JP7461772B2 - Influence range recognition device and program - Google Patents

Description

This disclosure relates to an impact scope recognition device that recognizes the impact scope of devices present on a network, and a topology information generation device that generates network topology information as a graph.

The network diagnostic program traceroute is widely used to check network reachability at the L3 layer, which is the network layer level. There are also tools that use STP and FDB information to obtain connection information at the L2 layer, which is the data link layer level, and obtain network topology information. There is also technology related to the function of collecting and configuring network topology (for example, Patent Document 1).

When monitoring network devices or servers, if a failure occurs on the monitoring path starting from the monitoring device, communication will not reach the device downstream from the failure point via the network. Therefore, it will appear as if a failure has occurred in the device downstream from the failure point.

If a fault appears to be occurring in equipment downstream of the fault point, it is possible to determine the extent of the impact downstream of the fault point and determine which equipment among the detected faults does not require any action to be taken.

However, commercially available network topology collection tools or conventional technologies such as those described in Patent Document 1 can obtain topology information about how each device on the network is connected to each other. However, they cannot collect topology information that takes into account the monitoring route.

JP 2014-96705 A

The present disclosure aims to provide a system and device that presents topology information and the scope of impact of a failure, taking into account the monitoring path.

The influence range recognition device according to the present disclosure comprises:
a topology information acquisition unit that acquires graphed topology information, the graph indicating the connection states of a plurality of hosts present in a network by a connection state between host nodes that represent the hosts, and the connection states of network interfaces possessed by each of the plurality of hosts by a connection state of an IP node that represents the network interface, where one IP node and another IP node are connected by an IP edge having a direction that indicates the input/output of search data transmitted by a traceroute function that searches for a host route that indicates a host connection in the network;
an influence range recognition unit that recognizes an influence range exerted by the host node based on a connection state of the plurality of host connections between the host nodes and a connection state of the IP node;
Equipped with.

The influence range recognition unit
Recognizing a first IP node at a position going back along the IP edge connected to one of the IP nodes that is a starting IP node;
recognizing a plurality of IP edge nodes, which are a plurality of IP nodes that can be traced from the first IP node and the origin IP node via the IP edges;
Recognizing an origin host node corresponding to the origin IP node and a first host node corresponding to the first IP node;
recognizing a chain of the host connections originating from the origin host node, excluding the host connection connected to the first host node among the plurality of host connections connected to the origin host node;
The range of influence exerted by the origin host node is recognized by recognizing a common host included in the host nodes that are included in the chain of host connections and correspond to each of the recognized IP edge nodes.

The influence range recognition device further comprises:
a route acquisition unit that acquires a plurality of host routes searched by the traceroute function;
a graph generating unit that generates a graph based on the plurality of host routes, in which IP nodes corresponding to the network interfaces of the host are connected to each other by edges having a direction representing an input/output of search data transmitted by the traceroute function, and assigns an attribute of the edge to each of the edges;
Equipped with.

The graph generation unit
The attribute including monitoring target identification information for identifying the host to be monitored is assigned.

A graph generating device according to the present disclosure includes:
a route acquisition unit that acquires a plurality of host routes searched for by a traceroute function that searches for host routes that indicate connections between hosts in a network;
a graph generation unit that generates a graph based on the plurality of host routes, in which IP nodes corresponding to network interfaces of the host are connected with edges having directions that represent input and output of search data transmitted by the traceroute function, and assigns attributes of the edges to each of the edges of the graph;
Equipped with.

The program according to the present disclosure is
On the computer,
a topology information acquisition process for acquiring graphed topology information, the graph showing connection states of a plurality of hosts existing in a network as connection states between host nodes representing the hosts, and showing connection states of network interfaces possessed by each of the plurality of hosts as connection states of IP nodes representing the network interfaces, where one IP node and another IP node are connected by an IP edge having a direction representing input/output of search data transmitted by a traceroute function for searching a host route showing a host connection in the network;
an influence range recognition process for recognizing an influence range exerted by the host node based on a connection state of the plurality of host connections between the host nodes and a connection state of the IP node;
Execute the command.

The present disclosure aims to provide a system and device that presents topology information and the scope of impact of a failure, taking into account the monitoring path.

