This application claims the Japanese Patent Application No. 2013-154616 filed Jul. 25, 2013, which is incorporated herein by reference in its entirety.
1. Field of the Invention
The present invention relates to a technique for specifying a cause of microburst occurrence.
2. Description of the Related Art
Recently, a service of a mobile communication system which is standardized by 3GPP and called a long term evolution (LTE) system has been provided by a great number of mobile network operators and used. A standard document of the LTE is described in a 3GPP standard document (3GPP URL: http://www.3gpp.org/).
Also, recently, a technique for analyzing contents of a payload of an application layer of a data packet has been used for visualization or intrusion detection of traffic, the technique being called a deep packet inspection (DPI). An article of “Deep Packet Inspection using Parallel Bloom Filters”, by Sarang Dharmapurikar, et al., IEEE Micro, IEEE Computer Society, Volume 24, Issue 1, p. 52 to 61, January/February 2004, is related to a DPI using a Bloom filter.
Recently, a communication system includes a broader band and higher density in housing. Thus, when communication is simultaneously started by a great number of terminals, in a communication apparatus housing the terminals at high density, a phenomenon called a microburst, in which a great number of packets reaches the communication apparatus as a burst instantly, occurs. The reason why communication is started simultaneously by a great number of terminals is that the great number of terminals use a specific service/application which automatically causes communication at predetermined time.
Since communication is started from a call control of a control plane, a control plane packet becomes a microburst in most cases.
When receiving microbursts exceeding a throughput, a communication apparatus deals by performing shaping, policing, and packet discarding of a packet flow, but a delay or discarding of a packet caused thereby causes lower service quality. Thus, it is necessary for a communication operator to provide an essential solution.
As one of the essential solutions, there is a method to prevent packets from being congested and becoming the microburst by improving the throughput of the communication apparatus to process the microburst without performing delaying or discarding, or by expanding the communication apparatus to perform distributed processing. However, in a case where traffic volume of the microburst is dozens of times of that of a normal time, a great part of the throughput becomes idle in normal traffic processing. Thus, the improvement of the throughput or the expansion of the communication apparatus is not a realistic method. A different method to specify a cause of microburst occurrence and to ask a service/application providing operator for an improvement to prevent a microburst due to the same cause is a realistic method.
However, to specify the cause of microburst occurrence, statistical data or a call control log of the traffic volume included by a prior communication apparatus is not adequate. It is because the statistical data or the call control log of the traffic volume does not include information of “what service/application has caused traffic?” which is necessary in analyzing the cause of microburst occurrence, although the statistical data or the call control log of the traffic volume includes information of “when which call control has become a microburst”. This information is in a payload in an application layer of a data plane packet during microburst occurrence.
As a method to specify a service/application by analyzing contents of a payload of an application layer, there is the DPI technique such as an example in an article of “Deep Packet Inspection using Parallel Bloom Filters”, by Sarang Dharmapurikar, et al., IEEE Micro, IEEE Computer Society, Volume 24, Issue 1, p. 52 to 61, January/February 2004. However, there has been no mechanism to detect microburst occurrence and to extract and analyze a data plane packet related to the microburst.
Thus, to specify a cause of microburst occurrence, a new mechanism to extract and analyze a data plane packet corresponding to the microburst.
In a system to specify a cause of burst occurrence by using a microburst detection apparatus, a packet extraction apparatus, and a cause analysis apparatus, each of the apparatuses operates in the following manner. The microburst detection apparatus detects a microburst of a control plane packet and extracts, from the control plane packet which forms the detected microburst, call information for identifying call of a data plane. The packet extraction apparatus extracts a data plane packet corresponding to the call information extracted by the microburst detection apparatus. The cause analysis apparatus analyzes a payload of an application layer of the data plane packet extracted by the packet extraction apparatus and specifies a service/application which causes microburst occurrence. Then, the cause analysis apparatus counts the number of data plane packets in response to the specified service/application and displays the counted number of packets associated with the specified service/application.
According to the present invention, it is possible to specify a cause of microburst occurrence.
First, microburst occurrence will be described along with a configuration of an LTE system. In
Here, for description in the following, a data channel called a bearer in the S1-U (113) and an identifier TEID thereof will be described. To make a U-Plane packet flow in the S1-U (113), it is necessary to establish a data channel called a bearer in the S1-U (113). The bearers vary from one UE 101 to another. Also, one UE 101 may use a plurality of bearers. Also, an Uplink bearer and a Downlink bearer are different from each other. The bearer is identified by an identifier called a TEID.
