WO2011118575A1

WO2011118575A1 - Communication system, control device and traffic monitoring method

Info

Publication number: WO2011118575A1
Application number: PCT/JP2011/056822
Authority: WO
Inventors: 栄一溝口
Original assignee: 日本電気株式会社
Priority date: 2010-03-24
Filing date: 2011-03-22
Publication date: 2011-09-29

Abstract

Provided is a communication system that is able to respond to both a requirement to minimize the number of processing rules (flow entries) maintained by individual transfer nodes, and a requirement for gaining a clear picture of the traffic that flows through a network. The communication system contains: a plurality of transfer nodes, which process incoming packets using processing rules that conform to the incoming packets, and are provided with a packet processing unit that collects statistics on the packets to which the processing rules have been applied; and a control device, which, for a specific transfer node, begins a detailed analysis of the packets that are the target of the statistical information, on the basis of the statistical information on the packets collected from each transfer node, and receives and outputs the analysis results from the specific transfer node (fig. 1).

Description

Communication system, control device, and traffic monitoring method

[Description of related applications]
The present invention is based on the priority claim of Japanese Patent Application: Japanese Patent Application No. 2010-068904 (filed on Mar. 24, 2010), the entire contents of which are incorporated herein by reference. Shall.
The present invention relates to a communication system, a control device, and a traffic monitoring method, and more particularly to a communication system, a control device, and a traffic monitoring method including a forwarding node that processes a received packet according to a processing rule that matches the received packet.

In recent years, a technique called OpenFlow has been proposed (see Non-Patent Documents 1 and 2). OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. The OpenFlow switch that functions as a forwarding node includes a secure channel for communication with the OpenFlow controller positioned as a control device, and operates according to a flow table that is appropriately added or rewritten from the OpenFlow controller. In the flow table, for each flow, a set of a matching rule (header field) for matching with a packet header, an action (Action) that defines the processing content, and flow statistical information (counter) is defined (see FIG. 8). ).

For example, when the OpenFlow switch receives a packet, it searches the flow table for an entry having a matching rule (see the header field in FIG. 8) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch updates the flow statistical information (counter) and executes the processing contents described in the action field of the entry on the received packet. To do. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and the source / destination of the received packet. To request the determination of the route of the packet based on the above, receive the flow entry that realizes this, and update the flow table. As described above, the OpenFlow switch performs packet transfer using an entry stored in the flow table as a processing rule.

Also, as described above, the OpenFlow controller has a function of collecting flow statistical information (counter) that is updated each time a packet is processed (visualization function).

Non-Patent Document 3 introduces a technique called “sFlow” for performing network traffic sampling.

The entire disclosures of Non-Patent Documents 1 to 3 are incorporated herein by reference.
The following analysis was made by the present inventors.
The no. Of FIG. 1 to 3 are examples of flow entries (processing rules) set in the open flow switch (OFS2) in FIG. no. 1 flow entry has a source IP address of 10.10.10. An action for outputting a packet received from A from port number # 0 (GBE0 / 3) is defined. Similarly, no. For the

flow entries

2 and 3, the source IP address 10.10.10. B (port # 8000), 10.10.10. An action for outputting a packet received from B (port # 8080) from port number # 0 (GBE0 / 3) is defined.

Since wildcards can be used in the flow entries set in

Non-Patent Documents

1 and 2, no. The flow entries 1 to 3 can be combined into a single flow entry as shown in FIG. 9B, thereby efficiently using the storage area and processing capacity of the flow entry in the open flow switch (OFS2). It is possible to do.

However, by collecting the flow entries, the statistical information (“counter” in FIGS. 8 and 10) for each flow entry that can be acquired by the open flow switch (OFS2) is also combined into one. For example, As shown in FIG. 10, when abnormal traffic occurs, there is a problem that it becomes difficult to determine which flow is causing abnormal traffic.

On the other hand, it is conceivable to implement sFlow, “NetFlow”, port mirroring, etc. of Non-Patent Document 3 in individual OpenFlow switches. However, the constant use of these technologies causes a heavy CPU load on the OpenFlow switch, There is a problem that the throughput of the entire network is lowered.

The present invention has been made in view of the above circumstances, and the object of the present invention is to request that the number of processing rules (flow entries) held by each forwarding node be as small as possible, It is an object of the present invention to provide a communication system, a control device, and a traffic monitoring method that can satisfy both requests for grasping flowing traffic.