FIG. 11 is a diagram of a comparative example for clarifying the characteristics of the influence range recognition system 100 in the first embodiment. FIG. 1 is a diagram showing a system configuration of an influence range recognition system 100 according to a first embodiment. FIG. 2 is a hardware configuration diagram of an influence range recognition device 30 according to the first embodiment. FIG. 11 is a diagram showing topology information according to the first embodiment. FIG. 2 is a diagram according to the first embodiment, showing a graph generated by the graph generating unit 22. FIG. 1 is a diagram of the first embodiment, showing a case where there are two monitoring devices H1 and H2. FIG. 11 is a diagram of the first embodiment showing information on a monitoring route in which H1 is a monitoring device. FIG. 11 is a diagram of the first embodiment showing information on a monitoring route in which H4 is a monitoring device. 4 is a flowchart showing the operation of a topology information acquisition unit 32 and an influence range recognition unit 33 in the first embodiment. FIG. 2 is a diagram showing topology information acquired by a topology information acquisition unit 32 in the first embodiment. FIG. 11 is a diagram showing the process of step S11 in the first embodiment. FIG. 11 is a diagram showing the process of step S12 in the first embodiment. FIG. 11 is a diagram showing the process of step S13 in the first embodiment. FIG. 11 is a diagram showing the process of step S14 in the first embodiment. FIG. 11 is a diagram showing the process of step S15 in the first embodiment. FIG. 11 is a diagram showing the process of step S16 in the first embodiment.

Embodiment 1.
An influence range recognition system 100 according to a first embodiment will be described with reference to FIGS.

Comparative Example
FIG. 1 is a diagram of a comparative example for clarifying the characteristics of the impact range recognition system 100 of the first embodiment. FIG. 1 shows an overview of an integrated control center monitoring system 220. In the network of FIG. 1, switches 231, 232, 233, 234, and 235, which are L2 switches or L3 switches, and monitored servers 241, 242, and 243 are arranged. Here, the switch 233 is the object of construction. If communication is not received due to construction of the switch 233, the operator 210 performs an alarm suppression setting in advance for the integrated control center monitoring system 200 so that an alarm is not generated in the monitored server 243. In FIG. 1, the object of construction is the switch 233, and the monitored server 243 is normal. Here, the switches 231, 232, and 233 are connected in terms of the network, but are not visible on the monitoring path in server monitoring, and the identification of the impact range caused by the failure of equipment on the network or the construction depends on the experience and skill of the operator 210. Therefore, in the example of FIG. 1, there is a risk that the alarm suppression setting by the operator 210 for the monitored server 243 may be missed.
Therefore, the impact extent recognition system 100 according to the first embodiment presents the impact extent caused by a failure of equipment on a network or construction work, without relying on the experience or skill of the operator 210.
The influence range recognition system 100 will be described in detail below.

***Configuration Description***
Conventional techniques such as those disclosed in Patent Document 1 can obtain topology information on how each device is connected. However, it is not possible to generate topology information that takes into account the monitoring path. The impact range recognition system 100 of the first embodiment can generate topology information that takes into account the monitoring path and recognize the impact range. The impact range recognition system 100 will be described below.

<Configuration of influence range recognition system 100>
2 shows the configuration of an influence extent recognition system 100. The influence extent recognition system 100 includes a generation information collection device 10, a topology information generation device 20, and an influence extent recognition device 30. The generation information collection device 10 collects generation information used to generate topology information. The topology information generation device 20 generates topology information using the information collected by the generation information collection device 10. The topology information generation device 20 is a graph generation device.
The impact extent recognition device 30 recognizes the impact extent of the effect caused by a failed device when a failure occurs in a device on a network.

<Generation information collection device 10>
The generation information collecting device 10 includes a generation information collecting unit 11. The generation information collecting device 10 targets an L2NW device 61, an L2NW device 62, and a server device 63. The generation information collecting device 10 includes the generation information collecting unit 11 that collects information used to generate topology information.
The generation information collecting unit 11 has an information collecting function using protocols such as SNMP, LLDP/CDP for L2NW devices at the L2 layer. The generation information collecting unit 11 can also collect information using traceroute. The generation information collecting unit 11 acquires configuration management information from the configuration management information database 50, and extracts information used to generate topology information from the configuration information. In FIG. 2, the configuration management information database 50 is represented as CMDB 50.

