JP2010088031A - Fault detection method of underlay network, and network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect the fault of an underlay network by the change of tunnel traffic in an overlay network constructed on the underlay network. <P>SOLUTION: In a measuring function portion 303 within an overlay node, a passive probe 304 extracts the tunnel traffic of the overlay network, and accumulates a packet header portion thereof in a collector portion 306, an analyzer portion 308 calculates utilization band which is in traffic state, delay and packet loss rate, based on packet header information, controls tunnel traffic status for every tunnel. A fault detection portion 310 analyzes the pattern of traffic change from a measured traffic status, predicts the tolerable range of the change, figures fault occurrence, when a current measurement result is not in the tolerable range. An active probe 312 performs a route trace processing to validate the fault and performs the pinpointing of fault area of the underlay network. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an underlay network failure detection method for detecting a failure of an underlay network from behavior in the overlay network when an overlay network having a plurality of virtual nodes is constructed on an underlay network that is a real network, for example. And a network system in which such a method is executed.

  A virtual network constructed to cover a network based on TCP / IP (Transmission Control Protocol / Internet Protocol) or MPLS (Multi-Protocol Label Switching) as an underlay network. A network having a name space different from the ray network is called an overlay network. It is possible to construct a plurality of overlay networks corresponding to a plurality of services on the underlay network. It is known that a network technology that does not depend on an existing network technology can be used in a virtual network configured by an overlay network. However, since the overlay network depends on the underlay network, an abnormality occurs in the overlay network due to a failure in the underlay network. Therefore, when the overlay network is operated, the overlay network It is desirable to be able to detect an underlay network failure based on changes in the virtual link traffic state at

  Conventionally, network traffic status monitoring involves measuring all traffic received at the physical interface of each network device (router or switch) in the network and calculating traffic status information for each physical link. There are ways to monitor for anomalies. However, in this method, each network node performs monitoring and measurement in units of physical links in its own node, so the measurement result can only indicate the traffic state on the physical link between the network nodes.

  With regard to this network measurement / monitoring and abnormality detection technique, for example, Japanese Patent Application Laid-Open No. 2008-118242 discloses a technique for detecting abnormal traffic by packet sampling. In this detection method, in order to make it easy to detect abnormalities such as sudden peaks in traffic, the entire large traffic volume is divided into multiple groups, so that the location of the abnormality can be easily identified. Yes. In addition, each sampled traffic value is recorded in a time series, the traffic change is predicted, and the predicted value is compared with the actually measured result to identify whether there is a traffic change. In this method, the measurement / monitoring results in the network node are collected in an abnormal traffic detection device provided as a central management server, and the network failure / abnormality is detected in the abnormal traffic detection device. Therefore, even if the network node itself performs measurement / monitoring on the physical link, the abnormal traffic detection device is requested to analyze the data, and although it can cope with complicated analysis, the analysis time increases as the analysis amount increases. There is a problem that is necessary. In addition, when the network design change or the measurement target location is changed, it is necessary to change the setting of the abnormal traffic detection device, and the network design change cannot be handled immediately.

Patent Document 2 (Japanese Patent Laid-Open No. 2008-141641) discloses a technique for learning the results of traffic measured in the past and predicting traffic fluctuations and transitions. In this technology, when there is periodicity in the traffic flowing in the network, the traffic form of a certain period in the past (for example, the period for each day of the week) is learned in advance, the periodic component is analyzed, and the traffic in that period Record the characteristics of Thereby, the traffic characteristic of a certain period can be predicted, and a traffic abnormality can be detected by comparing the newly measured traffic state with the past fluctuation trend. However, since the thing of patent document 2 learns the period of traffic and specifies the abnormality of traffic, in order to improve accuracy, much past data for learning is needed, and there is no periodicity. With regard to traffic, there is a problem that it is impossible to judge abnormality because there is no past reference data.
JP 2008-118242 A JP 2008-141641 A

  In the method of measuring and monitoring traffic as described above to detect a network failure, the monitoring and measurement target is all packets entering the physical interface, so the state of the underlay network is the main. Measurement results for traffic between adjacent nodes in the underlay network.