The S-GW 104 delivers and transmits an Uplink TEID to the eNB 102 through the MME 103, whereby the Uplink bearer is established. An Uplink TEID delivered by the S-GW 104 is unique in one S-GW 104. Thus, to identify Uplink bearers of a plurality of S-GWs 104 uniquely, it is necessary to make an IP address and an Uplink TEID of the S-GW 104 a set (pair). As an identifier which is a set of an IP address and an Uplink TEID of the S-GW 104, there is an S1-U SGW F-TEID.
Similarly, the eNB 102 delivers and transmits a Downlink TEID to the S-GW 104 through the MME 103, whereby the Downlink bearer is established. A Downlink TEID delivered by the eNB 102 is unique in one eNB 102. Thus, to identify Downlink bearers of a plurality of eNBs 102 uniquely, it is necessary to make an IP address and a Downlink TEID of the eNB 102 a set (pair). As an identifier which is a set of an IP address and a Downlink TEID of the eNB 102, there is an S1 eNodeB F-TEID.
In the LTE system, when the UE 101 has been in a non-communication state for more than a predetermined period of time, a bearer in the S1-U (113) is released. Thus, when the UE 101 starts communication, call control called Reactivation to reestablish a bearer in the S1-U (113) is performed. That is, when a great number of radio terminal UEs 101 use a specific service/application which causes communication at certain time (time determined by specific service/application), the Reactivation occurs from the great number of UEs 101 simultaneously at the certain time.
In
When the connection of the radio section between the UE 101 and the eNB 102 is established, the UE 101 transmits, to the MME 103, a call control message called a Service Request (212) through the eNB 102. A stream control transmission protocol (SCTP) is used as a protocol for communication of the S1-MME (111) between the eNB 102 and the MME 103. Thus, the MME 103 does not receive, from the eNB 102, a microburst exceeding the throughput.
In response to the reception of the Service Request (212) by the MME 103, Authentication/Security processing (213) is executed between the UE 101 and the MME 103 and EMM Information (214) is transmitted from the MME 103 to the UE 101.
When the MME 103 transmits an Initial Context Setup Request (215) to the eNB 102, RRC Connection Reconfiguration processing (216) is executed between the eNB 102 and the UE 101. The Initial Context Setup Request (215) includes an IP address and an Uplink TEID of the S-GW 104. Thus, by using the IP address and the Uplink TEID of the S-GW 104, the eNB 102 can transfer Uplink Data (217), which is transmitted from the UE 101, to the S-GW 104 through the S1-U (113). (Since the Uplink TEID delivered from the S-GW 104 is also notified to the MME 103 in advance when the UE 101 establishes a session with the S-GW 104, the MME 103 transmits, to the eNB 102, the Initial Context Setup Request (215) including the Uplink TEID in the Reactivation.)
Next, when an Initial Context Setup Response (218) is transmitted back from the eNB 102 to the MME 103, the MME 103 transmits a Modify Bearer Request (219) to the S-GW 104. A user datagram protocol (UDP) is used for communication of the S11 (112) between the MME 103 and the S-GW 104 Thus, this Modify Bearer Request (219) may become a microburst which exceeds the throughput.
The Modify Bearer Request (219) includes the S1 eNodeB F-TEID which is a Downlink identifier. Thus, by using the S1 eNodeB F-TEID, the S-GW 104 can transfer Downlink Data (221), which moves to the UE 101, to the eNB 102 through the S1-U (113). Also, the S-GW 104 transmits a Modify Bearer Response (220) back to the MME 103.
What has been described above is a flow of the Reactivation. It has been described that the Modify Bearer Request (219) in the S11 (112) may become a microburst which exceeds the throughput.
A mechanism to specify a cause of microburst occurrence in a case where a Modify Bearer Request (219) becomes the microburst will be described. In
To detect a microburst of the Modify Bearer Request (219) in S11 (112), a microburst detection apparatus 120 is placed. Also, to extract a U-Plane packet flowing in S1-U (113), a packet extraction apparatus 130 is placed and connected to the microburst detection apparatus 120. Also, a cause analysis apparatus 140 is placed and connected to the packet extraction apparatus 130. By an eNB 102, an MME 103, and an S-GW 104, each of the microburst detection apparatus 120 and the packet extraction apparatus 130 is not recognized as an apparatus to be communicated but is recognized simply as a communication path. Thus, the LTE system operates in such a manner described with reference to
An operation of the LTE system illustrated in
The microburst detection apparatus 120 is preset (431) to count the number of received packets including the Modify Bearer Request (219) in each cycle of predetermined duration and to determine a microburst in a case where a count value in one cycle becomes equal to or greater than a threshold, and to extract call information for identifying call of a U-Plane according to information in the packet including the Modify Bearer Request (219).
