JP6295681B2 - Communication analysis device, communication analysis system, communication analysis method, and program - Google Patents

Description

  The present invention relates to a communication analysis device, a communication analysis system, a communication analysis method, and a program, in particular, a communication analysis device, a communication analysis system, a communication analysis method, for communication between virtual machines (hereinafter referred to as VMs), And the program.

  In recent years, cloud systems are increasingly operated in a multi-tenant configuration. In the case of an IaaS (Infrastructure as a Service) type cloud system, a cloud system operator (hereinafter referred to as a cloud operator) prepares a host machine (hereinafter referred to as a host machine) for operating a VM. A cloud operator) implements a multi-tenant configuration by preparing a plurality of virtual machines on a host machine and lending them to a plurality of users (hereinafter referred to as tenant users).

  One tenant may be configured across multiple host machines. In other words, a plurality of VMs in a tenant may be distributed on a plurality of host machines. In this case, one VM may automatically move multiple host machines for the purpose of ensuring fault tolerance. As such a technique, for example, there is an existing technique called live migration.

  When a tenant is configured across a plurality of host machines, the host machine group is not necessarily physically located. The cloud service provider can construct a virtual network by a network tunneling technology such as VxLAN (Virtual eXtensible Local Area Network) and configure a tenant on the virtual network. In that case, even if a plurality of host machines are physically separated, the tenant can communicate as one network.

  Communication between VMs that are physically separated from each other generally goes through a WAN (Wide Area Network), so it often takes less bandwidth and round-trip time than communication within a LAN (Local Area Network). It will be slower. Therefore, even within the same tenant, if the physical distance of the host machine on which the VM runs is long, the communication speed between VMs may not be sufficient.

  In response to this situation, when the information on the communication status between VMs, that is, between which host machines is communicating between VMs and how much traffic is available, is optimal for operation. It is convenient because it is easy to make a conversion plan. In addition, it is better that this information can be referred to not only by the cloud operator but also by the tenant user.

  By the way, as a technique for statistically collecting the amount of communication for each content, there are standard protocols for flow aggregation such as NetFlow and IPFIX. If the virtual switch on the host machine or the physical switch along the route supports NetFlow etc., collect information on the communication flow between VMs by preparing a device or software that can receive and store NetFlow etc. It can be realized.

  The collected flow information includes information included in NetFlow, for example, source / destination IP address, VLAN information, and passing interface information on the switch. However, it is not easy for a cloud operator or a tenant administrator to determine whether the communication is directly completed within the same host machine.

  This situation is not limited to a tenant in a multi-tenant system, and may occur in other application systems that execute distributed processing.

  In relation to the above-mentioned problem, the following technologies are disclosed.

  Patent Document 1 discloses an apparatus for measuring a fine network delay even in a cloud network environment. This apparatus accumulates the flow information collected from the transfer apparatus, calculates the difference between the time when the packet is transmitted and the time when the response is received with reference to the accumulated flow information, and measures the delay. This apparatus sets key information for specifying a unit of traffic to be measured as a filtering condition.

  Patent Document 2 is a cloud system in which two bases are connected by a VPN (Virtual Private Network), a VLAN-ID (Virtual Local Area Network IDentIFier) is used between the bases, and communication is performed using other addresses within the bases. Is disclosed.

JP 2013-240017 JP 2013-162418 A

  The apparatuses and systems disclosed in the technologies of Patent Documents 1 and 2 do not manage or determine the relationship between communication and the host machine. An object of the present invention is to provide an apparatus, a method, and a program for determining whether communication between VMs executed on a plurality of host machines is communication completed within the same host machine.

  A communication analysis apparatus according to an embodiment of the present invention includes a switch number, a host number, and a connection terminal number of the communication network in a communication network in which a plurality of host devices including a virtual machine and a virtual switch are connected. Definition storage means for storing and history storage means for storing a record including a switch number, an input terminal number, an output terminal number, a communication address, and a communication time received from a relayed virtual switch for each communication between virtual hosts And from the history storage means, a first record whose output terminal number is a connection terminal number with the communication network, the input terminal number is a connection terminal number with the communication network, and the first record When a second record having the same communication address and communication time as the record is extracted, the host device obtained from the switch number of the first record; Comprising obtaining means for detecting communications between the host device obtained from the switch number of the second record, the.