  The overlay network is built on the underlay network because it is desired to configure a virtual network that can set the name space without depending on the network configuration in the underlay network. It is highly desirable to be able to identify faults based on monitoring and measurement results. However, the above-described extension of the conventional technique has a problem in that it is impossible to specify a failure occurrence location in the underlay network without the overall information about both the underlay network and the overlay network.

  Therefore, an object of the present invention is to measure changes in traffic quality and state between nodes in an overlay network when a plurality of overlay networks corresponding to a plurality of services are created on an underlay network that is a real network, for example. It is another object of the present invention to provide an underlay network failure detection method capable of detecting a failure in an underlay network from the change in the traffic state and a network system in which such a failure detection method is implemented.

  The underlay network failure detection method of the present invention detects a change in the state of a tunnel by measuring the traffic state of each tunnel on each overlay network when a plurality of overlay networks are formed on the underlay network. A method for detecting failures in the underlay network, extracting tunnel traffic packets, analyzing packet headers of the extracted packets and measuring tunnel traffic status, and analyzing packet headers From the results, it is possible to estimate the occurrence of a failure and to reconfirm the path of the underlay network when the occurrence of the failure is estimated.

  The network system of the present invention is a network system in which a plurality of overlay networks are formed on an underlay network, and measures the traffic state of one or a plurality of virtual nodes and each tunnel on each overlay network to measure the tunnel. An overlay node having a measurement function unit that detects a change in the state of the packet, and the measurement function unit analyzes a packet extraction unit that extracts a packet of tunnel traffic and a packet header of the packet extracted by the packet extraction unit. Packet header analysis means for measuring the traffic state of the tunnel, tunnel failure detection means for estimating the occurrence of a failure based on the analysis result of the packet header analysis means, and when the tunnel failure detection means estimates the occurrence of the failure Underraine Comprising a route re-verification means for re-check the path of the workpiece, the.

  In the present invention, a passive probe is used to extract packets for the traffic entering the overlay node, not for the entire traffic, but for the tunnel traffic of the overlay network. Therefore, it is possible to measure and manage the traffic state / quality for each virtual link (tunnel) of each overlay network.

  In addition, according to the present invention, it is possible to estimate the topology change in the underlay network that cannot be seen from the overlay network by detecting the traffic state / quality change of the overlay network. By reconfirming the path of the underlay network, the location of the fault in the underlay network can be identified.

  Next, embodiments of the present invention will be described with reference to the drawings. The technology of this embodiment measures and monitors the traffic state of a virtual link (that is, a tunnel) of an overlay network (virtual network) composed of a plurality of virtual nodes. It is to detect a failure.

  First, the overlay network will be described. FIG. 1 is a configuration diagram showing a basic relationship between an underlay network 100 constructed as a real network, for example, and a plurality of overlay networks 140 and 150 constructed as virtual networks on such an overlay network.

  Overlay nodes 101 to 105 for constructing an overlay network are configured from the underlay network 100, and virtual nodes 110 to 113 and 120 to 123 are mounted on the overlay nodes. Here, the two overlay networks 140 and 150 are distinguished by the letters “A” and “B”, and the virtual nodes 110 to 113 labeled with the letter “A” correspond to the overlay network 140 of “A”. Virtual nodes 120 to 123 that are virtual nodes and labeled with the letter “B” are virtual nodes of the overlay network 150 of “B”. The virtual nodes of both overlay networks may coexist on the same overlay node, or only the virtual nodes of one overlay network may exist. These virtual nodes are connected to each other by overlay links (virtual links) 141 to 144 and 151 to 154 for each overlay network. The virtual link is also called a tunnel, and for example, a TCP session, an IP / IPsec tunnel, an MPLS path, an ATM connection, or the like is used. In the underlay network 100 (for example, a real network), the overlay nodes 101 to 105 are connected by links 130 to 133 in the underlay network, for example.

