quality management unit 16 searches for the same SSRC in the capture data stored in the capture storage unit 40, that is, the RTP packet and RTCP packet of the same session (step S39). The quality confirmation unit 16B in the quality management unit 16 acquires voice quality confirmation information based on the searched RTP packet and RTCP packet of the same session (step S40). The quality confirmation unit 16B calculates the RTT value, the number of packet abnormalities, and the jitter value based on the searched RTP packet and RTCP packet of the same session. Further, the quality confirmation 16B acquires the R value and the quality class based on the RTT value, the number of packet abnormalities, and the jitter value.

  The quality confirmation unit 16B stores the acquired voice quality confirmation information in the quality confirmation information storage unit 50 (step S41). Furthermore, the quality confirmation unit 16B updates and registers the voice quality confirmation information as the corresponding statistical information in the statistical information storage unit 21 (step S42), and ends the processing operation illustrated in FIG.

  In the audio quality confirmation process shown in FIG. 10, filter conditions are generated based on the statistical information of the audio stream in the statistical information storage unit 21, and specific RTP and RTCP packets are extracted by the filter unit 14 under the generated filter conditions. The voice quality confirmation process captures the extracted RTP and RTCP packets for a certain period of time. As a result, it is possible to automatically set a filter condition and reliably extract audio streams such as specific RTP and RTCP packets.

  Furthermore, in the voice quality confirmation process, an RTT value, a packet abnormality number, and a jitter value related to the voice stream are acquired based on the specific captured RTP and RTCP packets. In the audio quality confirmation process, the R value and the quality class of the audio stream are acquired based on the RTT value, the number of packet abnormalities, and the jitter value of the specific audio stream, and the acquired audio quality confirmation information is stored in the quality confirmation information storage Store in the unit 50. As a result, it is possible to manage audio quality confirmation information related to the audio streams of RTP and RTCP packets.

  Although the filter control unit 13 generates the filter condition based on the statistical information, the filter control unit 13 may generate the audio stream filter condition based on the aggregate statistical information. In this case, it is assumed that the aggregate statistical information includes at least IPDA 20F, IPSA 20G, and DA port number 20H. The filter control unit 13 sets the generated filter condition in the filter unit 14 and captures specific RTP and RTCP packets extracted by the filter unit 14 for a certain period of time. Then, the quality confirmation unit 16B can acquire the RTT value, the number of packet abnormalities, the jitter value, the R value, and the quality class based on the captured RTP and RTCP packets.

  FIG. 11 is a flowchart showing an example of the processing operation of the manager device 6 related to the traffic counting process. The traffic totaling process shown in FIG. 11 is a process of collecting statistical information and aggregated statistical information stored in each probe apparatus 5 on the manager apparatus 6 side. In FIG. 11, the manager device 6 collects statistical information of each probe device 5 in the transmission system 1 (step S51), and stores the collected statistical information of each probe device 5 (step S52). The manager device 6 can manage traffic information on the network where the probe device 5 is arranged. The manager device 6 determines whether there is unspecified statistical information (step S53).

  When there is undesignated statistical information (Yes at Step S53), the manager device 6 designates undesignated statistical information (Step S54), and compares the comparison target of the statistical information with the reference threshold (Step S55). The comparison target is, for example, a traffic rate obtained by dividing the difference in the number of received bytes 20K between the current collection time and the previous collection time by the collection interval time. Further, the number of received packets 20J, the number of received bytes 20K, the RTT value, the jitter value, the R value, the quality class, etc. in the statistical information may be used. The manager device 6 determines whether or not the comparison target is less than the reference threshold based on the comparison result (step S56).

  When the comparison target is less than the reference threshold (Yes at Step S56), the manager device 6 sets the statistical information to be outside the management target (Step S57), and determines whether there is unspecified statistical information. The process proceeds to S53. If the comparison target is not less than the reference threshold (No at Step S56), the manager device 6 proceeds to Step S53 to determine whether there is unspecified statistical information.

  If there is no unspecified statistical information (No at Step S53), the manager device 6 determines whether there is statistical information that is not managed (Step S58). When there is statistical information that is not to be managed (Yes at Step S58), the manager device 6 requests each probe device 5 to delete statistical information that is not to be managed (Step S59), and ends the processing operation illustrated in FIG. . Note that the traffic management unit 12 in each probe device 5 receives statistical information that is not managed from the statistical information storage unit 21 when the manager device 6 requests deletion of statistical information that is not managed (No in step S58). delete.

  In the traffic totaling process shown in FIG. 11, the statistical information and the aggregated statistical information that the manager device 6 has acquired with each probe device 5 are periodically collected. As a result, the manager device 6 can manage the statistical information and aggregated statistical information acquired by each probe device 5.