In
Here, it is assumed that the microburst detection apparatus 120 is preset in a manner illustrated in
When the microburst detection apparatus 120 detects the Modify Bearer Request (219), the microburst detection apparatus 120 follows the setting illustrated in
In
In
Next, an operation (434 in
In 435 in
Next, an operation (436 in
For example, when a result in the display contents by S904 is in such a manner illustrated in
In the present embodiment, it is illustrated that a Downlink Data packet which flows after occurrence of a microburst of a Modify Bearer Request is extracted as a U-Plane packet which is a material to specify a service/application which is a cause of the microburst occurrence, and the service/application which causes the microburst occurrence is specified from an analysis of the extracted Downlink Data packet.
In the present embodiment, an Uplink Data packet which starts flowing before occurrence of a microburst of a Modify Bearer Request (219) is extracted as a U-Plane packet which is a material to specify a service/application which causes the microburst occurrence. Therefore, a packet extraction apparatus accumulates packets in a predetermined period of time. Also, the packet extraction apparatus extracts call information for identifying call of corresponding Uplink Data according to information in the Modify Bearer Request (219).
In
An operation in a system configuration in
Although it is not illustrated, when executing a call control sequence, such as Initial Attach, Tracking Area Update with S-GW change, Handover with S-GW change, Dedicated Bearer Activation, and Dedicated Bearer Deactivation, as an original operation, the S-GW 104 stores a correspondence relationship between an F-TEID for a C-Plane delivered from the S-GW 104 to the MME 103 and an S1-U SGW F-TEID delivered from the S-GW 104 to an eNB 102. Here, this stored correspondence relationship is called a call information correspondence table.
The packet extraction apparatus 131 duplicates a packet of Uplink Data 217 and accumulates the duplicated packet (1232 in
When detecting the Modify Bearer Request (219), the microburst detection apparatus 121 follows the contents of presetting, extracts a destination IP address and a destination TEID from a packet of the Modify Bearer Request (219), and counts the number of extracted packets (1233 in
In
In
Here, description goes back to
An operation (1236 in
An operation of the cause analysis apparatus 140 (1238 in
As a result of the processing by the cause analysis apparatus 140, a result similar to that in
The present embodiment is a modified example of the second embodiment. In the second embodiment, the interface for acquiring a call information correspondence table is connected to the S-GW 104. In the second embodiment, the S-GW 104 creates a call information correspondence table by an original operation thereof and outputs the call information correspondence table to the microburst detection apparatus 121 in response to a request from the microburst detection apparatus 121. In the present embodiment, a call information management apparatus is introduced on the assumption of a case where a microburst detection apparatus 121 cannot acquire a call information correspondence table from an S-GW 104.
In
As it has been described as the operation of the S-GW 104 in the second embodiment, the call information management apparatus 1600 monitors a message of the S11 (112) during a call control sequence such as Initial Attach, Tracking Area Update with S-GW change, Handover with S-GW change, Dedicated Bearer Activation, and Dedicated Bearer Deactivation, and stores, into the call information correspondence table, a correspondence relationship between an F-TEID for a C-Plane delivered from the S-GW 104 to an MME 103 and an S1-U SGW F-TEID delivered from the S-GW 104 to an eNB 102. Detail description of the operation of the call information management apparatus 1600 is omitted since the operation thereof is realized as the operation of the existing S-GW 104.
Note that as it is obvious from the system configuration in
In
As it is obvious from
To detect a microburst of a Modify Bearer Request (219) moving to the S-GW (A) 104A in the S11 (112), the microburst detection apparatus (A) 121A is placed. To detect a microburst of a Modify Bearer Request (219) moving to the S-GW (B) 104B, the microburst detection apparatus (B) 121B is placed. Also, a packet extraction apparatus 132 is placed to the communication path S5/S8 between the aggregation SW 1700, which aggregates the S-GW (A) 104A and the S-GW (B) 104B, and the P-GW 105. Both of a U-Plane packet which flows in the S-GW (A) 104A and a U-Plane packet which flows in the S-GW (B) 104B flow between the aggregation SW 1700 and the P-GW 105. Thus, placing one packet extraction apparatus is enough. On the other hand, it is useless to place one microburst detection apparatus between the aggregation SW 1700 and the P-GW 105. It is because a microburst of the Modify Bearer Request (219) which reaches the S-GW (A) 104A or the S-GW (B) 104B may not reach the P-GW 105 in a burst-state after being processed by the S-GW (A) 104A or the S-GW (B) 104B.
