Abstract:
A transmission device includes: one or more processors; and a memory configured to store a program which is executed by the one or more processors, wherein the one or more processors is configured to: measure a communication traffic amount on a line; calculate a degree of change in the communication traffic amount; compare the degree of change in the communication traffic amount with a threshold; and measure, in accordance with a comparison result, the communication traffic amount on the line in accordance with one of a first measurement cycle and a second measurement cycle that is shorter than the first measurement cycle.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2015-143927, filed on Jul. 21, 2015, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to a transmission device and a traffic amount measurement method. 
       BACKGROUND 
       [0003]    As the bandwidth of communication networks has become wider and components have been accommodated therein more closely, relay devices have been enabled to perform simultaneous communication with a number of terminal devices. 
         [0004]    International Publication Pamphlet No. WO2012/147909 discusses related technology. 
       SUMMARY 
       [0005]    According to an aspect of the embodiments, a transmission device includes: one or more processors; and a memory configured to store a program which is executed by the one or more processors, wherein the one or more processors is configured to: measure a communication traffic amount on a line; calculate a degree of change in the communication traffic amount; compare the degree of change in the communication traffic amount with a threshold; and measure, in accordance with a comparison result, the communication traffic amount on the line in accordance with one of a first measurement cycle and a second measurement cycle that is shorter than the first measurement cycle. 
         [0006]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0007]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0008]      FIG. 1  illustrates an example transmission system; 
           [0009]      FIG. 2  illustrates an example functional configuration of a monitoring unit; 
           [0010]      FIGS. 3A and 3B  each illustrate an example relationship between a communication traffic amount and time; 
           [0011]      FIG. 4  illustrates example processing operations of a CPU; 
           [0012]      FIG. 5  illustrates an example functional configuration of a monitoring unit; 
           [0013]      FIGS. 6A and 6B  each illustrate an example relationship between a communication traffic amount and time; and 
           [0014]      FIG. 7  illustrates example processing operations of a CPU. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0015]    A micro-bursting event in a communication network causes a packet loss, line quality deterioration, and the like because a large volume of communication is suddenly performed in a short time. Since micro-bursting occurs suddenly, it is difficult to identify micro-bursting and analyze the causes thereof. Accordingly, a method for detecting micro-bursting may be provided. 
         [0016]    For example, when an amount of communication traffic measured on a line exceeds a threshold for an abnormal traffic amount, marking may be performed, and the marking may be used to recognize a traffic amount abnormality, for example, a burst abnormality. 
         [0017]    For example, although the marking is performed when the communication traffic amount exceeds the threshold for an abnormal traffic amount, the state of the communication traffic amount before the measured traffic amount exceeds the threshold for an abnormal traffic amount may not be recognized. Since the state of the communication traffic amount before the measured traffic amount exceeds the threshold for an abnormal traffic amount, for example, the state of the communication traffic amount before the abnormality occurrence is not recognized, a causal event before the occurrence of the abnormal traffic amount, for example, a causal event before the micro-bursting occurrence may not be analyzed. 
         [0018]    The embodiments described below may be combined appropriately without causing inconsistency. 
         [0019]      FIG. 1  illustrates an example of a transmission system  1 . The transmission system  1  illustrated in  FIG. 1  includes a plurality of relays  2  and a network  3 . Each relay  2  is connected to the network  3  through a corresponding one of lines  4  and is, for example, a packet relay device that relays a packet through the line  4 . The relay  2  includes a switch (SW)  2 A and a router  2 B. The SW  2 A is a switch for, for example, Layer 2/Layer 3 (L2/L3). The SW  2 A includes a monitoring unit  10  that monitors the amount of traffic of packets flowing through the line  4 , for example, a communication traffic amount. The router  2 B is connected to the line  4  and is a routing switch that transfers a packet based on destination information in the packet. 
         [0020]      FIG. 2  illustrates an example functional configuration of a monitoring unit. The monitoring unit  10  illustrated in  FIG. 2  includes a network processor unit (NPU)  11 , a field programmable gate array (FPGA)  12 , a random access memory (RAM)  13 , and a central processor unit (CPU)  14 . The NPU  11  corresponds to a communication processor connected to the line  4  and measures a communication traffic amount in the line  4 . The NPU  11  measures the communication traffic amount (bps) in the line  4  in accordance with a predetermined measurement cycle, for example, in accordance with a one-millisecond (1-ms) cycle. 