  Further, the traffic aggregation process determines for each statistical information whether or not the comparison target of the statistical information is less than the reference threshold. If the comparison target is less than the reference threshold, the statistical information is set out of management target. As a result, the manager device 6 can reduce statistical information that is not managed.

  Further, in the traffic counting process, the manager device 6 requests each probe device 5 to delete the statistical information, and each probe device 5 responds to the request for deleting the statistical information that is not managed, Is deleted from the statistical information storage unit 21. As a result, each probe device 5 deletes statistical information that is not a management target, so that resources in the statistical information storage unit 21 can be effectively used.

  The manager device 6 designates not only the statistical information but also the unspecified aggregate statistical information, and determines whether or not the comparison target of the aggregate statistical information is less than the reference threshold. Then, when the comparison target of the aggregate statistical information is less than the reference threshold, the manager device 6 sets the aggregate statistical information out of the management target. As a result, the manager device 6 can reduce aggregate statistical information that is not managed.

  Further, the manager device 6 requests each probe device 5 to delete the aggregated statistical information, and each probe device 5 receives the aggregated statistical information that is not managed in response to the request for deleting the aggregated statistical information that is not managed. Delete from the aggregated statistical information storage unit 22. As a result, each probe device 5 deletes aggregate statistical information that is not a management target, so that resources in the aggregate statistical information storage unit 22 can be effectively used.

  The traffic management unit 12 according to the present embodiment registers traffic information in the traffic storage unit 20 based on all packets communicated on the network. The filter control unit 13 generates a filter condition based on the traffic information of the audio stream, and the filter unit 14 extracts specific RTP and RTCP packets using the generated filter condition. The capture unit 15 captures the extracted RTP and RTCP packets for a certain period of time. As a result, the probe device 5 can automatically set the filter condition and reliably extract the audio stream such as specific RTP and RTCP packets.

  Furthermore, the RTP / RTCP search unit 16A of this embodiment searches for the RTP and RTCP packets of the same SSRC from the RTP and RTCP packets captured by the capture unit 15 for a certain period of time. The quality confirmation unit 16B acquires voice quality confirmation information including the RTT value, the number of packet abnormalities, and the jitter value based on the retrieved RTP and RTCP packets. As a result, the probe device 5 can manage voice quality confirmation information of specific RTP and RTCP packets.

  Furthermore, the traffic management unit 12 of this embodiment stores the collected traffic information in the traffic storage unit 20. The traffic management unit 12 adds the voice communication quality information acquired by the quality confirmation unit 16B to the corresponding traffic information and updates and registers it in the traffic storage unit 20. As a result, the probe device 5 can manage the voice communication quality information together with the traffic information.

  Furthermore, the traffic management unit 12 according to the present embodiment requests that the traffic information to be compared is less than the reference threshold from the manager device 6 that integrally manages the traffic information registered in the traffic storage unit 20, and requests that the traffic information be deleted. Suppose that In this case, the traffic management unit 12 deletes the traffic information requested to be deleted from the traffic storage unit 20. As a result, the probe device 5 can reduce the storage capacity of the traffic storage unit 20 and effectively use the traffic storage unit 20.

  In the present embodiment, an entry to be monitored is automatically registered from the packet received by the probe device 5, and when the entry is an audio stream, audio quality confirmation is periodically performed. As a result, detailed traffic volume confirmation and quality confirmation can be performed without the user specifying a communication service operated on the network in advance. In addition, since quality check is regularly performed and the result is managed as statistical information, it is possible to check the quality retroactively.

  The date and time can be registered in the voice quality confirmation information stored in the quality confirmation information storage unit 50 and managed as a history.

  Moreover, in the said Example, although the probe apparatus 5 was illustrated as a communication monitoring apparatus, you may apply to routers, such as L3 switch, for example.

  In addition, each component of each part illustrated does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads and usage conditions. Can be configured.

  Furthermore, various processing functions performed in each device are performed on a CPU (Central Processing Unit) (or a microcomputer such as an MPU (Micro Processing Unit), MCU (Micro Controller Unit), etc.) in whole or in part. You may make it perform. Various processing functions may be executed entirely or arbitrarily on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or hardware based on wired logic. Needless to say.

  By the way, the various processes described in the present embodiment can be realized by executing a program prepared in advance on a communication device. Therefore, in the following, an example of a communication device that executes a program having the same function as the above embodiment will be described. FIG. 12 is an explanatory diagram illustrating a communication device that executes a communication monitoring program.