The microburst detection apparatus (A) 121A and the microburst detection apparatus (B) 121B are connected, respectively through communication paths 1701A and 1701B, to the packet extraction apparatus 132. The packet extraction apparatus 132 is connected to a cause analysis apparatus 141.
Also, the microburst detection apparatus (A) 121A and the microburst detection apparatus (B) 121B are respectively connected to the S-GW (A) 104A and the S-GW (B) 104B through interfaces 1100A and 1100B in order to acquire call information correspondence tables.
Similarly to the second embodiment, other than the interfaces 1100A and 1100B being respectively provided to the S-GW#1 S-GW (A) 104A and S-GW (B) 104B, it is not necessary to change an original configuration of the LTE system.
In the following, an operation of when a microburst of the Modify Bearer Request reaches the S-GW (A) 104A will be described in comparison with the other embodiments. An operation of when a microburst of the Modify Bearer Request reaches the S-GW (B) 104B is in a similar manner.
The contents of items illustrated in
With this, the microburst detection apparatus (A) 121A extracts a destination IP address of an IP header and a destination TEID of a GTPv2-C header of a packet including the Modify Bearer Request (219) as the message type. Also, the microburst detection apparatus (A) 121A determines a microburst in a case where the number of counted packets of the Modify Bearer Request (219) in the count cycle 502 is equal to or greater than a set value of the microburst detection threshold 503. Moreover, when determining the microburst, the microburst detection apparatus (A) 121A extracts an S5/S8-U SGW F-TEID corresponding to the extracted destination IP address and destination TEID from the call information correspondence table.
Note that when executing, as an original operation, a call control sequence such as Initial Attach, Tracking Area Update with S-GW change, Handover with S-GW change, Dedicated Bearer Activation, and Dedicated Bearer Deactivation, the S-GW (A) 104A executes processing to associate an “F-TEID for C-Plane delivered to MME” with the “S5/S8-U SGW F-TEID”.
Although it is not illustrated, in respect to the call information correspondence table of the present embodiment, the SGW (A) 104A stores the “F-TEID for C-Plane delivered to MME” associated with the “S5/S8-U SGW F-TEID”.
When the Modify Bearer Request (219) reaches the microburst detection apparatus (A) 121A, the microburst detection apparatus (A) 121A follows the setting and extracts a destination IP address and a destination TEID from a packet of the Modify Bearer Request (219) while counting the number of packets. Other than the processing in S1303, the operation of the microburst detection apparatus (A) 121A is similar to that in
An operation of the packet extraction apparatus 132 which has received the packet extraction instruction is similar to the operation of the packet extraction apparatus 130 of the first embodiment illustrated in
As described above, although it is necessary to place a plurality of microburst detection apparatuses in response to a plurality of S-GWs, by placing one packet extraction apparatus and one cause analysis apparatus, a maintainer can recognize a service/application which is a cause of microburst occurrence and ask an operator providing the service/application for an improvement such as spreading timing of communication occurrence, similarly to the other embodiments described above.
The present embodiment is a modified example of the fourth embodiment. In the fourth embodiment, the interface for acquiring a call information correspondence table is connected to the S-GW (A) 104A and the S-GW (B) 104B. In the fourth embodiment, the S-GW (A) 104A and the S-GW (B) 104B create the call information correspondence tables by the original operations thereof, and respectively output the call information correspondence tables to the microburst detection apparatus (A) 121A and the microburst detection apparatus (B) 121B in response to requests from the microburst detection apparatus (A) 121A and the microburst detection apparatus (B) 121B. In the present embodiment, a call information management apparatus is introduced on the assumption of a case where a microburst detection apparatus (A) 121A and a microburst detection apparatus (B) 121B cannot receive call information correspondence tables respectively from an S-GW (A) 104A and an S-GW (B) 104B.
In
The call information management apparatus (A) 1800A includes an interface 1820A to monitor a C-Plane packet in S11 (112) of an S-GW (A) 104A and an interface 1830A to monitor a C-Plane packet in a communication path S5/S8 from the S-GW (A) 104A to an aggregation SW 1700. A point different from the fourth embodiment is to provide such a call information management apparatus (A) 1800A.