  In a communication analysis method according to an embodiment of the present invention, a switch number of a virtual switch, a host number, and a connection terminal number of the communication network in a communication network in which a plurality of host devices including a virtual machine and a virtual switch are connected. For each communication between the virtual hosts, a record that includes the switch number, input terminal number, output terminal number, communication address, and communication time received from the relayed virtual switch is stored, and the output terminal number is the communication A first record that is a connection terminal number with a network, and a second record in which the input terminal number is a connection terminal number with the communication network, and the communication address and communication time coincide with the first record. Is extracted between the host device obtained from the switch number of the first record and the host device obtained from the switch number of the second record. To detect the signal.

  The apparatus according to the present invention can clarify whether communication between VMs executed on a plurality of host machines is communication completed within the same host machine.

FIG. 1 shows an example of the overall configuration of the communication analysis system 50. FIG. 2 is a configuration diagram of the communication control apparatus 10 according to the first embodiment. FIG. 3 shows the configuration of information stored in the history storage unit 12. FIG. 4 shows the configuration of the tenant table 62 stored in the definition storage unit 13. FIG. 5 shows the configuration of the switch table 63 stored in the definition storage unit 13. FIG. 6 is an operation flowchart of the acquisition unit 14. FIG. 7 is a configuration diagram of the communication control apparatus 10 according to the second embodiment.

<First Embodiment>
(Constitution)
FIG. 1 shows an example of the overall configuration of a communication analysis system 50 according to the present invention. The communication analysis system 50 is a cloud system. The communication analysis system 50 is configured by connecting a plurality of domains including a plurality of host devices 20 and a switch 30 connecting the host devices 20 via a WAN 40 (Wide Area Network). The communication analysis device 10 is connected to the switch 30 of any domain.

  In each host apparatus 20, a VM 29 and a virtual switch 22 are arranged. The VM 29 and the virtual switch 22 are virtually realized by software executed by the processor of the host device 20 that is a computer.

  The virtual switch 22 includes a plurality of connection terminals, that is, a connection interface, and is connected to the VM 29 and the switch 30. An identification number is assigned to each connection interface. Hereinafter, the connection interface connected to the VM 29 is referred to as an access IF 23 (where IF is an abbreviation of the interface), and the connection interface connected to the switch 30 is referred to as a trunk IF 24.

  The virtual switch 22 acquires communication flow information for all connection interfaces (access IF 23 and trunk IF 24) and transmits the communication flow information to the communication analysis device 10. Communication here is communication between VM29, for example.

  The communication speed between VMs 29 is the fastest between VMs 29 in the same host device 20, followed by VMs 29 in different host devices 20 in the same domain, and between VMs 29 in host devices 20 in different domains. Slowest. Therefore, it is a concern for the user how the communication between the VMs 29 is performed.

  In the example of the communication analysis system 50 shown in FIG. 1, the host devices 1 and 2 in the domain 1 are connected to the switch 1, and the host devices 3 and 4 in the domain 2 are connected to the switch 2. The switches 1 and 2 are connected via the WAN 40. The communication analysis device 10 is connected to the switch 1 of the domain 1.

  Each of the host devices 1 to 4 is provided with virtual switches 1 to 4, respectively. In addition, VM11 and VM12 are arranged in the host device 1. The host device 2 has a VN 21, the host device 3 has a VN 31, and the host device 4 has a VN 41.

  In the example of the communication analysis system 50 in FIG. 1, a different VLAN is assigned to each tenant to separate networks. For example, the tenant A is assigned VLAN10 including VM11, VM31, and VM41, and the tenant B is assigned VLAN20 including VM12 and VM21. In addition, in the virtual switch 22, the communication flow statistical function by NetFlow or the like is effectively set for each connection interface. In addition, the virtual switch 22 is set to include the VLAN number in the information to be collected. Such setting is possible by the technique described in Non-Patent Document 1.