  The overlay nodes and the links between them do not have a one-to-one correspondence with the nodes and links in the underlay network. FIG. 2 is a diagram for explaining the relationship between an overlay node and an underlay node. In the example shown here, the link between the two overlay nodes 101 and 102 passes through a plurality of underlay nodes 170 to 173. The virtual nodes 110 and 111 mounted on the overlay nodes 101 and 102 are connected by a virtual link (tunnel) 141 to construct an overlay network. The overlay nodes 101 and 102 and the underlay nodes 170 and 172 and the underlay nodes 170 to 173 are connected to each other by, for example, underlay links 160 to 165 that are physical links. The underlay node of the underlay network is composed of general routers and switches, and performs route calculation using existing routing protocols such as STP and OSPF, and TCP / IP, Ethernet (registered trademark), MPLS. Data transfer is performed using a transfer protocol such as

  The overlay network is nested as seen from the underlay network by connecting the virtual nodes 110 and 111 with the virtual link 141. By providing the overlay network with an independent name space for the underlay network, a virtual network that does not depend on the protocol of the underlay network can be constructed. The use of an independent name space is used as an IP-VPN based on MPLS or Internet VPN based on IPsec as a known technique. On the other hand, it is possible to apply a new network technology on the overlay network by changing the processing operation of the virtual node and processing the new network technology in a virtual node connected by a plurality of virtual links.

  When a node or link failure occurs in the underlay network, route recalculation is performed using the underlay routing protocol, and the route is switched from the normal route to the detour route. However, since the virtual node on the overlay network does not hold the topology information of the underlay network, the path switching cannot be grasped even if the path switching occurs on the underlay network side. Since the path switching in the underlay network affects the traffic state and quality of the overlay network, it is necessary to make it possible for the overlay network to know the failure of the underlay network. Therefore, in the present embodiment, the overlay node can detect a failure in the underlay network.

  FIG. 3 is a block diagram showing a configuration of an overlay node constituting the network failure detection system according to the embodiment of the present invention, and shows mainly a portion for measuring traffic. FIG. 4 is a block diagram for showing details of processing in the measurement function unit 303.

  In the overlay node 300, a plurality of virtual nodes 301 each having an independent overlay routing protocol function and a measurement function unit 303 for measuring traffic are provided. The measurement function unit 303 includes a passive probe 304, a collector unit 306, an analyzer unit 308, a failure detection unit 310, an active probe unit 312, and a path information recording unit 314.

  The passive probe 304 monitors the packet 302 arriving at the overlay node 300, identifies whether the packet header includes a tunnel header indicating overlay network traffic, filters only overlay network traffic, and overlay network tunnel traffic. Extract only packets. The passive probe 304 samples the extracted packets at a predetermined rate in order to reduce the accumulation amount and the analysis amount, and sends the header information of the sampled packets and the tunnel information to the collector unit 306. In order to perform such filtering and sampling, the passive probe 304 includes a filtering unit 331 and a sampling unit 332.

  FIG. 5 shows a packet header of the traffic of the overlay network. In the packet, an outer header 360, a tunnel header 361, an inner header 362, and a payload 363 are arranged in this order. The outer header 360 is a header for the routing protocol of the underlay network, the tunnel header 361 is an important header portion indicating the packet header of the overlay network, and the inner header 362 is a header for the routing protocol of the overlay network. . The tunnel header 361 holds a time stamp 364 when transmitting from an overlay node to another overlay node, an overlay network identification key 365, and a sequence number 366 that guarantees the packet order. .

  Next, details of the processing in the passive probe 304 will be described with reference to FIG.