According to a first aspect of the present invention, a plurality of forwarding nodes including a packet processing unit that performs processing of a received packet using a processing rule that matches the received packet and that collects statistics of the packet to which the processing rule is applied; Based on the statistical information of the packets collected from each forwarding node, the specific forwarding node starts analyzing the packet that is the target of the statistical information, and receives the analysis result from the specific forwarding node. And a control device that outputs the data.

According to the second aspect of the present invention, a plurality of forwarding nodes including a packet processing unit that performs processing of a received packet using a processing rule that matches the received packet and that takes statistics of the packet to which the processing rule is applied; Based on the statistical information of the packets that are connected and collected from each forwarding node, the specific forwarding node starts analyzing the packet that is the target of the statistical information, and the analysis result is sent from the specific forwarding node. A control device for receiving and outputting is provided.

According to a third aspect of the present invention, a plurality of forwarding nodes including a packet processing unit that performs processing of a received packet using a processing rule that matches the received packet and that takes statistics of the packet to which the processing rule is applied; A program that is executed by a computer that configures a connected control device and that collects packet statistical information from each forwarding node and a specific forwarding based on the packet statistical information collected from each forwarding node There is provided a program for causing a node to execute processing for starting analysis of a packet that is the target of the statistical information, and processing for receiving and outputting the analysis result from the specific forwarding node. This program can be recorded on a computer-readable storage medium. That is, the present invention can be embodied as a computer program product.

According to a fourth aspect of the present invention, a plurality of forwarding nodes including a packet processing unit that performs processing of a received packet using a processing rule that matches the received packet and that takes statistics of the packet to which the processing rule is applied; The connected control device collects the statistical information of the packet from each of the forwarding nodes, and based on the statistical information of the packet collected from each of the forwarding nodes, becomes a target of the statistical information to a specific forwarding node There is provided a traffic monitoring method including a step of starting an analysis of a received packet and a step of receiving and outputting the analysis result from the specific forwarding node. The method is tied to a specific machine, a control device that controls the forwarding node.

According to the present invention, it is possible to satisfy both a request for reducing the number of processing rules (flow entries) held by each forwarding node as much as possible and a request for grasping traffic flowing in the network. . This is because a forwarding node that performs detailed traffic monitoring is specified based on the statistical information of the processing rules, and a stepwise configuration is adopted in which traffic analysis is performed.

It is a block diagram for demonstrating the structure of the 1st Embodiment of this invention. It is a sequence diagram for demonstrating the operation | movement of the 1st Embodiment of this invention. It is a figure for demonstrating the operation | movement of the 1st Embodiment of this invention. It is an example of the processing rule set using the analysis result of FIG. It is a block diagram for demonstrating the structure of the 2nd Embodiment of this invention. It is a figure for demonstrating the operation | movement of the 2nd Embodiment of this invention. 7 is an example of processing rules set using the analysis result of FIG. 6. It is a figure which shows the structure of the flow entry of the open flow switch of a

nonpatent literature

1,2. It is a specific example of the flow table of the open flow switch of a

nonpatent literature

1,2. It is a figure for demonstrating operation | movement of the open flow switch to which the flow entry shown to (B) of FIG. 9 was set.

First, the outline of the present invention will be described. Hereinafter, the reference numerals of the drawings attached to this summary are merely examples for assisting understanding, and are not intended to be limited to the illustrated embodiments. As shown in FIG. 1, the communication system according to the present invention performs processing of received packets using processing rules that match the received packets, and includes a plurality of packet processing units that take statistics of packets to which the processing rules are applied. Transfer nodes (OFS; OpenFlow switch) 10A to 10C, and a control device (OFC; OpenFlow controller) 20 having a function of collecting statistical information of packets collected from each of the transfer nodes 10A to 10C. Consists of.

The control device 20 causes the specific forwarding node to start analyzing the passing packet based on the packet statistical information collected from each forwarding node 10A to 10C, and receives the analysis result of the passing packet from the specific forwarding node. And output. For example, when there is an abnormality in the statistical information of the packet collected from the forwarding node 10A, the control device 20 causes the forwarding node 10A to start detailed analysis of the packet that is the target of the statistical information and receive the result ·Output.

The detailed analysis result of the packet can be used to identify the cause of abnormal traffic and to implement countermeasures (packet discard, route change) in the upstream forwarding nodes 10A to 10C causing the abnormal traffic.

[First Embodiment]
Next, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram for explaining the configuration of the first embodiment of the present invention. Referring to FIG. 1, a terminal 30, three forwarding nodes 10A to 10C (OFS1 to OFS3), a control device (OFC) 20, a server 40A, and a server 40B are shown.