"Sisco Systems NetFlow Services Export Version 9", B. Claise, Ed. Cisco Systems, October 2004 <http://www.ietf.org/rfc/rfc3954.txt> is there. The communication analysis device 10 includes a storage unit 11, a history storage unit 12, a definition storage unit 13, and an acquisition unit 14.

  The flow information transmitted from the virtual switch 22 is received by the storage unit 11 and stored in the history storage unit 12. The accumulation unit 11 reads information on the tenant from the definition storage unit 13, and classifies the flow information based on the information. The accumulation unit 11 stores the classified flow information separately for the flow DB 1 and the flow DB 2. Details of the classification process will be described later.

  The accumulated flow information (flow record 60) is acquired and analyzed in response to a request from the user, and is output together with the analysis result to a display device (not shown) of the communication analysis device 10. The request from the user is received by the acquisition unit 14, and the flow record 60 is acquired, analyzed, and output from the history storage unit 12 according to the request content.

  The storage unit 11 and the acquisition unit 14 are configured by logic circuits. The accumulating unit 11 and the acquiring unit 14 may be realized by a program stored in a memory (not shown) of the communication analysis device 10 that is a computer and executed by a processor (not shown). The history storage unit 12 and the definition storage unit 13 are storage devices such as disk devices.

  FIG. 3 shows the configuration of information stored in the history storage unit 12. The history storage unit 12 stores the flow record 60 and the flow direction 61 in association with each other.

  The flow record 60 includes the flow information received from the virtual switch 22 by the storage unit 11. The flow record 60 includes, for example, a collection switch name, a collection time, a VLAN number, an input IF, an output IF, a communication address, and a communication amount.

  The collection switch name is the switch name of the virtual switch 22 that collected the flow information that is the source of the flow record 60. The collection switch name is, for example, the virtual switch 1 in FIG.

  The collection time is the time when the virtual switch 22 collects the flow information that is the source of the flow record 60. The VLAN number is an identification number of a VLAN in which communication for which flow information has been acquired is performed. The VLAN number is, for example, VLAN10.

  The input IF is the number of the connection interface where the communication packet is input to the virtual switch 22. The output IF is the number of the connection interface from which the communication packet is output from the virtual switch 22.

  The communication address is, for example, a transmission source IP address, a transmission destination IP address, a transmission source TCP port number, and a transmission source TCP port number. The communication amount is a data amount of communication performed.

  The flow record 60 may include other information that can be collected by the flow aggregation protocol.

  The flow direction 61 indicates whether the communication crosses a plurality of virtual switches 22 (“outside”) or within one virtual switch 22 (“inside”). The storage unit 11 determines the flow direction 61 from the flow record 60 and information in a switch table 63 described later, and adds the flow direction 61 to the flow record 60.

  FIG. 4 shows the configuration of the tenant table 62 stored in the definition storage unit 13. The tenant table 62 includes, for each tenant, the tenant name and the VLAN number of the VLAN assigned to the tenant. The tenant table 62 may include the IP address of the VM 29 for each tenant.

  FIG. 5 shows the configuration of the switch table 63 stored in the definition storage unit 13. The switch table 63 includes, for each virtual switch 22, the virtual switch name, the name of the host device 20 to which the virtual switch 22 belongs, the domain information to which the host device 20 belongs, and the connection interface number of the trunk IF 24 or the access IF 23. Include.

(Operation)
First, accumulation of the flow record 60 and the flow direction 61 by the accumulation unit 11 will be described. Although the flow aggregation protocol is assumed to be NetFlow, other protocols may be used.

  Communication occurs between certain VM29s. This communication is, for example, communication from the VM 11 in FIG. 1 to another VM. Since this communication passes through at least the virtual switch 1, information collection by NetFlow is performed in the virtual switch 1. The collected flow information is transmitted from the virtual switch 1 to the communication analysis device 10.

  In the communication between VMs 29 whose source is the VM 11, the virtual switch 22 and the connection interface that are routed vary depending on the destination.

  1. When the transmission destination is VM 29 (for example, VM 12) on the same host device 20, communication passes only through the virtual switch 1. In the flow information collected on the virtual switch 1, the input IF is the access IF 23-11, and the output IF is the access IF 23-12.