  When a packet arrives at the physical interface in step 400, the passive probe 304 first determines in step 401 whether the packet has a tunnel header for the overlay network. If there is no tunnel header, the process proceeds to the process of transferring the packet by the routing function of the underlay network shown in step 403. If there is a tunnel header, then in step 402, the passive probe 304 performs packet filtering. Packets not extracted by this filtering are forwarded to the virtual node as shown in step 404. Next, the passive probe 304 samples the packet extracted by packet filtering in step 405, and then records the header information of the sampled packet in the collector unit 306 in step 406 for processing. finish.

  The collector unit 306 receives and records the packet header information of the filtered and sampled overlay traffic from the passive probe 304, and when recording new packet header information, periodically notifies the analyzer unit of the packet header information. To do. That is, the collector unit 306 acquires necessary information 305 of the measured packet header from the passive probe 304 and stores the header information data until the analyzer unit acquires the header information.

  The analyzer unit 308 accesses and acquires the packet header information 307 of the overlay traffic stored in the collector unit 306 at a set cycle. The analyzer unit 308 configures a tunnel ID (identifier) by combining [source IP address], [destination IP address], and [overlay network key] in the [outer header] of the packet header. The traffic state in the tunnel of the overlay network is managed for each tunnel (virtual link) tunnel ID. Such an analyzer unit includes a memory slot 335 that stores a traffic state in units of tunnel IDs, and a tunnel information database 336 that holds information about the tunnel. The tunnel information database 336 includes a tunnel that stores a tunnel ID. It consists of an ID database 337 and a tunnel state database 338 that holds a state table (state table) describing the state of each tunnel.

  The analyzer unit 308 analyzes and calculates the use bandwidth, the delay, and the packet loss rate, which are the traffic state of the tunnel, from the packet header information 307 stored in the collector unit 306, and in the memory slot for each tunnel ID, The calculated use band value, delay value, and packet loss rate value are recorded in time series at the set analysis cycle. Furthermore, in order to be able to grasp the traffic state of the entire overlay network, the analyzer unit 308 periodically notifies the external management server of the traffic state of the tunnel as indicated by an arrow 316.

  FIG. 7 is a flowchart showing the operation of the analyzer unit 308. In step 410, the analyzer unit 308 acquires the header data of the tunnel traffic packet stored in the collector unit 306 at a constant cycle. Then, from the header data information, the analyzer unit 308 calculates, for each tunnel, three parameters indicating the tunnel traffic state: use band, delay, and packet loss rate, as shown in steps 411 to 413. In order to distinguish the traffic state of each tunnel, as shown in step 414, the analyzer unit 308 uses the measured use band value, delay value, and packet loss value as the tunnel ID (the overlay network key in the tunnel header, the transmission In step 415, the calculated three parameter values are recorded in a memory slot for each parameter. As a result, each parameter representing the tunnel traffic state is stored for each tunnel in a time series with a fixed period.

  The failure detection unit 310 accesses the memory slot for the use band value of each tunnel ID, the memory slot for the delay value, and the memory slot for the packet loss rate value in the analyzer unit 308, and stores n memories. Based on each parameter (bandwidth value, delay value, and packet loss rate value) stored in the slot, an average value μ and standard deviation σ of these parameters over n periods are calculated. The failure detection unit 310 sets an allowable range that exceeds “μ−ασ” and is equal to or less than “μ + ασ” from the average value μ and the standard deviation σ with respect to the variation of each parameter. Here, α is a positive number set by the administrator. Then, the failure detection unit 310 compares the fluctuation allowable range calculated from each parameter in the memory slot with the result value of the latest measurement, and if the measured value is not within the fluctuation allowable range, that is, the measured value When ≦ μ−ασ or measured value> μ + ασ, it is determined that the traffic in the tunnel of the tunnel ID is abnormal, and there is a failure in the underlay network used by the traffic presume. When the failure in the underlay network is estimated in this way, the failure detection unit 310 notifies the active probe 312 of the alarm 311 indicating the occurrence of the failure.