         [0021]    The FPGA  12 , for example, connects the CPU  14  and the RAM  13 , the CPU  14  and the NPU  11 , and the NPU  11  and the RAM  13 . The FPGA  12  is a large scale integrated circuit (LSI) that executes various processes. The RAM  13  is a memory unit such as a double-data-rate 3 synchronous dynamic random access memory (DDR3 SDRAM) that stores various pieces of information. The CPU  14  performs overall control on the monitoring unit  10 . 
         [0022]    The RAM  13  stores various programs such as a traffic-amount measurement program. The RAM  13  includes a traffic-amount storage unit  21 , a threshold table  22 , and a log storage unit  23 . The traffic-amount storage unit  21  is an area for serially storing communication traffic amounts measured by the NPU  11 . The threshold table  22  is an area for storing, for example, a first threshold, a second threshold, and a third threshold. 
         [0023]    The log storage unit  23  is an area for storing logs that are each a communication history including results of communication traffic amount measurement performed in virtual local area network (VLAN) units by the NPU  11 , a time stamp, a VLAN identifier (ID), a flow ID, and the like. The CPU  14  reads out the traffic-amount measurement program stored in the RAM  13  and implements the functions of a calculation unit  31 , a first judgment unit  32 , a second judgment unit  33 , a third judgment unit  34 , and a controller  35  based on the read out traffic-amount measurement program. The NPU  11  implements the functions of a first measurement unit  36  and a second measurement unit  37  based on the traffic-amount measurement program. 
         [0024]    The first measurement unit  36  serially measures communication traffic amounts in the line  4 , for example, in accordance with the 1-ms measurement cycle and serially stores measurement results in the traffic-amount storage unit  21 . The calculation unit  31  calculates the degree of change in the communication traffic amounts stored in the traffic-amount storage unit  21 . The degree of change in the communication traffic amounts represents an amount of change in communication traffic amounts corresponding to 10 ms that are to be monitored among the communication traffic amounts stored in the traffic-amount storage unit  21 . The calculation unit  31  serially calculates the amounts of change in 10-ms communication traffic amounts, that is, every 10 ms, for example, in such a manner as to calculate an amount of change in traffic amounts in a period from 1 ms to 10 ms, an amount of change in communication traffic amounts in a period from 11 ms to 20 ms, and an amount of change in communication traffic amounts in a period from 21 ms to 30 ms. 
         [0025]    The second measurement unit  37  enables setting of two types of log acquisition modes such as a normal mode and a detail mode. During the normal mode, the second measurement unit  37  collects logs of, for example, a communication traffic amount, a time stamp, a VLAN ID, a flow ID, and the like that are measured in accordance with a one-second (1-s) measurement cycle in VLAN units and stores the collected logs in the log storage unit  23 . The time stamp represents the date and time of measurement of the communication traffic amount of a packet, and the VLAN ID and the flow ID are IDs for respectively identifying a user of the packet and the packet. 
         [0026]    During the detail mode, the second measurement unit  37  collects logs of, for example, a communication traffic amount, a time stamp, a VLAN ID, a flow ID, and the like that are measured in accordance with a 1-ms measurement cycle in VLAN units and stores the collected logs in the log storage unit  23 . For example, the number of logs collected in the detail mode is 1000 times the number of logs collected in the normal mode. 
         [0027]    The controller  35  sets the normal mode as the initial setting in the second measurement unit  37 . The first judgment unit  32  is, for example, a judgment unit that judges whether the degree of change in the communication traffic amounts exceeds the first threshold. The first threshold represents the degree of change in the communication traffic amounts for judging whether to set the detail mode in the second measurement unit  37 . 
         [0028]    If the degree of change in the communication traffic amounts exceeds the first threshold, the controller  35  sets the detail mode in the second measurement unit  37 . If the degree of change in the communication traffic amounts exceeds the first threshold, the controller  35  increments a count value by one. If the degree of change in the communication traffic amounts does not exceed the first threshold, the controller  35  sets the normal mode in the second measurement unit  37 . If the degree of change in the communication traffic amounts does not exceed the first threshold, the controller  35  resets the count value. 