  2. When the transmission destination is VM29 (for example, VM21) on another host device 20 in the same domain, the communication passes through virtual switch 1 and virtual switch 2. In the flow information collected by the virtual switch 1, the input IF is the access IF 23-11, and the output IF is the trunk IF 24-1. Further, in the flow information collected by the virtual switch 2, the input IF is the trunk IF 24-2, and the output IF is the access IF 23-21.

  3. When the destination is a VM 29 (for example, VM 31) on another host device 20 in another domain, the communication passes through the virtual switch 1 and the virtual switch 3. In the flow information collected by the virtual switch 1, the input IF is the access IF 23-11, and the output IF is the trunk IF 24-1. Further, in the flow information collected by the virtual switch 3, the input IF is the trunk IF 24-3, and the output IF is the access IF 23-31.

  In the above situations 1 to 3, the storage unit 11 searches the switch table 63 using the virtual switch name that transmitted the flow information as a key, and determines whether the input IF and the output IF are the trunk IF 24. Since the access IF 23 is a connection interface that is not the trunk IF 24, the storage unit 11 determines the access IF 23 from the switch table 63 in the same manner.

  The storage unit 11 of the communication analysis device 10 receives the flow information as described above from each virtual switch 22, classifies it according to the following algorithm, creates a flow record 60 and a flow direction 61, and stores them in the history storage unit 12. To do.

1. When the flow information input IF is the access IF 23, the storage unit 11 stores the flow record 60 in the flow DB 1. When storing, the storage unit 11 stores the flow direction 61 as “out” when the output IF is the trunk IF 24, and stores the flow direction 61 as “in” otherwise.
2. When the flow information input IF is the trunk IF 24, the storage unit 11 stores the flow record 60 in the flow DB2. The accumulation unit 11 stores the flow direction 61 as “out”.

  It is clear from the definition of the access IF 23 that for any communication, the input IF is not collected as the access IF 23 on one virtual switch 22 and the input IF is not collected as the access IF 23 on another virtual switch 22. Therefore, by dividing the database to be stored for each type of input IF in this way, one flow information is not counted repeatedly in each database.

  Next, processing for referring to the accumulated flow record 60 and the flow direction 61 will be described. This process is executed by the acquisition unit 14.

  FIG. 6 is an operation flowchart of the acquisition unit 14 when a cloud provider or the like that has no restriction on the information that can be referred to refers to the flow record 60 stored in the communication analysis device 10.

  The acquisition unit 14 receives as an input the condition of the flow record 60 that the user wants to refer to (S1). The condition of the flow record 60 is a condition for selecting the flow record 60 stored in the flow DB 1 such as a transmission source IP address or a flow collection time range.

  The acquisition unit 14 extracts the flow record 60 that matches the input condition and the flow direction 61 associated therewith from the flow DB 1 (S2), and for each of the extracted flow records 60 (hereinafter referred to as flow record F), S3 to S11 are executed.

  The acquisition unit 14 obtains the tenant name by looking up the tenant table 62 as the “VLAN number” key of the flow record F (S3). The acquired tenant name is, for example, tenant A.

  Using the “collection switch” of the flow record F, the acquisition unit 14 acquires the host device 20 and domain to which the virtual switch 22 belongs from the switch table 63 (S4). Assume that the acquired host device 20 is the host device H, and the acquired domain is the domain D.

  The acquisition unit 14 determines whether or not the flow direction 61 associated with the flow record F is “inside” (S5). If it is “inside” (Y in S5), the host unit H and domain D The completed communication is detected, and a message to that effect is output along with the tenant name and the contents of the flow record F. The output is performed, for example, on the display device of the communication analysis device 10. The acquisition unit 14 may store the detection result in the history storage unit 12 in association with the flow record F.

  When the flow direction 61 associated with the flow record F is “outside”, the output IF on the virtual switch 22 that collected the flow information of this record is the trunk IF 24. In this case, flow information is collected as input IF = trunk IF 24 on the virtual switch 22 other than the virtual switch 22. That is, a flow record 60 having the same communication address and collection time as the flow record F exists in the flow DB2.