  FIG. 8 is a flowchart showing the operation of the failure detection unit 310. In step 420, the failure detection unit 310 acquires the value of each parameter stored in the memory slot 335 of the analyzer unit 308, and in steps 421 and 422, calculates the average value μ and standard deviation σ of each parameter, Next, in step 423, an allowable range of variation of each parameter is determined using the average value μ and the standard deviation σ. The allowable range is a range of [μ−ασ: μ + ασ]. α is a positive numerical value. When α is reduced, the allowable range of change is narrowed, and many false detections occur. Conversely, when a large value is set for α, the allowable range becomes large, and many undetected cases occur.

  Next, the failure detection unit 310 determines in step 424 whether the latest measurement value is within the allowable range of each parameter. If it is within the permissible range, the process is terminated as it is because no failure has occurred. On the other hand, if it is not within the allowable range, in step 425, a failure in the underlay network is estimated based on a change in the use band or a change in the delay. FIG. 9 is a flowchart for explaining the conditions for estimating such a failure.

When a large packet loss rate occurs in the TCP flow that flows on the overlay network, it is a case where TCP congestion control occurs, so the usage band fluctuates drastically and it becomes difficult to identify fluctuations in the usage band due to a failure. . In this case, it is appropriate to estimate the fault based on the delay variation. On the other hand, when the packet loss rate is small, the use band is in a stable state, so a sudden change in the use band can be easily detected, and a failure can be estimated based on the use band. The packet loss rate that is the judgment condition and the throughput that is the characteristic of TCP have a relationship of 1 / (RTT * (packet loss rate) ^1/2 ). Therefore, the value of the packet loss rate used as the judgment condition is Can be determined. Here, RTT is a throughput represented by a round trip time.

  Therefore, as shown in FIG. 9, in step 430, it is determined whether or not the packet loss rate exceeds a certain fixed value. Fault detection is performed under the change condition, and as shown in step 433, a change in delay and a change in the packet loss rate are used as a reference, and in step 435, a fault in the underlay network is estimated. Conversely, when the packet loss rate exceeds a fixed value, as shown in step 432, failure detection is performed under the condition of delay change, and as shown in step 434, reference is made to changes in the bandwidth used and changes in the packet loss value. In step 435, a fault in the underlay network is estimated. Specifically, when the change in the used bandwidth value is a condition, when the used bandwidth value decreases and the delay value increases, and when the used bandwidth value decreases and the packet loss rate value increases, When the traffic state is estimated to be abnormal and the change in the delay value is a condition, the delay value increases and the bandwidth usage value decreases, and the delay value increases and the packet loss rate value increases. In this case, it is estimated that the traffic state is abnormal.

  When the failure estimation shown in step 425 of FIG. 8 is performed in this way, next, in step 426, it is determined whether a failure has occurred in the underlay network as a result of the estimation, and the failure occurrence cannot be estimated. In this case, the process is terminated as it is, and when the failure occurrence can be estimated, in step 427, the failure detection unit 310 sends an alarm 311 for estimating the failure occurrence in the underlay network to the active probe 312. .

  When the active probe 312 receives the failure occurrence estimation alarm 311 in the underlay network from the failure detection unit 310, the active probe 312 determines the path of each underlay node in the underlay network that is actually used by the tunnel (virtual link) of the overlay network. It is reconfirmed and it is confirmed in advance whether it matches the route information registered in the route information recording unit 314. If they do not match, it is determined that a path switch or change has occurred in the underlay network, and the active probe 312 notifies the overlay node virtual node 301 or an external management server of an alarm of an underlay network failure.