The call information management apparatus (A) 1800A monitors, through the interface 1820A and the interface 1830A, a message of the S11 (112) and a message of the S5/S8 during a call control sequence such as Initial Attach, Tracking Area Update with S-GW change, Handover with S-GW change, Dedicated Bearer Activation, and Dedicated Bearer Deactivation, and associates an F-TEID for a C-Plane delivered from the S-GW (A) 104A to an MME 103 with an S5/S8-U SGW F-TEID delivered from the S-GW (A) 104A to a P-GW 105.
This association will be described with processing during the Initial Attach as an example. Here, detail description of the Initial Attach is omitted.
By monitoring an Uplink C-Plane packet of the S11 (112) of the S-GW (A) 104A through the interface 1820A and analyzing the Uplink C-Plane packet, the call information management apparatus (A) 1800A responds to reception of a packet including a Create Session Request as a message type and detects the Initial Attach. Information included in the packet of the Create Session Request is stored in the following manner. *A subscriber identifier called an IMSI is stored into a memory 1 (not illustrated, hereinafter each memory is not illustrated) of the call information management apparatus (A) 1800A. *Information which is called a Sender F-TEID for Control Plane and is for telling an F-TEID for a C-Plane delivered from a sender side to a receiver in a destination of GTPv2-C, that is, here, an F-TEID delivered from the MME 103 is stored into a memory 2. *An F-TEID for a C-Plane of the PGW 105, which is called a PGW S5/S8 Address for Control Plane or PMIP, is stored into a memory 3. Although an IP address of the PGW 105 is stored in a Create Session Request of the Initial Attach, a TEID is 0.
Next, when detecting, from the Uplink C-Plane packet of the S5/S8 of the S-GW (A) 104A through the interface 1830A, a packet which includes a destination IP address equal to an IP address in the PGW S5/S8 Address for Control Plane or PMIP stored in the memory 3, a Create Session Request as a message type, and an IMSI equal to the IMSI stored in the memory 1, the call information management apparatus (A) 1800A stores the information included in the packet in the following manner. *The Sender F-TEID for Control Plane, that is, here, the F-TEID for a C-Plane delivered from the S-GW (A) 104A to the P-GW 105 is stored into a memory 4. *The S5/S8-U SGW F-TEID is stored into a memory 5.
Next, the call information management apparatus (A) 1800A detects, from a Downlink C-Plane packet of the S5/S8 of the S-GW (A) 104A through the interface 1830A, a packet which includes a TEID of the GTPv2-C header equal to a TEID in the Sender F-TEID for Control Plane stored in the memory 4 and the Create Session Response as the message type. However, since there is not information stored into the memory here, the processing may be omitted.
Next, the call information management apparatus (A) 1800A detects, through the interface 1820A, a packet, which includes a TEID of the GTPv2-C header equal to a TEID in the Sender F-TEID for Control Plane stored in the memory 2 and the Create Session Response as the message type, from the Downlink C-Plane packet of the S11 (112) of the S-GW (A) 104A. The information included in the packet is stored in the following manner. *The Sender F-TEID for Control Plane is stored into a memory 6.
The data in the memory 6 and the data in the memory 5 are respectively associated with an “F-TEID for C-Plane delivered to MME” and an “S5/S8-U SGW F-TEID” on the call information correspondence table and managed.
Although description of other operations in the call control sequence is omitted, a Sender F-TEID for Control Plane in an Uplink message and a destination IP address of an IP header and a TEID of a GTPv2-C header in a Downlink message packet of the S11 (112) are checked, and the Uplink message and the Downlink message of the S11 (112) are associated with each other in a similar manner. Also, a Sender F-TEID for Control Plane in an Uplink message and a destination IP address of an IP header and a TEID of a GTPv2-C header in a Downlink message packet of the communication path S5/S8 are checked, and the Uplink message and the Downlink message of the communication path S5/S8 are associated with each other. Also, an IMSI, a PGW S5/S8 Address for Control Plane or PMIP, and the like can be checked and a message of the S11 (112) and a message of the communication path S5/S8 can be associated with each other. An S5/S8-U SGW F-TEID in the Uplink message of the communication path S5/S8 and a Sender F-TEID for Control Plane in the Downlink message of the S11 (112) can be extracted and respectively associated with the “F-TEID for C-Plane delivered to MME” and the “S5/S8-U SGW F-TEID” on the call information correspondence table and managed.
What has been described above is a unique operation of the present embodiment and an operation, description of which is omitted, is in a manner similar to that of the fourth embodiment.