         [0029]    The second judgment unit  33  judges whether the communication traffic amounts exceed the second threshold. The second threshold is an upper limit value of the communication traffic amounts and represents a communication traffic amount from which packet loss occurrence is assumable on the receiving side. If the communication traffic amounts do not exceed the second threshold, the third judgment unit  34  judges whether the count value exceeds the third threshold. The third threshold represents the number of times the degree of change in the communication traffic amounts is judged to exceed the first threshold (a count value). From the number of times, a drastic increase of the communication traffic amounts before the communication traffic amounts exceed the second threshold is predictable. If the third judgment unit  34  judges that the count value exceeds the third threshold, the controller  35  sets the detail mode in the second measurement unit  37 . If the third judgment unit  34  judges that the count value does not exceed the third threshold, the controller  35  sets the normal mode in the second measurement unit  37 . 
         [0030]      FIGS. 3A and 3B  each illustrate an example relationship between a communication traffic amount and time.  FIG. 3A  illustrates a communication traffic amount related to mode switching performed when the degree of change increases drastically. In  FIG. 3A , during the normal mode, if communication traffic amounts do not exceed the second threshold, but if the degree of change in the communication traffic amounts exceeds the first threshold, the detail mode is set in the second measurement unit  37 .  FIG. 3B  illustrates a communication traffic amount related to mode switching performed when the degree of change increases gradually. In  FIG. 3B , during the normal mode, if communication traffic amounts exceed the second threshold, but if the degree of change in the communication traffic amounts does not exceed the first threshold, the second measurement unit  37  is set in the normal mode. 
         [0031]      FIG. 4  illustrates example processing operations of a CPU.  FIG. 4  illustrates processing operations related to a first mode-switching process performed by the CPU  14  in the monitoring unit  10 . The first mode-switching process is a process in which the log acquisition mode is switched and set in the second measurement unit  37  based on the degree of change in communication traffic amounts. 
         [0032]    In  FIG. 4 , the controller  35  in the CPU  14  sets the normal mode as the initial setting in the second measurement unit  37  (operation S 11 ). The controller  35  judges whether the current time is a measurement time for the first measurement unit  36  (operation S 12 ). The measurement cycle of the measurement time for the first measurement unit  36  may be set to 1 ms. If the current time is the measurement time (“affirmative” in operation S 12 ), the first measurement unit  36  measures a communication traffic amount (operation S 13 ). The first measurement unit  36  stores the measured communication traffic amount in the traffic-amount storage unit  21 . 
         [0033]    The calculation unit  31  in the CPU  14  judges whether the first measurement unit  36  completes acquisition of the communication traffic amounts corresponding to a predetermined period of time (operation S 13 A). The communication traffic amounts corresponding to a predetermined period of time are equivalent to, for example, communication traffic amounts corresponding to 10 ms and thus ten units of a communication traffic amount. If the acquisition of the communication traffic amounts corresponding to the predetermined period of time is complete (“affirmative” in operation S 13 A), the calculation unit  31  calculates the degree of change in the communication traffic amounts based on the monitored communication traffic amounts corresponding to the predetermined period of time stored in the traffic-amount storage unit  21  (operation S 14 ). The first judgment unit  32  in the CPU  14  judges whether the degree of change in the communication traffic amounts exceeds the first threshold (operation S 15 ). If the degree of change in the monitored communication traffic amounts exceeds the first threshold (“affirmative” in operation S 15 ), the controller  35  judges that the possibility of micro-bursting occurrence is high and increments the count value by one (operation S 16 ). After incrementing the count value by one, the controller  35  sets the detail mode in the second measurement unit  37  (operation S 17 ). Since the current set mode is the detail mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-ms cycle. 
         [0034]    After the detail mode is set, the second judgment unit  33  in the CPU  14  judges whether the monitored communication traffic amounts exceed the second threshold (operation S 18 ). If the monitored communication traffic amounts exceed the second threshold (“affirmative” in operation S 18 ), the process proceeds to operation S 12  to cause the controller  35  to judge whether the current time is the measurement time. 