  FIG. 10 is a flowchart showing the operation of the active probe 312. The active probe 312 is normally in a standby state. That is, as shown in step 441, the active probe 312 is on standby until the failure occurrence estimation alarm 311 is received in step 440. When the alarm 311 for estimating the occurrence of a failure in the underlay network is received from the failure detection unit 340, in this case, it is necessary to check whether there is a change in the network topology with respect to the underlay network. In step 442, 312 performs path trace processing in the underlay network to detect the topology of the underlay network. For example, when the underlay network is a TCP / IP network, the active probe 312 sends the traceroute packet 315 for the address at the front end of the tunnel to the underlay network and receives a response to the traceroute packet, so that the active probe 312 Detect the topology of. Next, the active probe 312 compares the path information of the underlay network detected by the path trace process in step 443 with the path information stored in the path information recording unit 314 in advance, and the path information matches in step 444. It is reconfirmed whether or not the route is actually changed. The active probe 312 ends the process as it is when the route information matches, that is, when the route change has not occurred, and when the route information does not match, that is, when the route change has been performed, the underlay network Is identified, and an alarm 316 indicating an underlay network failure is alerted to an external management server.

  In the above-described embodiment, since a failure in the underlay network must be specified, if a false detection occurs in the failure detection unit 310, the active probe 312 is also activated to perform path trace processing, and the underlay network The route will be reconfirmed. However, in the present embodiment, the frequency of the route trace processing is low, and the expandability and efficiency are high as compared with the case where the processing by the active probe is periodically performed.

  In general, there are two methods for network monitoring: passive measurement based on packet filtering and the like, and active measurement in which a traceroute packet is propagated in the network and route trace processing is performed. Among them, passive measurement is considered to have low measurement accuracy, and active measurement is high in measurement accuracy, but measurement traffic is generated, so that measurement load on the entire network is increased. In the above-described embodiment, by reducing the candidates for occurrence of failure by passive measurement and performing active measurement only when it is estimated that there is a possibility of failure, the load on the network is reduced. This makes it possible to perform accurate fault detection.

  Next, another embodiment of the invention will be described. In this example, using each parameter measured and stored in the memory slot, a tunnel traffic failure is detected using a change in one parameter and a change in two or more parameters.

  When only one parameter is used, if α is set to a small value for the product ασ of the standard deviation σ and the variable α, the allowable range of parameter variation becomes narrow, and even small changes in each parameter are detected as an obstacle. As a result, many false detections occur. Therefore, it is necessary to set a large value for the variable α.

  On the other hand, when two or more parameters are used, a tunnel traffic failure is detected by detecting that two or more parameters (two or more of the used bandwidth, delay, and packet loss rate) change simultaneously. Notify the alarm. When two or more parameters are used, the average value μ and the standard deviation σ are obtained for the product of such parameters, and the variable α is set to an allowable range that exceeds “μ−ασ” and is equal to or less than “μ + ασ”. If a large value is set to, the allowable range becomes too large and a change in a certain parameter cannot be detected. Therefore, it is necessary to set a small value for α under the condition that two or more parameters change simultaneously.

  The determination of failure detection is realized under the condition “There is a change in one parameter” or “There is a change in two or more parameters”.

  In each of the embodiments described above, the measurement function unit that monitors the tunnel traffic state of the overlay network and estimates a failure of the underlay network due to a change in the tunnel traffic may be configured by hardware or causes the computer to operate. It may be realized by a software program. Alternatively, it may be partially configured with hardware and partially configured with software.

  According to each embodiment described above, when a plurality of overlay networks (virtual networks) are constructed on an underlay network (real network), the traffic state of each tunnel (virtual link) of each overlay network is monitored, and each tunnel is monitored. By detecting a change in traffic state, it is possible to detect topology changes and failures in the underlay network that cannot be seen in the topology of the overlay network.

  Although the present invention has been specifically described above based on the embodiment, the present invention is not limited to the above-described embodiment, and it is needless to say that various changes can be made without departing from the scope of the invention.