The control device (OFC) 20 is connected to the transfer nodes 10A to 10C (OFS1 to OFS3) via a dedicated secure channel, and sets a flow entry as a processing rule in the transfer nodes 10A to 10C (OFS1 to OFS3). It has a function. In the case of the OpenFlow controller and OpenFlow switch of

Non-Patent Documents

1 and 2, the setting of the flow entry and the collection of statistical information to be described later are performed using the OpenFlow protocol.

The forwarding node 10A (OFS1) searches for a processing rule storage unit 11 that stores a flow entry as a processing rule, and a processing rule that matches the received packet from the processing rule storage unit 11, and determines the processing content defined in the processing rule. The packet processing unit 12 to be executed and the packet sampling processing unit that starts sampling of the passing packet based on an instruction from the sampling data analysis unit 23 of the control device (OFC) 20 and transmits the result to the control device (OFC) 20 13. Further, the packet processing unit 12 has a function of requesting the control device (OFC) 20 to set a processing rule when there is no processing rule that matches the received packet in the processing rule storage unit 11.

Although omitted in FIG. 1, the forwarding node 10B (OFS2) and the forwarding node 10C (OFS3) are also assumed to have the same configuration as the forwarding node 10A (OFS1). Such a forwarding node can be realized by mounting the sFlow agent of Non-Patent Document 3 on the OpenFlow switch of

Non-Patent Documents

1 and 2.

The control device (OFC) 20 creates a processing rule in response to a processing rule setting request from the packet processing unit of the forwarding nodes 10A to 10C (OFS1 to OFS3), and each of the forwarding nodes 10A to 10C (OFS1 to OFS3). ), A statistical information collection unit 22 that requests statistical information of packets to which the processing rules are applied, from the packet processing units of the forwarding nodes 10A to 10C (OFS1 to OFS3), Based on the information, the sampling data analysis unit 23 that instructs the packet sampling processing unit of the specific forwarding nodes 10A to 10C (OFS1 to OFS3) to start the packet sampling (sFlow setting) and receives the result. I have. Such a control device can be realized by mounting the sFlow diagram analysis function (sFlow collector) of Non-Patent Document 3 on the OpenFlow controllers of

Non-Patent Documents

1 and 2.

As described in

Non-Patent Documents

1 and 2, the control device (OFC) 20 holds network topology information, transfer node configuration information, and set flow information (flow entry information). A processing rule is created by referring to it. For example, by referring to the network topology information, using the Dijkstra method, etc., create a route with the minimum hop, and set processing rules for realizing the route to each forwarding node on the route, so that each flow Route control can be performed.

Each unit (processing means) of the control device (OFC) 20 shown in FIG. 1 is executed by a computer program that causes a computer constituting the control device (OFC) 20 to execute the above-described processes using the hardware. Can be realized.

Subsequently, the operation of the present embodiment will be described in detail with reference to FIGS. FIG. 2 is a sequence diagram for explaining the operation of the first exemplary embodiment of the present invention. Referring to FIG. 2, the control device (OFC) 20 assigns each processing rule to the packet processing units of the forwarding nodes 10A to 10C (OFS1 to OFS3) at a predetermined timing such as a fixed time interval and a predetermined time. Request the statistical information of the applied packets and collect the responses (see Step S001; page 9 “Read-State” of Non-Patent Document 2).

Next, the control device (OFC) 20 determines whether an abnormality has occurred based on the collected statistical information. In this determination, either the number of received bytes or the number of packets included in the statistical information received from each of the forwarding nodes 10A to 10C (OFS1 to OFS3), or an index calculated using both of them is determined. This can be done depending on whether or not the threshold is exceeded.

Here, for example, as shown in FIG. 3, when abnormal traffic is observed in a certain forwarding node 10B (OFS2) (Yes in step S002), the control device (OFC) 20 uses the forwarding node 10B (OFS2). ) Is set for a processing rule exceeding a predetermined threshold value, and packet sampling and counting are instructed (step S003).

Here, as traffic sampled by sFlow, information on the header field of the processing rule in which an abnormality has been observed is used, and the port (output port: GBE0 / 1) and the destination IP address (10.10.10.X) The sampling conditions can be specified and the traffic to be sampled can be minimized.

Upon receipt of the instruction, the forwarding node 10B (OFS2) transmits a packet sampling result (analysis result) to the control device (OFC) 20 under the designated condition (step S004). The result of sampling the packet (analysis result) is transmitted, for example, in the form of an sFlow datagram.