  In this case (N in S5), the acquisition unit 14 acquires a flow record 60 having the same communication address and collection time as the flow record F from the flow DB 2 (S7). Note that the acquisition unit 14 considers that the collection time differences are equal if they are within the communication delay time range. It is assumed that the acquired flow record 60 is a flow record F ′.

  Using the “collection switch” of the flow record F ′, the host device 20 and the domain to which the virtual switch 22 belongs are acquired from the switch table 63 (S8). Assume that the acquired host device 20 is the host device H ′ and the acquired domain is the domain D ′.

  When the domain D and the domain D ′ match (Y in S9), the acquisition unit 14 detects communication from the host device H to the host device H ′ in the domain D, and notifies that to the tenant name, flow record Output together with the contents of F and F ′ (S10). The acquisition unit 14 may store the detection result in the history storage unit 12 in association with the flow records F and F ′.

  When the domain D and the domain D ′ are different (N in S9), the acquisition unit 14 detects communication from the host device H of the domain D to the host device H ′ of the domain D ′, and notifies that to the tenant name and flow It is output together with the contents of records F and F ′ (S11). The acquisition unit 14 may store the detection result in the history storage unit 12 in association with the flow records F and F ′.

  When the tenant user refers to the flow record 60 and the flow direction 61, an inquiry request is transmitted to the communication analysis device 10 using his / her tenant name as a key. When receiving the inquiry request, the acquisition unit 14 in the communication analysis device 10 refers to the tenant table 62 in the definition storage unit 13 and acquires the VLAN number corresponding to the tenant name.

  Thereafter, the acquisition unit 14 executes the process according to the operation flowchart of FIG. 3, but the flow records 60 acquired in S2 are narrowed down to only those that match the acquired VLAN number. In this way, the acquisition unit 14 can restrict each tenant user so that only the information of his / her tenant can be referred to.

  The communication analysis device 10 according to the present embodiment can clarify whether the communication between the VMs 29 executed by the plurality of host devices 20 is communication completed within the same host device 20. Therefore, the cloud business operator or the like can easily acquire information on how much traffic has crossed the host device 20 in the communication analysis system 50. The reason is that when the acquisition unit 14 acquires the flow record 60, it calculates from the information stored in the history storage unit 12 which host device 20 the communication between the received VMs 29 is addressed to which host device 20. Because it does.

Furthermore, the communication analysis device 10 according to the present embodiment can divide and visualize the communication flow flowing on the cloud system and its statistical information for each user of the cloud system. That is, the communication analysis device 10 can prevent a tenant user from referring to information of another tenant. The reason is that the storage unit 11 stores the flow information including the VLAN number in the history storage unit 12. Then, when a certain tenant user acquires information, the acquisition unit 14 performs access control so as to search only the flow record 60 corresponding to the VLAN number of the tenant.
(Modification)
The accumulation unit 11 does not have to distribute the flow records 60 into the flow DB1 and the flow DB2 and store them in the history storage unit 12. Furthermore, the storage unit 11 may not add the flow direction 61 to the flow record 60. The acquisition unit 14 may classify the flow information described above as being performed by the storage unit 11 with reference to the input IF and the output IF.

  If the virtual switch 22 does not support a flow aggregation protocol such as NetFlow, the physical switch 30 (switch 1 or 2) to which the host device 20 is connected may collect NetFlow or the like instead. . In that case, the virtual switch 22 and the physical switch may be replaced in the above description.

<Second Embodiment>
FIG. 7 is a configuration diagram of the communication analysis apparatus 10 according to the second embodiment. The communication analysis device 10 includes an acquisition unit 14, a history storage unit 12, and a definition storage unit 13.

  The definition storage unit 13 stores a switch number, a host number, and a connection terminal number of the virtual switch 22 in a communication network in which a plurality of host devices 20 including the VM 29 and the virtual switch 22 are connected. The history storage unit 12 stores a flow record 60 that includes a switch number, an input terminal number, an output terminal number, a communication address, and a communication time received from the relayed virtual switch 22 for each communication between the VMs 29.