         [0035]    If the degree of change in the monitored communication traffic amounts does not exceed the first threshold (“negative” in operation S 15 ), the controller  35  judges that the possibility of micro-bursting occurrence is low and resets the count value (operation S 19 ). After resetting the count value, the controller  35  sets the normal mode in the second measurement unit  37  (operation S 20 ). The process proceeds to operation S 12  to cause the controller  35  to judge whether the current time is the measurement time. Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0036]    If the monitored communication traffic amounts do not exceed the second threshold (“negative” in operation S 18 ), the third judgment unit  34  in the CPU  14  judges whether the count value exceeds the third threshold (operation S 21 ). If the count value exceeds the third threshold (“affirmative” in operation S 21 ), the process proceeds to operation S 12  to cause the controller  35  to judge whether the current time is the measurement time. Since the current set mode is the detail mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-ms cycle. 
         [0037]    If the count value does not exceed the third threshold (“negative” in operation S 21 ), the controller  35  sets the normal mode in the second measurement unit  37  (operation S 22 ). The process proceeds to operation S 12  to cause the controller  35  to judge whether the current time is the measurement time. Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0038]    If the degree of change in the communication traffic amounts exceeds the first threshold, the CPU  14  that executes the first mode-switching process sets the detail mode in the second measurement unit  37 . Since the degree of change in the communication traffic amounts is high, the CPU  14  consequently judges that the possibility of micro-bursting occurrence is high and predicts micro-bursting occurrence. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14  recognizes in detail the logs of communication traffic amounts in VLAN units based on the logs collected in the detail mode and analyzes causal events occurring, for example, before and after the micro-bursting. 
         [0039]    If the degree of change in the communication traffic amounts does not exceed the first threshold, the CPU  14  sets the normal mode in the second measurement unit  37 . Since the degree of change in the communication traffic amounts is low, the CPU  14  consequently judges that the possibility of micro-bursting occurrence is low. The second measurement unit  37  collects the logs in the normal mode. The CPU  14  may roughly recognize the logs of communication traffic amounts in VLAN units based on the logs collected in the normal mode. Since the number of logs collected in the normal mode is reduced, the CPU  14  may save a memory resource of the log storage unit  23 . 
         [0040]    Further, if the degree of change in the communication traffic amounts does not exceed the first threshold, and if the communication traffic amounts exceed the second threshold, the CPU  14  sets the normal mode in the second measurement unit  37 . Even though the communication traffic amounts exceed the second threshold, the CPU  14  consequently collects the logs in the normal mode. Accordingly, this may avoid wasting a memory resource of the log storage unit  23 , the wasting being caused by the detail mode set when an increase of the communication traffic amount is not caused by micro-bursting. 
         [0041]    If the degree of change in the communication traffic amounts exceeds the first threshold, and if the communication traffic amounts exceed the second threshold, the CPU  14  sets the detail mode in the second measurement unit  37 . The CPU  14  consequently judges that the possibility of micro-bursting occurrence is high. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14  recognizes in detail the logs of communication traffic amounts in VLAN units based on the logs collected in the detail mode and may analyze causal events occurring, for example, before and after the micro-bursting. 
         [0042]    If the communication traffic amounts do not exceed the second threshold, but if the count value exceeds the third threshold, the CPU  14  sets the detail mode in the second measurement unit  37 . Even though the communication traffic amounts do not exceed the second threshold, the CPU  14  consequently judges that the possibility of micro-bursting occurrence is high. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14  recognizes in detail the logs of communication traffic amounts in VLAN units based on the logs collected in the detail mode and analyzes causal events occurring, for example, before and after the micro-bursting. 
         [0043]    If the communication traffic amounts do not exceed the second threshold, and if the count value does not exceed the third threshold, the CPU  14  sets the normal mode in the second measurement unit  37 . The CPU  14  consequently judges that the possibility of micro-bursting occurrence is low. The second measurement unit  37  collects the logs in the normal mode. Since the number of logs collected in the normal mode is reduced, the CPU  14  may save the memory resource of the log storage unit  23 . 
         [0044]    If the degree of change in the communication traffic amounts exceeds the first threshold, and if the count value exceeds the third threshold, the CPU  14  sets the detail mode in the second measurement unit  37 . Accordingly, the logs of events occurring before and after the micro-bursting occurrence are collected in detail, and the collected logs are stored in the log storage unit  23 . The CPU  14  consequently analyzes causal events occurring, for example, before and after the micro-bursting occurrence, in VLAN units based on the logs of events before and the after the micro-bursting occurrence. 