<Topology information generating device 20>
The topology information generating device 20 includes a route acquisition unit 21, a graph generation unit 22, a topology information generation unit 23, and a topology information database 24. The route acquisition unit 21, the graph generation unit 22, and the topology information generation unit 23, like the generation information collection unit 11, have information collection functions using protocols such as SNMP and LLDP/CDP for L2NW devices, targeting L2NW devices 61, L2NW devices 62, and server devices 63. The topology information database 24 is a database in which topology information generated by the topology information generation unit 23 is registered. The topology information database 24 is software. The topology information generating device 20 is characterized by the route acquisition unit 21 and the graph generation unit 22. The functions of the route acquisition unit 21 and the graph generation unit 22 will be described later in the explanation of the operation.

<Influence range recognition device 30>
The impact extent recognition device 30 includes a failure location estimation unit 31, a topology information acquisition unit 32, an impact extent recognition unit 33, a topology information editing unit 34, and a topology information display unit 35. The topology information display unit 35 displays topology information on a display device 40. The features of the impact extent recognition device 30 are the topology information acquisition unit 32 and the impact extent recognition unit 33. The functions of the topology information editing unit 34 and the topology information display unit 35 will be described later in the explanation of the operation.

Figure 3 shows the hardware configuration of the impact scope recognition device 30. The hardware configuration of the impact scope recognition device 30 will be explained with reference to Figure 3.

The influence scope recognition device 30 is a computer. The influence scope recognition device 30 includes a processor 610. In addition to the processor 610, the influence scope recognition device 30 includes other hardware such as a main memory device 620, an auxiliary memory device 630, an input IF 640, an output IF 650, and a communication IF 660. The processor 610 is connected to the other hardware via a signal line 670 and controls the other hardware.

The functions of the functional elements of the impact scope recognition device 30, namely, the failure location estimation unit 31, the topology information acquisition unit 32, the impact scope recognition unit 33, the topology information editing unit 34, and the topology information display unit 35, are realized by the program 631.

The processor 610 is a device that executes the program 631. The processor 610 is an integrated circuit (IC) that performs arithmetic processing. Specific examples of the processor 610 include a central processing unit (CPU), a digital signal processor (DSP), and a graphics processing unit (GPU).

The main memory 620 is a memory device. Specific examples of the main memory 620 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory). The main memory 620 holds the results of calculations by the processor 610.

The auxiliary storage device 630 is a storage device that stores data in a non-volatile manner. A specific example of the auxiliary storage device 630 is a HDD (Hard Disk Drive). The auxiliary storage device 630 may also be a portable recording medium such as an SD (registered trademark) (Secure Digital) memory card, a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD (Digital Versatile Disk). The auxiliary storage device 630 stores a program 631.

The input IF 640 is a port through which data is input from each device. The output IF 650 is a port to which various devices are connected and through which the processor 610 outputs data to the various devices. The display device 40 is connected to the output IF 650. The communication IF 660 is a communication port through which the processor communicates with other devices. The communication IF 660 is connected to a network.

The processor 610 loads the program 631 from the auxiliary storage device 630 into the main storage device 620, and reads and executes the program 631 from the main storage device 620.

Program 631 is a program that causes a computer to execute each process, procedure, or step in the failure location estimation unit 31, topology information acquisition unit 32, affected area recognition unit 33, topology information editing unit 34, and topology information display unit 35, where "part" is replaced with "process," "procedure," or "step."

Program 631 may be provided by being stored on a computer-readable recording medium, or may be provided as a program product.

Note that the generation information collection device 10 and the topology information generation device 20 are computers similar to the influence range recognition device 30, so their explanations are omitted.