  The acquisition unit 14 receives from the history storage unit 12 a first record whose output terminal number is a connection terminal number with a communication network, an input terminal number is a connection terminal number with a communication network, and a first record And a second record having the same communication address and communication time are extracted. Then, the acquisition unit 14 detects communication between the host device 20 obtained from the switch number of the first record and the host device 20 obtained from the switch number of the second record.

  The communication analysis device 10 according to the present embodiment can clarify whether the communication between the VMs 29 executed by the plurality of host devices 20 is communication completed within the same host device 20. Therefore, the cloud business operator or the like can easily acquire information on how much traffic has crossed the host device 20 in the communication analysis system 50. The reason is that when the acquisition unit 14 acquires the flow record 60, it calculates from the information stored in the history storage unit 12 which host device 20 the communication between the received VMs 29 is addressed to which host device 20. Because it does.

  Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

10 Communication analyzer
11 Accumulator
12 History storage
13 Definition memory
14 Acquisition Department
20 Host device
22 Virtual switch
23 Access IF
24 Trunk IF
29 VM
30 switch
40 WAN
50 Communication analysis system
60 Flow record
61 Flow direction
62 Tenant table
63 Switch table

Claims (10)

In a communication network in which a plurality of host devices are connected comprising a virtual machine and a virtual switch, a definition storage section for storing the virtual switch, the switch number, host number, the connection terminal number between the communication network,
For each communication between the virtual host, received from the virtual switch that relayed, the switch number, input terminal number, an output terminal number, communication address, and a history storage means for storing including records a communication time,
From the history storage means, the first record whose output terminal number is a connection terminal number with the communication network, the input terminal number is the connection terminal number with the communication network, and the first record When a second record having the same communication address and communication time is extracted, communication between the host device obtained from the switch number of the first record and the host device obtained from the switch number of the second record is detected. A communication analysis apparatus comprising: an acquisition unit;   When the acquisition unit extracts from the history storage unit a third record in which both the input and output terminal numbers are not connection terminal numbers with the communication network, the acquisition unit stores the third record in the host device obtained from the switch number of the third record. The communication analysis device according to claim 1, wherein communication is detected. The definition storage means includes a communication domain number of the virtual switch,
Said acquisition means, said a first record domain number obtained from the switch number, the communication within the second record domain if they match the domain number obtained from the switch numbers, between matched unless domain communication The communication analysis device according to claim 1 or 2, wherein The definition storage means includes the user name and VLAN number of the user,
The record stored in the history storage means includes a VLAN number;
4. The communication analysis device according to claim 1, wherein, when a user name is input, the acquisition unit detects communication from a record including a VLAN number of the user of the user name. 5.   The communication analysis apparatus according to claim 1, further comprising a storage unit that receives the record from a virtual switch that relays the communication and stores the record in the history storage unit for each communication between virtual hosts. And several of the host device,
It includes any communication analysis apparatus of claims 1 to 5, a communication analysis system. In a communication network in which a plurality of host devices are connected comprising a virtual machine and a virtual switch, a virtual switch, the switch number, host number, stores the connection terminal number between the communication network,
For each communication between the virtual host, received from the virtual switch that relayed, the switch number, input terminal number, an output terminal number, communication address, and the communication time is stored including records,
The first record whose output terminal number is the connection terminal number with the communication network, the input terminal number is the connection terminal number with the communication network, and the first record, the communication address and the communication time are A communication analysis method for detecting communication between a host device obtained from a switch number of the first record and a host device obtained from a switch number of the second record when a matching second record is extracted.   8. The communication according to claim 7, wherein when a third record in which both input and output terminal numbers are not connection terminal numbers with respect to the communication network is extracted, communication within the host device obtained from the switch number of the third record is detected. analysis method. Stores the communication domain number of the virtual switch,
Wherein the domain number obtained from the switch number of the first record, the communication within the domain if the resulting domain numbers match the switch number of the second record, for detecting the inter unless match domain communication, wherein Item 7. The communication analysis method according to item 7 or 8.   A program that causes a computer to execute the method according to claim 7.

Images