         [0045]    The CPU  14  calculates an amount of change in communication traffic amounts corresponding to the predetermined period of time measured by the first measurement unit  36  as the degree of change in the communication traffic amounts. Based on the degree of change in the communication traffic amounts, the CPU  14  consequently recognizes changes in groups of the communication traffic amounts corresponding to the predetermined period of time. 
         [0046]    The CPU  14  sets, as the count value, the number of times the degree of change in the communication traffic amounts exceeds the first threshold. If the count value exceeds the third threshold, the CPU  14  sets the detail mode in the second measurement unit  37 . The CPU  14  consequently predicts micro-bursting occurrence and sets the detail mode before the micro-bursting occurrence. 
         [0047]    The changing direction of the degree of change in the communication traffic amounts may be an increasing direction. For example, if the degree of change exceeds the first threshold, the detail mode is set. For example, the changing direction of the degree of change in the communication traffic amounts may also be a decreasing direction. If the degree of change exceeds the first threshold, the detail mode may be set. 
         [0048]      FIG. 5  illustrates an example functional configuration of a monitoring unit. Components that are substantially the same as or similar to those in the transmission system  1  illustrated in  FIG. 2  are denoted by the same reference numerals, and explanation of the same components and operations may be omitted. 
         [0049]    The difference between a monitoring unit  10 A illustrated in  FIG. 5  and the monitoring unit  10  illustrated in  FIG. 2  is as follows. Specifically, a first judgment unit  32 A identifies whether the changing direction of the degree of change in communication traffic amounts is the increasing direction or the decreasing direction. If the degree of change, in the communication traffic amount, as a matter of course in the increasing direction or in the decreasing direction exceeds the first threshold, the detail mode is set. 
         [0050]    The first judgment unit  32 A includes an identification unit  41  that identifies whether the changing direction of the degree of change in the communication traffic amounts is the increasing direction or the decreasing direction.  FIGS. 6A and 6B  each illustrate an example relationship between a communication traffic amount and time.  FIG. 6A  illustrates a communication traffic amount related to the degree of change in the increasing direction. If the identification unit  41  identifies the changing direction of the degree of change in the communication traffic amounts as the increasing direction as illustrated in  FIG. 6A , the first judgment unit  32 A judges whether the degree of change in the increasing direction exceeds the first threshold. If the degree of change in the increasing direction exceeds the first threshold, a controller  35 A sets the detail mode in the second measurement unit  37 . If the degree of change in the increasing direction does not exceed the first threshold, the controller  35 A sets the normal mode in the second measurement unit  37 . 
         [0051]      FIG. 6B  illustrates a communication traffic amount related to the degree of change in the decreasing direction. If the identification unit  41  identifies the changing direction of the degree of change in the communication traffic amounts as the decreasing direction as illustrated in  FIG. 6B , the first judgment unit  32 A judges whether the degree of change exceeds the first threshold. If the degree of change in the decreasing direction exceeds the first threshold, the controller  35 A sets the detail mode in the second measurement unit  37 . If the degree of change in the decreasing direction does not exceed the first threshold, the controller  35 A sets the normal mode in the second measurement unit  37 . 
         [0052]      FIG. 7  illustrates example processing operations of a CPU.  FIG. 7  illustrates processing operations of a CPU  14 A in the monitoring unit  10 A according to a second mode-switching process. The second mode-switching process is a process in which the log acquisition mode is switched and set in the second measurement unit  37  based on whether the changing direction of the degree of change in the communication traffic amounts is the increasing direction or the decreasing direction. 
         [0053]    In  FIG. 7 , the controller  35 A in the CPU  14 A sets the normal mode as the initial setting in the second measurement unit  37  (operation S 31 ). The controller  35 A judges whether the current time is a measurement time for the first measurement unit  36  (operation S 32 ). The measurement cycle of the measurement time for the first measurement unit  36  may be set to 1 ms. If the current time is the measurement time (“affirmative” in operation S 32 ), the first measurement unit  36  measures a communication traffic amount (operation S 33 ). The first measurement unit  36  stores the measured communication traffic amount in the traffic-amount storage unit  21 . 