*** Operation Description ***
First, a method of recognizing an influence range in the influence range recognition system 100 will be described. The influence range recognition method is executed by the influence range recognition unit 33 of the influence range recognition device 30. The influence range recognition method by the influence range recognition unit 33 relates to the L3 layer and the L2 layer. In the influence range recognition method, the influence range is recognized using topology information, which is a graph generated based on the collected results of MonitorPath in the L3 layer and the collected results of L2Connection in the L2 layer.
FIG. 4 shows topology information. For convenience, FIG. 4 includes supplementary notes, but the topology information is made up of HostNode1 to HostNode4, IPNode1 to IPNode4, and edges connecting these nodes, which are indicated by circles. In FIG. 4, a HostNode is a node having information about a device. A HostNode has an attribute such as a hostname of the device. Host nodes are connected to each other by an L2Connection. In the following, a HostNode is indicated as "H". For example, HostNode1 is written as H1. In FIG. 4, an IPNode is indicated as IPNode, which is a node corresponding to a network interface of a device. An IP node has an attribute such as an IP address. IP nodes are connected to each other by a MonitorPath by traceroute. In the following, an IPNode is indicated as "N". For example, IPNode1 is written as N1. Contains indicates the relationship between a host node and an IP node. As shown in Fig. 4, when there is an "→" indicating a connection from a host node to an IP node, it indicates that the host has that network interface. In a device with multiple network interfaces such as a router, one host node is connected to multiple IP nodes with a Contains edge. MonitorPath indicates the route obtained by traceroute. Figure 4 shows the results of expressing these in a graph.

L2Connection is indicated by a solid line, Contains by a dashed line, and MonitorPath by a dashed line. The same applies to the following figures. As shown in Figure 4, assume that there is a system consisting of a monitoring device, two L2 switches, and a server to be monitored. Here, the L2 switches are those that have a management IP address for changing settings or obtaining status. In a configuration like that of Figure 4, N1, each L2 switch (N2, N3), and the server (N4) often belong to the same segment. Since they are L2 switches, no routing is performed at the IP level between the monitoring device and the server, and they are in the same segment. When traceroute is executed from the monitoring device, the management IP of the L2SW and the server IP appear to be the next hop from the monitoring device.

In this case, if we try to find the extent of the impact of a failure starting from an L2SW in the L3 layer, there will be no impact on any of the L2SWs when a failure occurs, because there is no device downstream of the L2SW in the MonitorPath of the traceroute information, as shown in Fig. 4. However, when information is collected at the L2 layer, as shown in the upper part of Fig. 4, an L2SW is sandwiched between the monitoring device and the server, and there are devices that will actually lose communication when a failure occurs. Therefore, with reference to the flowchart in Fig. 9 below, we will explain a method of finding the extent of the impact from the failure point (starting node) by combining information at the L2 layer and information at the L3 layer.
Before describing FIG. 9, which shows how information from the L2 layer and information from the L3 layer are combined, a method for determining an affected area using information from the L3 layer will be described with reference to FIG. 5 or FIG.
Fig. 5 is a diagram for explaining a method for determining an affected range using information of the L3 layer. The method for determining an affected range using information of the L3 layer corresponds to a process for generating a graph of topology information. Fig. 5 will now be described.

Figure 5 shows a graph, which is topology information generated by the graph generation unit 22. Graph generation by the graph generation unit 22 will be explained with reference to Figure 5.

As a preliminary step before the graph generation unit 22 generates a graph, the route acquisition unit 21 acquires multiple host routes discovered by a traceroute function that searches for host routes that indicate the connections between hosts in a network.

The graph generation unit 22 generates a graph in which IP nodes corresponding to the network interfaces of the host are connected by edges having directions that represent the input and output of search data transmitted by the traceroute function of traceroute, based on the multiple host routes acquired by the route acquisition unit 21, and assigns edge attributes to each edge. This is explained in detail below.

The graph generation unit 22 integrates the routes obtained by traceroute into one graph. At this time, information on the host that is the target of traceroute is added as an attribute to the MonitorPath that is the route. A specific example will be explained below. H1 is a monitoring device, and H2 to H6 are network devices or servers to be monitored. At this time, the route obtained as a result of traceroute is assumed to be as follows.
(1) H1 → H2 → H3 → H4
(2) H1 → H2 → H3
(3) H1 → H2
(4) H1 → H5 → H6
(5) H1 → H5
Here, for the edges of the route (1) H1→H2, H2→H3, and H3→H4, in order to indicate that the monitoring target is H4, the graph generating unit 22 adds a targetHost attribute to the edges. The targetHost has a structure having multiple lists of host names.
Similarly, for paths (2) to (5), the graph generation unit 22 puts the host information of the monitoring target in the targetHost attribute. This enables the graph generation unit 22 to represent the route information of (1) to (5) in a single graph. By representing it in a single graph, it is easy to understand visually, and the extent of influence on the monitoring route can be easily identified by operating the graph DB by tracing the MonitorPath from the IPNode that is the starting point.