It is a figure explaining the outline | summary of an underlay network and the some overlay network accommodated in this underlay network. It is a figure explaining the relationship between an overlay node and an underlay node. It is a block diagram which shows the structure of the overlay node in one embodiment of this invention. It is a block diagram for showing the detail of the process in a measurement function part. It is a figure which shows the structure of the header of an overlay packet. It is a flowchart which shows operation | movement of a passive probe. It is a flowchart which shows operation | movement of an analyzer part. It is a flowchart which shows operation | movement of a failure detection part. It is a flowchart which shows the operation | movement of a fault estimation. It is a flowchart which shows operation | movement of an active probe.

Explanation of symbols

100 Underlay network 140, 150 Overlay network 101-105 Overlay nodes 110-113, 120-123, 301 Virtual nodes 130-133 on overlay nodes 141-144, 151-154 Overlay links (virtual links)
160 to 165 Underlay links 170 to 173 Underlay node 300 Overlay node 302 Traffic 303 Measurement function unit 304 Passive probe 306 Collector unit 308 Analyzer unit 310 Fault detection unit 312 Active probe 314 Path information recording unit 331 Filtering 332 Sampling 335 Memory slot 336 Tunnel information database 337 Tunnel ID database 338 Tunnel state database

Claims (20)

When multiple overlay networks are formed on an underlay network, a method for measuring a traffic state of each tunnel on each overlay network to detect a change in the tunnel state and detecting a failure in the underlay network Because
Extracting packets of the tunnel traffic;
Analyzing the packet header of the extracted packet to measure the traffic state of the tunnel;
Estimating the occurrence of a failure from the analysis result of the packet header;
Re-checking the path of the underlay network when the occurrence of a failure is estimated,
An underlay network failure detection method comprising: Extracting the packet includes
Filtering only the overlay network traffic packets from the received total traffic packets by identifying with the overlay network key in the tunnel header;
Sampling the filtered packet at a determined rate;
The underlay network failure detection method according to claim 1, comprising: Measuring the traffic state
Obtaining packet header information of the sampled packet;
From the packet header information, calculating a use bandwidth value, a delay value, and a packet loss value, which are three parameters each representing a tunnel traffic state;
Recording the value of each parameter of the tunnel traffic state in a memory slot as time-series data of a fixed period;
The underlay network failure detection method according to claim 2, further comprising:   A packet header of the tunnel traffic of the overlay network, an outer header for the routing protocol of the underlay network, a tunnel header including a key of an identifier of each overlay network, and an inner header for the routing protocol of the overlay network, The underlay network failure detection method according to claim 3.   A tunnel ID is configured using a key of the overlay network in the tunnel, a source IP address in the outer header, and a destination IP address in the outer header, and the traffic state of each tunnel in each overlay network The underlay network failure detection method according to claim 4, wherein management is performed using a tunnel ID. Estimating the occurrence of the failure is
Obtaining the value of each parameter stored in the memory slot;
Calculating the mean value μ and the standard deviation σ of the change for each parameter;
determining an allowable change range where α is a given integer and the lower limit is μ−ασ and the upper limit is μ + ασ for each parameter;
The underlay network failure detection method according to claim 3, further comprising: The change allowable range of each parameter is compared with the latest measured value of each parameter, and when the latest measured value falls within the allowable change range, it is determined that the parameter value is normal, and the latest If the measured value does not fall within the allowable change range, it is determined that there is a sudden change in the parameter value,
The underlay network failure detection method according to claim 6, wherein the occurrence of a failure is estimated by estimating a traffic state abnormality based on the presence or absence of the sudden change. When there is a sudden change,
When the packet loss rate is less than or equal to the set value, an abnormal traffic state is estimated on the condition that the used bandwidth value changes, and when the packet loss rate is greater than the set value, the change in the delay value is The underlay network failure detection method according to claim 7, wherein a traffic state abnormality is estimated as a condition. When the change in the used band value is a condition, the traffic condition is abnormal when the used band value decreases and the delay value increases, and when the used band value decreases and the packet loss rate value increases. Estimate
When the change in the delay value is a condition, anomalies in traffic conditions are estimated when the delay value increases and the bandwidth usage value decreases, and when the delay value increases and the packet loss rate value increases. To