         [0054]    The calculation unit  31  in the CPU  14 A judges whether the first measurement unit  36  completes acquisition of the communication traffic amounts corresponding to the predetermined period of time (operation S 33 A). The communication traffic amounts corresponding to a predetermined period of time are equivalent to, for example, communication traffic amounts corresponding to 10 ms and thus ten units of a communication traffic amount. If the acquisition of the communication traffic amounts corresponding to the predetermined period of time is complete (“affirmative” in operation S 33 A), the calculation unit  31  calculates the degree of change in the communication traffic amounts based on the monitored communication traffic amounts corresponding to the predetermined period of time stored in the traffic-amount storage unit  21  (operation S 34 ). The first judgment unit  32 A in the CPU  14 A judges whether the changing direction of the degree of change in the monitored communication traffic amounts is the increasing direction by using the identification unit  41  (operation S 35 ). 
         [0055]    If the changing direction of the degree of change in the monitored communication traffic amounts is the increasing direction (“affirmative” in operation S 35 ), the first judgment unit  32 A judges whether the degree of change, in the monitored communication traffic amounts, in the increasing direction exceeds the first threshold (operation S 36 ). If the degree of change in the increasing direction exceeds the first threshold (“affirmative” in operation S 36 ), the controller  35 A judges that the possibility of micro-bursting occurrence is high and increments the count value by one (operation S 37 ). After incrementing the count value by one, the controller  35 A sets the detail mode in the second measurement unit  37  (operation S 38 ). Since the current set mode is the detail mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-ms cycle. 
         [0056]    After the detail mode is set, the second judgment unit  33  in the CPU  14 A judges whether the monitored communication traffic amounts exceed the second threshold (operation S 39 ). If the monitored communication traffic amounts exceed the second threshold (“affirmative” in operation S 39 ), the process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. 
         [0057]    If the degree of change in the increasing direction does not exceed the first threshold (“negative” in operation S 36 ), the controller  35 A judges that the possibility of micro-bursting occurrence is low and resets the count value (operation S 40 ). After resetting the count value, the controller  35 A sets the normal mode in the second measurement unit  37  (operation S 41 ). The process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0058]    If the monitored communication traffic amounts do not exceed the second threshold (“negative” in operation S 39 ), the third judgment unit  34  in the CPU  14 A judges whether the count value exceeds the third threshold (operation S 42 ). If the count value exceeds the third threshold (“affirmative” in operation S 42 ), the process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. Since the current set mode is the detail mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-ms cycle. 
         [0059]    If the count value does not exceed the third threshold (“negative” in operation S 42 ), the controller  35 A sets the normal mode in the second measurement unit  37  (operation S 43 ). The process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0060]    If the changing direction of the degree of change in the monitored communication traffic amounts is not the increasing direction (“negative” in operation S 35 ), the first judgment unit  32 A judges whether the changing direction of the degree of change in the communication traffic amounts is the decreasing direction by using the identification unit  41  (operation S 44 ). If the changing direction of the degree of change in the communication traffic amounts is the decreasing direction (“affirmative” in operation S 44 ), the first judgment unit  32 A judges whether the degree of change, in the monitored communication traffic amount, in the decreasing direction exceeds the first threshold (operation S 45 ). 
         [0061]    If the degree of change, in the communication traffic amount, in the decreasing direction exceeds the first threshold (“affirmative” in operation S 45 ), the controller  35 A sets the detail mode in the second measurement unit  37  (operation S 46 ). The process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. Since the current set mode is the detail mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in the decreasing direction in accordance with the 1-ms cycle. 
         [0062]    If the degree of change, in the communication traffic amount, in the decreasing direction does not exceed the first threshold (“negative” in operation S 45 ), the controller  35 A sets the normal mode in the second measurement unit  37  (operation S 47 ). The process proceeds to operation S 32  to cause the controller  35 A to judge whether the current time is the measurement time. Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0063]    If the changing direction of the degree of change in the monitored communication traffic amounts is not the decreasing direction (“negative” in operation S 44 ), the first judgment unit  32 A sets the normal mode in the second measurement unit  37 . Accordingly, the process proceeds to operation S 47 . Since the current set mode is the normal mode, the second measurement unit  37  consequently collects the logs of communication traffic amounts in accordance with the 1-s cycle. 
         [0064]    If the degree of change, in the communication traffic amount, in the increasing direction exceeds the first threshold, the CPU  14 A that executes the second mode-switching process sets the detail mode in the second measurement unit  37 . Since the degree of change, in the communication traffic amount, in the increasing direction is high, the CPU  14 A consequently judges that the possibility of micro-bursting occurrence is high and predicts micro-bursting occurrence. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14 A recognizes in detail the logs of communication traffic amounts in the increasing direction in VLAN units based on the logs collected in the detail mode and analyzes causal events occurring, for example, before and after the micro-bursting. 