In addition, if there are multiple monitoring devices, the targetHost attribute is assigned the kansiHostName, which indicates the name of the monitoring device. The IPNode attribute is assigned the kanshiHostName attribute, which indicates which monitoring device is monitoring it. This makes it possible to integrate monitoring route information into a single graph without losing information about which equipment each monitoring device is monitoring and which route it is.

A specific example will be described below.
6 shows a case where there are two monitoring devices H1 and H2. H1 and H4 are the monitoring devices, and H2, H3, and H5 are the network devices or servers to be monitored. In this case, the route obtained as a result of the traceroute is as follows:
(1) H1 → H2 → H3
(2) H1 → H2
(3) H4 → H2 → H5
Here, H2 is monitored only from H1. In the path H1→H2, in order to indicate that H2 and H3 are the monitoring targets and H1 is the monitoring device, the graph generation unit 22 assigns the information [{kansiHostName: Host1, hostname: Host3}, {kanshiHostName: Host1, hostname: Host2}] to the targetHost attribute as shown in Fig. 6. The graph generation unit 22 similarly assigns the targetHost attribute to other paths. Also, in each host, in order to indicate which monitoring device is monitoring it, the attribute kansiHostName is assigned to the IPNode.
The information of the monitoring device indicated by "kansiHostName" is monitoring target identification information.
In the example of (1), since H3 is monitored from H1, the graph generating unit 22 sets the kansiHostName attribute of N3, which is the IPNode of H3, to H1. The graph generating unit 22 similarly assigns the kansiHostName attribute to other IPNodes. This makes it possible to identify the information of each monitoring path even when there are multiple monitoring devices and hosts that are shared on the monitoring path.

Figure 7 shows information about the monitoring path with H1 as the monitoring device. Nodes shown with dashed lines are not displayed on the display device 40. The same applies to Figure 8 described below. The affected range recognition unit 33 can obtain Figure 7 by tracing the path in which Host1 is included in kanshiHostName in the targetHost attribute of MonitorPath. Therefore, the affected range can be identified by operating the topology information database 24 to determine the range that can be traced by MonitorPath on this path from the IPNode of the starting device.

8 shows information on a monitoring path in which H4 is a monitoring device. Similarly, when H4 is a monitoring device, the influence range recognition unit 33 can find the influence range by tracing the MonitorPath in which Host4 is included in the kanshiHostName of the targetHost attribute.
5 to 8, which use information from the L3 layer, will recognize that there is no device downstream of the L2SW, as described in Fig. 4. Therefore, a method of recognizing the extent of the impact by combining information from the L3 layer and information from the L3 layer will be described.

9 to 16, a method for recognizing a failure impact range by the impact range recognition unit 33 will be described. In this method for recognizing a failure impact range, information on the L2 layer and information on the L3 layer are combined to find the impact range from the failure point (starting node).
FIG. 9 is a flowchart showing the operations of the topology information acquisition unit 32 and the influence range recognition unit 33.

<Step S10>
In step S10, the topology information acquisition unit 32 acquires graphed topology information 24A from the topology information database 24. Figures 10 to 16 show the processing of the influence range recognition unit 33 for the same topology information 24A.
Fig. 10 shows topology information acquired by the topology information acquisition unit 32. H2, H3, and H4 on the upper side of Fig. 10 correspond to customer A, and H2, H3, and H4 on the lower side correspond to customer B. The topology information in Fig. 10 further includes H5, H6, and H7 and N5, N6, and N7 in addition to the topology information in Fig. 4. In Fig. 10, HostNode is indicated by a double circle, IPNnode is indicated by a circle, L2Connection is indicated by a solid line, Contains is indicated by a dashed line, and MonitorPath is indicated by a dashed line. Note that L2Connection only indicates the connection between hosts, and cannot indicate the direction of the monitoring path.

<Topology Information 24A>
The topology information 24A is information showing the connection state of a plurality of hosts existing in the network by a plurality of host connections between host nodes H representing the hosts, using L2Connection. The topology information 24A is also information showing the connection state of the network interface possessed by each of the plurality of hosts H, using MonitorPath, showing the connection state of the IP node N representing the network interface. In the topology information 24A, one IP node and the other IP node are connected by a MonitorPath having a direction representing the input/output of search data transmitted by a traceroute function that searches for a host path indicating the connection of hosts in the network. In FIG. 10, the two-dot chain line of the directed line segment representing the MonitorPath is called an IP edge.