The underlay network failure detection method according to claim 8. Reconfirming the route of the underlay network
The underlay network route information has changed from the overlay node to the address of the front end of the tunnel that is the destination, and the underlay network route information has changed in comparison with the route information stored in advance. Check that
Identifying a failure of the underlay network when the path of the underlay network has changed;
The underlay network failure detection method according to claim 1, comprising: A network system in which a plurality of overlay networks are formed on an underlay network,
An overlay node having one or a plurality of virtual nodes and a measurement function unit that measures a traffic state of each tunnel on each overlay network and detects a change in the state of the tunnel;
The measurement function unit includes a packet extraction unit that extracts a packet of the tunnel traffic, a packet header analysis unit that analyzes a packet header of the packet extracted by the packet extraction unit and measures a traffic state of the tunnel, and the packet Tunnel failure detection means for estimating the occurrence of a failure based on the analysis result of the header analysis means, and route reconfirmation means for reconfirming the route of the underlay network when the tunnel failure detection means estimates the occurrence of a failure A network system comprising: The packet extraction means includes
A filtering unit that filters only the packets of the overlay network traffic from the received whole traffic packets by identifying with the overlay network key in the tunnel header;
A sampling unit that samples the filtered packet at a determined rate;
The network system according to claim 11, comprising:   The packet header analyzing means includes a memory slot, obtains packet header information of the sampled packet, and uses the packet header information as three parameters representing a tunnel traffic state, a use band value, a delay value, and a packet. The network system according to claim 12, wherein a loss value is calculated, and the value of each parameter is recorded in the memory slot as time-series data having a constant period.   A packet header of the tunnel traffic of the overlay network, an outer header for the routing protocol of the underlay network, a tunnel header including a key of an identifier of each overlay network, and an inner header for the routing protocol of the overlay network, The network system according to claim 13.   The packet header analysis means constructs a tunnel ID using a key of the overlay network in the tunnel, a source IP address in the outer header, and a destination IP address in the outer header, and each of the overlay networks The network system according to claim 14, wherein the traffic state of each tunnel is managed using the tunnel ID.   The tunnel failure detection means obtains the value of each parameter stored in the memory slot, calculates the average value μ and the standard deviation σ of the change for each parameter, and is given α The network system according to claim 13, wherein an allowable change range is determined for each parameter as an integer, the lower limit being μ−ασ and the upper limit being μ + ασ.   The tunnel failure detection means compares the change allowable range of each parameter with the latest measured value of each parameter, and if the latest measured value falls within the change allowable range, the parameter value is normal. If the latest measured value does not fall within the allowable change range, it is determined that there is a sudden change in the parameter value, and an abnormal traffic state is estimated based on the presence or absence of the sudden change. The network system according to claim 16, wherein the occurrence of a fault is estimated.   The tunnel failure detection means estimates a traffic state abnormality on the condition of a change in the use band value if the packet loss rate ≦ the set value with respect to the measured packet loss rate when the sudden change occurs. 18. The network system according to claim 17, wherein if the packet loss rate is greater than the set value, an abnormality in the traffic state is estimated on the condition that the delay value changes. The tunnel failure detection means is
When the change in the used band value is a condition, the traffic condition is abnormal when the used band value decreases and the delay value increases, and when the used band value decreases and the packet loss rate value increases. Estimate
When the change in the delay value is a condition, anomalies in traffic conditions are estimated when the delay value increases and the bandwidth usage value decreases, and when the delay value increases and the packet loss rate value increases. The network system according to claim 18.   The route reconfirming unit reconfirms the route information of the underlay network with respect to the address of the front end of the tunnel that is a destination from the overlay node, and compares the information with the route information stored in advance. 12. The network system according to claim 11, wherein it is confirmed whether or not the route information of the network has changed, and a failure of the underlay network is specified when the route of the underlay network has changed.

Images