Abstract:
A method, apparatus, and computer program product for detecting a connection configuration of a network system. An embodiment includes acquiring first and second network data flowing in the network system; determining whether the contents of the first network data are identical with those of the second network data, and whether a destination address of the first network data is identical with a source address of the second network data; and providing output indicating that a load balancing apparatus is set to have the source address of the second network data, and that a cluster node is set to have a destination address of the second network data, in response to a determination that there is a coincidence in the above-mentioned determining step. The embodiment makes it possible to grasp a logical connection relationship of a current network, without relying on memory of a system administrator.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application claims priority under 35 U.S.C. § 119 to Japanese Patent Application No. 2005-376551 filed Dec. 27, 2005, the entire text of which is specifically incorporated by reference herein.  
       BACKGROUND OF THE INVENTION  
       [0002]     The present invention relates to grasping, from network data, information on connection of nodes each of which is a component of a load balancing system configured with a redundant system.  
         [0003]     Recently, companies have been constructing many systems for their customers or internal use via the Internet or intranet in order to provide various services. In order to prevent damage due to a loss of business opportunity or suspension of business operation, these systems are generally load balancing systems, in which loads are balanced by each processing, and which are redundant. In particular, in Web systems used in mission-critical business operation, a load balancing apparatus is often used to configure a cluster for the purposes of achievement of high availability and high speed.  
         [0004]     In the field of system management or business management, system configuration information is used for analysis of impact of each system component upon a whole system or business. Although a system administrator should grasp the system configuration information, it is difficult to grasp the system configuration information with accuracy and in real time in some cases: where, as time goes by, the system administrator is changed, or the system administrator often comes to have a dim memory of the system configuration information; and where there are many system administrators, when a single company operates many systems for business or customers.  
         [0005]     Some of the load balancing systems adopt a MAC (Media Access Control) transfer mode, which involves using a virtual IP (Internet Protocol) address and a MAC address for transfer via a load balancing server, in order that users can unconsciously access the systems.  
         [0006]     The load balancing system based on the MAC transfer mode is configured of a load balancing server and one or more cluster nodes, which are installed in the same segment. The load balancing server receives a packet destined for a virtual IP address for use in a cluster, rewrites only Ethernet layer information, and forwards the packet to an Ethernet address (or a MAC address) of a cluster node by use of uniquely set ARP (Address Resolution Protocol table) information. On the other hand, the cluster node is set to receive the packet destined for the virtual IP address. The cluster node recognizes that the packet is received directly from a client, and sends back the packet directly to the client, without passing through the load balancing server.  
         [0007]     As a result of automatic detection of the load balancing system based on the MAC transfer mode, however, the load balancing system is recognized as one node having a virtual IP address, whereby it is made impossible to grasp the overall configuration of the load balancing system. In other words, network analysis of IP or higher layers leads to a recognition that packets with the identical contents are overlapping. Even if MAC address information in the packet is used for analysis, it is necessary to analyze by use of knowledge of a correspondence between, in a monitor segment, a physical network structure (a relationship between MAC and IP addresses) and a logical network structure. For example, when two transactions having the identical contents but different MAC addresses are observed, it is required to determine whether this overlap is caused by MAC transfer, or packets on different channels are monitored in an overlapping manner. Additionally, there may be a case of merely retransmitting between communication devices, and thereby it is difficult to determine.  
         [0008]     H. Kashima discloses a method for grasping a calling relationship by using transaction information in “Network-based Problem Determination for Distributed Computer Systems,” ICDE 2005. The method disclosed in non-patent document 1 finds the calling relationship, provided that there is a transaction having IP or higher layer information. The method is incapable of finding the system configuration formed of the load balancing system. The method is aimed at solely analysis by using the found configuration information.  
         [0009]     In a load balancing system, in order to grasp an overall redundant system for impact analysis, it is needed to acquire information on a connection relationship of load balancing servers and cluster nodes based on the MAC transfer mode.  
       BRIEF SUMMARY OF THE INVENTION  
       [0010]     In order to solve the foregoing problems, the present invention provides an apparatus for detecting a connection configuration of a network system including plural network devices. The apparatus includes: means for acquiring first and second network data flowing in the network system; means for determining whether the contents of the first network data are identical with those of the second network data, and whether a destination address of the first network data is identical with a source address of the second network data; and means for providing output indicating that a load balancing apparatus is set to have the source address of the second network data, and that a cluster node is set to have a destination address of the second network data, in response to a determination that there is a coincidence in the above-mentioned determining step. The apparatus makes it possible to grasp a logical connection relationship of a current network, without relying on memory of a system administrator. 