         [0065]    If the degree of change, in the communication traffic amount, in the decreasing direction exceeds the first threshold, the CPU  14 A sets the detail mode in the second measurement unit  37 . Since the degree of change, in the communication traffic amount, in the decreasing direction is high, the CPU  14 A consequently judges that the possibility of recovery after the micro-bursting occurrence is high. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14 A recognizes in detail the logs of the communication traffic amounts in the decreasing direction in VLAN units based on the logs collected in the detail mode and analyzes, for example, causal events of the recovery from the micro-bursting. 
         [0066]    If the degree of change, in the communication traffic amount, in the increasing direction does not exceed the first threshold, the CPU  14 A sets the normal mode in the second measurement unit  37 . Since the degree of change, in the communication traffic amount, in the increasing direction is low, the CPU  14 A consequently judges that the possibility of micro-bursting occurrence is low. The second measurement unit  37  collects the logs in the normal mode. The CPU  14 A roughly recognizes the logs of communication traffic amounts in the increasing direction in VLAN units based on the logs collected in the normal mode. Since the number of logs collected in the normal mode is reduced, the CPU  14 A may save the memory resource of the log storage unit  23 . 
         [0067]    If the degree of change, in the communication traffic amount, in the increasing direction exceeds the first threshold, and if the communication traffic amounts exceed the second threshold, the CPU  14 A sets the detail mode in the second measurement unit  37 . The CPU  14 A consequently judges that the possibility of micro-bursting occurrence is high. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14 A recognizes in detail the logs of the communication traffic amounts in the increasing direction in VLAN units based on the logs collected in the detail mode and analyzes causal events occurring, for example, before and after the micro-bursting occurrence. 
         [0068]    If the communication traffic amounts do not exceed the second threshold, but if the count value exceeds the third threshold, the CPU  14 A sets the detail mode in the second measurement unit  37 . Even though the communication traffic amounts do not exceed the second threshold, the CPU  14 A consequently judges that the possibility of micro-bursting occurrence is high. The second measurement unit  37  collects the logs in detail in the detail mode. The CPU  14 A recognizes in detail the logs of the communication traffic amounts in the increasing direction in VLAN units based on the logs collected in the detail mode and analyzes causal events occurring, for example, before and after the micro-bursting occurrence. 
         [0069]    If the communication traffic amounts do not exceed the second threshold, and if the count value does not exceed the third threshold, the CPU  14 A sets the normal mode in the second measurement unit  37 . The CPU  14 A consequently judges that the possibility of micro-bursting occurrence is low. The second measurement unit  37  collects the logs in the normal mode. Since the number of logs collected in the normal mode is reduced, the CPU  14 A may save the memory resource of the log storage unit  23 . 
         [0070]    If the degree of change, in the communication traffic amount, in the increasing direction exceeds the first threshold, the CPU  14 A sets the detail mode in the second measurement unit  37 . Consequently, if the degree of change in the increasing direction increases drastically, the second measurement unit  37  collects the logs in the detail mode. The CPU  14 A analyzes causal events before and after the micro-bursting occurrence based on the collected logs. 
         [0071]    If the degree of change, in the communication traffic amount, in the decreasing direction exceeds the first threshold, the CPU  14 A sets the detail mode in the second measurement unit  37 . Consequently, if the degree of change in the decreasing direction increases drastically, the second measurement unit  37  collects the log in the detail mode. The CPU  14 A analyzes causal events of the recovery from micro-bursting based on the collected logs. 
         [0072]    For example, the communication traffic amount is measured in VLAN units by the first measurement unit  36 . However, the units are not limited to the VLAN, and the communication traffic amount may be measured in flow units. The units may be changed appropriately. 
         [0073]    The first measurement unit  36  and the second measurement unit  37  may be run by the NPU  11 . The first measurement unit  36  and the second measurement unit  37  may also be run by the CPU  14  ( 14 A), the FPGA  12 , or other components. The configuration may be changed appropriately. 