In the following, configuration views and operations of a microburst detection apparatus 120, a packet extraction apparatus 130, a cause analysis apparatus 140, and a call information management apparatus which have been described in each embodiment will be briefly illustrated. Note that a reference sign of each apparatus (such as microburst detection apparatus 120) also represents the apparatus. In a configuration view, a modification in each embodiment is also included and an operation of the apparatus is described.
In
A packet reception unit 1901 receives a packet and outputs the received packet to a packet identification unit 1902. When the packet input from the packet reception unit 1901 is a packet of a message type stored in the message type storage unit 1906, the packet identification unit 1902 counts the number of packets by a counter unit 1903 and extracts, based on an extraction method stored in the U-Plane call information extraction method storage unit 1909, information in the packet including the matching message type and stores the extracted information into the extraction information storage unit 1910. The counter unit 1903 clears a counter in a cycle stored in the count cycle storage unit 1907. Also, the packet identification unit 1902 outputs a packet to a packet transmission unit 1904. The packet transmission unit 1904 transmits the input packet to a communication apparatus (for example, S-GW 104 in a case of
The microburst detection unit 1911 refers to the counter unit 1903 and determines that a packet of a matching message type is a microburst when a counter value becomes equal to or greater than a microburst detection threshold stored in the microburst detection threshold storage unit 1908 within a cycle stored in the count cycle storage unit 1907.
In a case of a microburst, a U-Plane call information extraction processing unit 1912 refers to the U-Plane call information extraction method storage unit 1909 and instructs a call information correspondence table acquisition unit 1913 to acquire a call information correspondence table, when necessary (according to operation of the described embodiment). The call information correspondence table acquisition unit 1913 acquires the call information correspondence table and stores the acquired call information correspondence table into a call information correspondence table storage unit 1914.
A U-Plane call information extraction processing unit 1212 refers to the extraction information storage unit 1910 and the call information correspondence table storage unit 1914. Then, based on the extraction method stored in the U-Plane call information extraction method storage unit 1909, the U-Plane call information extraction processing unit 1212 sets the information stored in the extraction information storage unit 1910 as U-Plane call information or extracts U-Plane call information from the call information correspondence table stored in the call information correspondence table storage unit 1914 based on the information stored in the extraction information storage unit 1910, and outputs the U-Plane call information to a packet extraction instruction transmission unit 1915. The packet extraction instruction transmission unit 1915 transmits, to the packet extraction apparatus 130, a packet extraction instruction including U-Plane call information input from the U-Plane call information extraction processing unit 1912.
Note that in a case, such as the first embodiment, where a call information correspondence table is not necessary, the call information correspondence table acquisition unit 1913 and the call information correspondence table storage unit 1914 can be omitted.
In
A packet extraction instruction reception unit 2005 receives a packet extraction instruction from the microburst detection apparatus 120 and stores U-Plane call information included therein into a call information storage unit 2006. In response to the packet extraction instruction, the control unit 2007 controls a start delimiter packet transmission unit 2008 to transmit a start delimiter packet to the cause analysis apparatus 140 and instructs the packet identification unit 2003 to start packet extraction.
The packet identification unit 2003 transmits the U-Plane packet acquired from the packet reception unit 2001 to a communication apparatus (such as S-GW 104 in a case of
Note that in a case where a U-Plane packet to be extracted reaches the packet reception unit 2001 after the packet extraction instruction reception unit 2005 has received the packet extraction instruction (such as a case of first embodiment), the duplicated packet accumulation unit 2002 is omitted and the packet identification unit 2003 acquires the packet from the packet reception unit 2001.
In
In
In summary, the present embodiment described above is an LTE system including a microburst detection apparatus, a packet extraction apparatus, and a cause analysis apparatus, and each of the apparatuses operates in the following manner. The microburst detection apparatus detects a microburst of a control plane packet and extracts, from the control plane packet which forms the detected microburst, call information for identifying call of a data plane. The packet extraction apparatus extracts a data plane packet corresponding to the call information extracted by the microburst detection apparatus. The cause analysis apparatus analyzes a payload of an application layer of the data plane packet extracted by the packet extraction apparatus and specifies a service/application which causes microburst occurrence. Then, the cause analysis apparatus counts the number of data plane packets in response to the specified service/application and displays the counted number of packets associated with the specified service/application.
With such a configuration above, it is possible to extract and analyze a data plane packet corresponding to a microburst, and thus, it is possible to specify a cause of microburst occurrence.
Number | Date | Country | Kind |
---|---|---|---|
2013-154616 | Jul 2013 | JP | national |