In the control device (OFC) 20 that has received the result (analysis result) of sampling the packet, as shown in FIG. 4, the sFlow datagram with a large amount of communication is analyzed to identify the one with the largest amount of communication. Can do. Furthermore, since upper protocol information equivalent to tcpdump is obtained from the sFlow datagram, it is possible to identify an abnormal application from the analysis result.

Using the analysis result, the control device (OFC) 20 uses the transfer node (ingless OFS; transfer node 10A (OFS1) in FIG. 5) located at the start point of the abnormal flow or the flow used by the abnormal application. On the other hand, as shown in FIG. 5, a processing rule (flow entry) for executing packet discard for the corresponding flow is set (step S005). As described above, it is possible to cope with a traffic abnormality in the forwarding node 10B (OFS2).

In the example of FIG. 5, the processing rule (flow entry) for executing packet discarding has been described. However, any processing that suppresses the transfer of packets belonging to an abnormal flow may be used. A method of setting a processing rule (flow entry) that defines an action to be changed or an action to change a transfer route, or a method of sending a packet for ending communication can also be adopted.

In the example of FIG. 5, the processing rule (flow entry) is set for the forwarding node (ingress OFS; forwarding node 10A (OFS1) of FIG. 5) located at the start point of the flow. Set processing rules (flow entry) that cause other forwarding nodes on the upstream side of the path where the packet is generated to suppress packet forwarding such as packet discard or forwarding priority change, or send packets that terminate communication It is also possible to deal with.

As described above, according to the present embodiment, it is possible to obtain an analysis result of abnormal traffic and take measures without impairing the performance of the entire network. The reason for this is that a low-load traffic monitor that uses statistical information in the processing rules (flow entry) is regularly performed, and when an abnormality occurs, a detailed traffic analysis is performed locally to perform step-by-step monitoring. It is in having adopted.

As described above, it is also possible to identify an abnormal application by using sFlow for detailed traffic analysis.

[Second Embodiment]
Subsequently, a second embodiment of the present invention in which a change is made to the first embodiment will be described in detail with reference to the drawings. The difference between the second embodiment and the first embodiment is that the detailed traffic is also monitored using the statistical information in the processing rule (flow entry), and the basic configuration is the same. Therefore, the following description will focus on the differences.

FIG. 6 is a block diagram for explaining the configuration of the second embodiment of the present invention. The difference from FIG. 1 showing the configuration of the first embodiment is that the forwarding nodes 10A to 10c (OFS1 to OFS3) of the forwarding nodes 10A to 10C (OFS1 to OFS3) are omitted, and the sampling data analysis unit 23. The control device (OFC) 20a in which is omitted is used.

In the first embodiment, the sampling data analysis unit 23 of the control device (OFC) 20 selects specific forwarding nodes 10A to 10C (OFS1 to OFS1 to OFS1) based on statistical information received from the forwarding nodes 10A to 10C (OFS1 to OFS3). The packet sampling processing unit of OFS3) is instructed to start packet sampling (sFlow setting) and receives the result. In this embodiment, the processing rule creation unit 21a, as shown in FIG. Statistical information (xxx-1, xxx-2, xxx-3 in FIG. 7) is collected by setting a plurality of subdivided processing rules (flow entries) for detailed analysis of packets.

As shown in FIG. 9, a plurality of subdivided processing rules (flow entries) can be created from history information when a plurality of processing rules (flow entries) are aggregated on the control device (OFC) 20 side. it can. Moreover, it is good also as what is subdivided using the network topology information which the control apparatus (OFC) 20 hold | maintains, and the structure information of a forwarding node.

As described above, according to the present embodiment, the processing rules subdivided to the level necessary for traffic monitoring without mounting the packet sampling processing unit in each of the forwarding nodes 10a to 10c (OFS1 to OFS3). It is possible to create (flow entry) and perform detailed traffic analysis.

The preferred embodiment of the present invention and the specific operation thereof have been described above, but the present invention is not limited to the above-described embodiment, and is within the scope not departing from the basic technical idea of the present invention. Further modifications, substitutions and adjustments can be made.

For example, in the above-described embodiment, for the sake of simplicity of explanation, an example in which there is a network in which three transfer nodes 10A to 10C (OFS1 to OFS3) are arranged has been described. However, the number of transfer nodes is not limited.

Further, in the above-described embodiment, it has been described that sFlow is used. However, SNMP (Simple Network Management Protocol) remote monitoring (RMON), NetFlow, port mirroring, and the like depending on the functions provided in each transfer node. It is also possible to use traffic monitoring technology.