         [0074]    The calculation unit  31 , the first judgment unit  32  ( 32 A), the second judgment unit  33 , the third judgment unit  34 , and the controller  35  ( 35 A) may be run by the CPU  14  ( 14 A) or may be run by the FPGA  12 , the NPU  11 , and other components in a distributed manner. 
         [0075]    If the degree of change in the communication traffic amounts exceeds the first threshold during the normal mode, the detail mode may be set in the second measurement unit  37 . If the degree of change in the communication traffic amounts does not exceed the first threshold during the detail mode, the normal mode may be set. 
         [0076]    The degree of change may be calculated as the degree of change in the communication traffic amounts in accordance with an amount of change in communication traffic amounts corresponding to a predetermined period of time. A graph illustrating temporal changes of a communication traffic amount may be produced in such a manner that the vertical axis and the horizontal axis respectively represent communication traffic amount and time. The inclination angle of the changes may be set as the degree of change. 
         [0077]    If the degree of change in the communication traffic amounts exceeds the first threshold, the detail mode is set in the second measurement unit  37 . However, instead of the first threshold, a start time and end time of the detail mode may be set by predetermined manipulation. In this case, when the current time reaches the start time, the controller  35  switches and sets the mode from the normal mode to the detail mode. When the current time reaches the end time, the controller  35  switches the mode from the detail mode and sets the normal mode. For example, transmission of daily operation data of branch offices of banks and other organizations to the main office or a data center is scheduled for a predetermined time depending on the branch offices, and a period of time in which a communication traffic amount increases may thus be set for the detail mode. Instead of the first threshold, a time or the like may be set. For example, start and end times for the detail mode may be set using a date or the like. 
         [0078]    If the degree of change in the communication traffic amounts exceeds the first threshold, the detail mode may be set in the second measurement unit  37 . If the communication traffic amounts exceed the second threshold, the detail mode may be set. If the communication traffic amounts do not exceed the second threshold, the mode may be switched and set to the normal mode. 
         [0079]    If the degree of change in the communication traffic amounts does not exceed the first threshold during the detail mode, the mode may be switched and set to the normal mode. If the communication traffic amounts do not exceed the second threshold during the detail mode, the mode may be switched and set to the normal mode. 
         [0080]    The first threshold, the second threshold, and the third threshold may be appropriately changed and set in accordance with, for example, predetermined manipulation or a communication load in the network. 
         [0081]    The first measurement unit  36  may measure the communication traffic amount in accordance with the 1-ms cycle, and the second measurement unit  37  may measure the communication traffic amount in the detail mode or the normal mode. For example, the first measurement unit  36  may perform a measurement operation of the second measurement unit  37 . 
         [0082]    In operation S 13 A or operation S 33 A, the calculation unit  31  judges whether the acquisition of the communication traffic amounts corresponding to the predetermined period of time (10 ms) is complete. If the acquisition of the communication traffic amounts is complete, the calculation unit  31  calculates the degree of change based on the communication traffic amounts corresponding to the predetermined period of time. For example, after the first measurement unit  36  completes acquisition of communication traffic amounts corresponding to, for example, 100 ms, the calculation unit  31  may divide the 100-ms communication traffic amounts into ten groups of communication traffic amounts and may calculate the degree of change in each 10-ms communication traffic amount resulting from the division into the ten groups of communication traffic amounts. In this case, the first judgment unit  32  serially judges whether the degree of change in each 10-ms communication traffic amount resulting from the division exceeds the first threshold. The third judgment unit  34  may also set the detail mode if the degrees of change in, for example, the seven groups of communication traffic amounts of the degrees of change in the 10-ms communication traffic amounts corresponding to 100 ms (ten groups of communication traffic amounts) each exceed the first threshold, and if, for example, the number of times (count value) the degree of change in the communication traffic amounts exceeds the first threshold exceeds the third threshold of 6. 
         [0083]    All or some of the components of the illustrated units may be functionally or physically distributed or integrated on any basis in accordance with a corresponding one of various loads or usages. 
         [0084]    All or any of the various processing functions implemented by the devices may be implemented by the central processing unit (CPU) (or a microcomputer such as a micro processing unit (MPU) or a micro controller unit (MCU)). All or any of the processing functions may be run by using a program executed for parsing by the CPU (or the microcomputer such as a MPU or a MCU) or by using hardware based on wired logic. 
         [0085]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.