The impact scope recognition unit 33 recognizes the impact scope of the host node based on the connection status of multiple host connections between host nodes and the connection status of IP nodes. Details will be described later in steps S11 to S16 below.

In FIG. 10, let us assume that a failure occurs in N2, which is an L2SW, and the extent of the impact of the failure is sought starting from N2. In this case, the MonitorPath information of "traceroute" shows that there is no device downstream of N2. Therefore, there is no extent of the impact downstream of N2. However, when connection information is collected at the L2 layer, it is found that H2, which is an L2SW, and H3, which is also an L2SW, are sandwiched between H1, which is a monitoring device, and H4, which is a server. In reality, there are devices whose communication will be interrupted when a failure occurs in N2. The method for seeking the extent of the impact of the failure starting from N2 using the impact extent recognition unit 33 is as follows.

<Step S11>
FIG. 11 shows the process of the influence range recognition unit 33 in step S11.
In step S11, the influence range recognition unit 33 recognizes N1, which is the first IP node located at a position going back along the IP edge connected to N2, which is the starting point IP node. That is, the influence range recognition unit 33 recognizes N1 going back one MonitorPath from the starting point N2. N1 is one node upstream of N2 on the monitor path. In the tree, it corresponds to a parent node.

<Step S12>
FIG. 12 shows the process of the influence range recognition unit 33 in step S12.
In step S12, a plurality of IP edge nodes, which are a plurality of IP nodes that can be traced from the first IP node N1 and the starting point IP node N2 by IP edges, are recognized. Specifically, the process is as follows. The influence range recognition unit 33 recognizes IP Nodes that can be traced from the starting point N1 and N2 recognized in step S11 by the MonitorPath. As seen from the starting point N2, as shown in FIG. 12, the nodes that are connected from the higher nodes on the monitoring path are acquired, so that the acquired nodes correspond to N2 to N4 in FIG. 12. In addition, although they are not directly connected by the MonitorPath, the influence range recognition unit 33 simultaneously acquires siblings and their child nodes as seen from the starting point N2, which correspond to N5 to N7 in FIG. 12. The influence range recognition unit 33 recognizes N2, N3, N4, and N5, N6, and N7 as a result of tracing the path.

<Step S13>
FIG. 13 shows the process of the influence range recognition unit 33 in step S13.
In step S13, the influence extent recognition unit 33 recognizes the origin host H2 corresponding to the origin N2. That is, the influence extent recognition unit 33 recognizes H2, which is located back in the contains from the origin N2.

<Step S14>
FIG. 14 shows the process of the influence range recognition unit 33 in step S14.
In step S14, the influence extent recognizing unit 33 recognizes the first host node H1 corresponding to the first IP node N1. That is, the influence extent recognizing unit 33 recognizes H1 by tracing back through the contains from N1 recognized in step S11.

<Step S15>
FIG. 15 shows the process of the influence range recognition unit 33 in step S15.
In step S15, the influence range recognition unit 33 recognizes the chain of H2, H3, and H4, which is a chain of host connections originating from the origin host node H2, excluding the host connection connected to the first host node H1 among the multiple host connections connected to the origin host node H2. Specifically, it is as follows. The influence range recognition unit 33 recognizes the routes excluding the route toward H1 recognized in step S14 from the L2Connections connected from H2 recognized in step S13. By the process of step S15, a path toward the downstream side of the monitoring route remains. There is no host on that path upstream of the monitoring route as viewed from step S13. In other words, the upstream side of the simple route is not included in the influence range.

<Step S16>
FIG. 16 shows the process of the influence range recognition unit 33 in step S16.
In step S16, the influence scope recognition unit 33 recognizes the influence scope of the origin host node H2 by recognizing a common host that is included in the host connection chain and is included in the hosts corresponding to each of the multiple IP edge nodes recognized in step S12. Specifically, it is as follows. In steps S12 and S15, the influence scope recognition unit 33 recognizes a common host that is a commonly existing node that is connected by Contains. In step S15, this is not upstream of the origin N2, but because of step S12, it becomes a sibling/child node.
As a result of the above, each node identified in step S16 is a sibling/child node when viewed from the starting point N2, and may be within the influence range.