In the above-described embodiment, basically, a series of operations such as determination of traffic abnormality (comparison with a threshold value) and specification of abnormal flow (analysis of sFlow datagram) are performed by the control device (OFC) 20. 4 and FIG. 7 is displayed on the display device connected to the control device (OFC) 20, and the subsequent operation is performed through the judgment of the operator (network administrator). It is also possible to adopt a configuration for performing processing (sFlow setting, processing rule (flow entry) creation / setting).
Within the scope of the entire disclosure (including claims) of the present invention, the embodiment can be changed and adjusted based on the basic technical concept. Various combinations and selections of various disclosed elements are possible within the scope of the claims of the present invention. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

10a, 10A-10C Forwarding node (OFS)
DESCRIPTION OF SYMBOLS 11 Processing rule memory | storage part 12 Packet processing part 13 Packet

sampling processing part

20, 20a Control apparatus (OFC)
21, 21a Processing rule creation unit 22 Statistical information collection unit 23 Sampling data analysis unit 30 Terminal 40A Server A
40B Server B

Claims

A plurality of forwarding nodes including a packet processing unit that performs processing of a received packet using a processing rule that matches the received packet, and that collects statistics of the packet to which the processing rule is applied;
Based on the statistical information of the packets collected from each forwarding node, causes a specific forwarding node to start analyzing the packet that is the target of the statistical information, and receives the analysis result from the particular forwarding node; And a control device that outputs the communication system.
The control device causes the excess traffic to the forwarding node on the input side of the excess traffic specified using the network topology information based on the analysis result of the packet that is the target of the statistical information. The communication system according to claim 1, wherein a processing rule for suppressing packet transfer is set.
The forwarding node further includes a packet sampling processing unit that samples a packet according to a sampling condition instructed from the control device,
The communication system according to claim 1 or 2, wherein the control device instructs the packet sampling processing unit of the specific forwarding node to start sampling of the packet that is the target of the statistical information, and collects the result. .
The communication system according to claim 3, wherein the packet sampling processing unit operates as an sFlow agent, and transmits an sFlow datagram conforming to the designated sampling condition to the control device.
The communication system according to claim 1 or 2, wherein the control device sets a plurality of subdivided processing rules for analyzing the packet that is the target of the statistical information for the specific forwarding node.
The control device, based on the analysis result of the packet that is the target of the statistical information, to the forwarding node that is the input terminal of the excess traffic specified using the network topology information, the cause of the excess traffic The communication system according to any one of claims 1 to 5, wherein a processing rule that suppresses transfer of a packet that is configured is set.
The received packet is processed using a processing rule suitable for the received packet, and connected to a plurality of forwarding nodes including a packet processing unit that takes statistics of the packet to which the processing rule is applied,
Based on the statistical information of the packets collected from each forwarding node, causes a specific forwarding node to start analyzing the packet that is the target of the statistical information, and receives the analysis result from the particular forwarding node; Control device to output.
Based on the analysis result of the packet that is the target of the statistical information, the forwarding of the packet causing the excess traffic is suppressed for the forwarding node on the input side of the excess traffic specified by using the network topology information. The control device according to claim 7, wherein a processing rule to be set is set.
For the specific forwarding node, specify the sampling condition, instruct the sampling start of the packet that is the target of the statistical information,
The control device according to claim 7 or 8, wherein the packet sampling processing unit of the specific forwarding node performs packet sampling according to the sampling condition and collects the results.
The control device according to claim 7 or 8, wherein a plurality of subdivided processing rules are set for the specific forwarding node for analysis of the packet that is the target of the statistical information.
Based on the analysis result of the packet that is the target of the statistical information, the forwarding node that is the input terminal of the excess traffic identified by using the network topology information is sent to the packet that causes the excess traffic. The control device according to claim 7, wherein a processing rule for suppressing transfer is set.
The received packet is processed using a processing rule that matches the received packet, and executed on a computer that constitutes a control device connected to a plurality of forwarding nodes having a packet processing unit that takes statistics of the packet to which the processing rule is applied. A program to
Collecting packet statistical information from each forwarding node;
Based on the packet statistical information collected from each forwarding node, a process for causing a specific forwarding node to start analyzing the packet that is the target of the statistical information;
A program for executing processing for receiving and outputting the analysis result from the specific forwarding node.
A control device connected to a plurality of forwarding nodes that performs processing of the received packet using a processing rule that matches the received packet and includes a packet processing unit that takes statistics of the packet to which the processing rule is applied, Collecting packet statistics from
Based on the statistical information of the packets collected from each forwarding node, causing a specific forwarding node to start analyzing the packet that is the target of the statistical information;
Receiving and outputting the analysis result from the specific forwarding node.