  A communication device 100 that executes the communication monitoring program illustrated in FIG. 12 includes a communication interface 111, a ROM (Read Only Memory) 112, a RAM (Random Access Memory) 113, and a processor 114 that controls the entire communication device 100. . The communication interface 111 is connected to a network through which communication packets can communicate.

  The ROM 112 stores in advance a communication monitoring program that exhibits the same function as in the above embodiment. Note that the communication monitoring program may be recorded on a recording medium readable by a drive (not shown) instead of the ROM 112. The recording medium may be, for example, a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory, or a semiconductor memory such as a flash memory. As shown in FIG. 12, the communication monitoring program is a collection program 112A, a generation program 112B, and a capture program 112C. Note that the programs 112A, 112B, and 112C may be integrated or distributed as appropriate.

  Then, the processor 114 reads these programs 112A, 112B, and 112C from the ROM 112, and executes each of the read programs. Then, as shown in FIG. 12, the processor 114 functions as the collection process 114A, the generation process 114B, and the capture process 114C with respect to each program 112A, 112B, and 112C.

  The processor 114 collects traffic information including at least transmission source information, destination information, and destination port information related to communication data communicated on the network. The processor 114 generates a filter condition for extracting specific data based on the transmission source information, the destination information, and the destination port information in the collected traffic information. Furthermore, the processor 114 captures specific data for a predetermined time from communication data communicated on the network based on the generated filter condition. As a result, it is possible to extract specific data reliably by automatically setting filter conditions.

DESCRIPTION OF SYMBOLS 1 Transmission system 5 Probe apparatus 6 Manager apparatus 12 Traffic management part 13 Filter control part 14 Filter part 15 Capture part 16 Quality management part 20 Traffic storage part 21 Statistical information storage part 22 Aggregate statistical information storage part 30 Filter condition storage part 40 Capture storage 50 Quality confirmation information storage unit

Claims (6)

A collection unit that collects traffic information including at least transmission source information, destination information, and destination port information related to communication data communicated on the network;
A generating unit that generates a filter condition for extracting specific data of the audio stream based on the transmission source information, the destination information , the destination port information , RTP information, and RTCP information in the traffic information collected by the collection unit; ,
A capture unit for the basis of the filter condition generated by the generating unit, for a predetermined time capture the specific data from the communication data communication over the network,
A search unit for searching for specific data related to the same session identifier from the specific data captured by the capture unit for the predetermined time;
A communication monitoring apparatus , comprising: an acquisition unit configured to acquire communication quality information related to the specific data including a round trip delay time based on RTP information and RTCP information in the specific data searched by the search unit. The acquisition unit
Based on the RTP information and the RTCP information in said specific data retrieved by the retrieval unit, characterized that you acquire the communication quality information relating to the specific data including at least the round trip time, packet abnormal number and jitter values The communication monitoring apparatus according to claim 1. A management unit that stores traffic information collected by the collection unit in a storage unit;
The acquisition unit
The communication monitoring apparatus according to claim 2, wherein the acquired communication quality information is added to corresponding traffic information and updated and registered in the storage unit. The management unit
When the traffic information stored in the storage unit in the communication monitoring device is integrated and managed, and the traffic information comparison target is less than a reference threshold, and deletion of the traffic information is requested, the deletion is performed. The communication monitoring apparatus according to claim 3, wherein the requested traffic information is deleted from the storage unit. A communication monitoring method of a communication monitoring apparatus for monitoring communication data communicated on a network,
The communication monitoring device includes:
Collecting traffic information including at least transmission source information, destination information and destination port information relating to communication data communicated on the network;
Based on the source information, the destination information , the destination port information , the RTP information, and the RTCP information in the collected traffic information, a filter condition for extracting specific data of the audio stream is generated,
Based on the generated filter condition, the specific data is captured for a predetermined time from communication data communicating on the network ,
Search the specific data related to the same session identifier from the specific data captured for the predetermined time,
Based on the searched RTP information and RTCP information in the specific data, communication quality information related to the specific data including a round trip delay time is acquired.
A communication monitoring method characterized by executing processing . A communication monitoring program that is executed by a communication device including a communication interface that monitors communication data communicated on each network in the system and a processor,
In the processor,
Collecting traffic information including at least transmission source information, destination information and destination port information relating to communication data communicated on the network;
Based on the source information, the destination information , the destination port information , the RTP information, and the RTCP information in the collected traffic information, a filter condition for extracting specific data of the audio stream is generated,
Based on the generated filter condition, the specific data is captured for a predetermined time from communication data communicating on the network ,
Search the specific data related to the same session identifier from the specific data captured for the predetermined time,
Based on the searched RTP information and RTCP information in the specific data, communication quality information related to the specific data including a round trip delay time is acquired.
A communication monitoring program for executing processing .

Images