***Advantages of First Embodiment***
According to the recognition method of the influence range recognition device 30 shown in FIG. 9 to FIG. 16, which combines L2Connection of L2 and MonitorPath of L3 layer, it is possible to obtain the influence range at the time of construction/failure of NW equipment, which cannot be obtained by traceroute.
Furthermore, by using the topology information generating device 20 to create a graph that assigns attributes to the routes of the MonitorPath, it is possible to present the extent of influence of each monitoring device.

In the above embodiment, the generation information collection device 10, the topology information generation device 20, and the influence range recognition device 30 are realized as separate devices. However, the functions of the generation information collection device 10, the topology information generation device 20, and the influence range recognition device 30 may be realized by a single device or by multiple devices.

10 Generation information collection device, 11 Generation information collection unit, 20 Topology information generation device, 21 Path acquisition unit, 22 Graph generation unit, 23 Topology information generation unit, 24 Topology information database, 30 Impact range recognition device, 31 Fault location estimation unit, 32 Topology information acquisition unit, 33 Impact range recognition unit, 34 Topology information editing unit, 35 Topology information display unit, 40 Display device, 50 CMDB, 61 L2NW equipment, 62 L2NW equipment, 63 Server equipment, 100 Impact range recognition system, 210 Operator, 220 Integrated control center monitoring system, 231, 232, 233, 234, 235 Switch, 241, 242, 243 Monitored server, 610 Processor, 620 Main storage device, 630 Auxiliary storage device, 640 Input IF, 650 Output IF, 660 Communication IF, 670 signal line.

Claims (4)

a topology information acquisition unit that acquires graphed topology information, the graph indicating the connection states of a plurality of hosts present in a network by a connection state between host nodes that represent the hosts, and the connection states of network interfaces possessed by each of the plurality of hosts by a connection state of an IP node that represents the network interface, where one IP node and another IP node are connected by an IP edge having a direction that indicates the input/output of search data transmitted by a traceroute function that searches for a host route that indicates a host connection in the network;
an impact range recognition unit that recognizes an impact range that is affected by communication failure caused by the host node where construction or a failure occurs when construction or a failure occurs in the host node, based on a connection state of the plurality of host connections between the host nodes and a connection state of the IP node ;
An influence range recognition device comprising: The influence range recognition unit
Recognizing a first IP node at a position going back along the IP edge connected to one of the IP nodes that is a starting IP node;
recognizing a plurality of IP edge nodes, which are a plurality of IP nodes that can be traced from the first IP node and the origin IP node via the IP edges;
Recognizing an origin host node corresponding to the origin IP node and a first host node corresponding to the first IP node;
recognizing a chain of the host connections originating from the origin host node, excluding the host connection connected to the first host node among the plurality of host connections connected to the origin host node;
An influence scope recognition device as described in claim 1, which recognizes the influence scope influenced by the origin host node by recognizing common hosts included in the host nodes that are included in the chain of host connections and correspond to each node of the recognized multiple IP edge nodes. The influence range recognition device further comprises:
a route acquisition unit that acquires a plurality of host routes searched by the traceroute function;
a graph generating unit that generates a graph based on the plurality of host routes, in which IP nodes corresponding to the network interfaces of the host are connected to each other by edges having a direction representing an input/output of search data transmitted by the traceroute function, and assigns an attribute of the edge to each of the edges;
Equipped with
The graph generation unit
3. The influence scope recognition device according to claim 1, wherein the attribute includes monitoring target identification information for identifying a monitoring target host . On the computer,
a topology information acquisition process for acquiring graphed topology information, the graph showing connection states of a plurality of hosts existing in a network as connection states between host nodes representing the hosts, and showing connection states of network interfaces possessed by each of the plurality of hosts as connection states of IP nodes representing the network interfaces, where one IP node and another IP node are connected by an IP edge having a direction representing input/output of search data transmitted by a traceroute function for searching a host route showing a host connection in the network;
an impact range recognition process for recognizing an impact range affected by communication failure caused by the host node where construction or a failure occurs when construction or a failure occurs in the host node, based on a connection state of the plurality of host connections between the host nodes and a connection state of the IP node ;
A program that executes the following.

Images