     
    
     BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS  
       [0011]      FIG. 1  shows an example of an environment of a network where a load balancing system detecting apparatus operates.  
         [0012]      FIG. 2  is a schematic diagram of a hardware configuration in which the load balancing system detecting apparatus operates.  
         [0013]      FIG. 3  is a schematic functional configuration diagram.  
         [0014]      FIG. 4  shows an example of network data (a packet).  
         [0015]      FIGS. 5A and 5B  show an example of changes in MAC and IP addresses, when network data are transferred.  
         [0016]      FIG. 6  shows an example of a table structure of a network data database.  
         [0017]      FIG. 7  is a flowchart illustrating a flow for detecting a component of a load balancing system.  
         [0018]      FIGS. 8A and 8B  show examples of network components found by the load balancing system detecting apparatus. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0019]     In the following, a description will be provided of the present invention through an embodiment of the present invention. However, the following embodiments do not restrict the invention in the scope of the invention and all combinations of features explained in the embodiment are not always essential to means of the invention for solving the problems.  
         [0020]     As will be appreciated by one skilled in the art, the present invention may be embodied as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, the present invention may take the form of a computer program product on a computer-usable storage medium having computer-usable program code embodied in the medium.  
         [0021]     Any suitable computer usable or computer readable medium may be utilized. The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, or a magnetic storage device.  
         [0022]     Computer program code for carrying out operations of the present invention may be written in an object oriented programming language such as Java, Smalltalk, C++ or the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user&#39;s computer, partly on the user&#39;s computer, as a stand-alone software package, partly on the user&#39;s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user&#39;s computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).  
         [0023]      FIG. 1  shows an example of an environment  100  of a network system in which plural network devices, and in which a load balancing system detecting apparatus operates. Although a network, as employed herein, is assumed to be configured of two network switches  110  and  120 , the network may be configured of one switch, or a load balancing system detecting apparatus  101  can support a network with three or more network switches. The load balancing system detecting apparatus  101  is connected to the network switches. By use of a mirroring function of the network switches, the load balancing system detecting apparatus  101  can acquire network data such as packets transmitted between the network switches  110  and  120 , and server devices  111  to  114  or  121  to  124 .  
         [0024]     Besides this, acquisition of network data may be configured to acquire the network data by directly monitoring network lines. The network switch  110  has connections to the load balancing server (balancing processing unit)  111 , the processing servers  112  to  114  and the like. Herein, the load balancing server  111  serves to transfer, to processing servers, network data forwarded to a virtual IP address. Likewise, the network switch  120  has connections to the load balancing server (balancing processing unit)  121 , the processing servers  122  to  124  and the like. The network switches  110  and  120  are connected directly or indirectly to each other. The network system may be connected to a client terminal  131  via a network such as the Internet  130 .  
         [0025]      FIG. 2  is a schematic diagram of a hardware configuration  200  in which the load balancing system detecting apparatus operates. A CPU  201 , a central processing unit, executes various programs under control of various operating systems. The CPU  201  is interconnected via a bus  202  with a memory  203 , a disk  204 , a display adapter  205 , a user interface  206  and a network interface  207 . The disk  204  contains software and an operating system which cause a computer for realizing the present invention to function, as well as programs and the like for implementing the present invention. These programs are loaded into a memory and executed by the CPU, as needed. The disk  204  also holds network data acquired from the network switches and the like, or in-process data and the like to obtain network configuration information.  
         [0026]     The CUP  201  is connected to a keyboard  209  and a mouse  210  via the user interface  206 , to a display device  208  via the display adapter  205 , and to a network  211  via the network interface  207 . The load balancing system detecting apparatus is operated by use of the keyboard  209  and the mouse  210 , and in-process or processed data is displayed on the display device  208 . The network interface  207  is connected to a network card or the like.  
         [0027]     The present invention may be carried out in a distributed environment via the network  211 . The CUP  201  is connected to a network switch  212  via the network interface  207 . Incidentally, the hardware configuration  200  is a mere example of one embodiment of a computer system, bus arrangement and network interconnection, and features of the present invention can be achieved in various system configurations such as a form having plural identical components or a form further distributed on the network.  
         [0028]      FIG. 3  is a schematic functional configuration diagram. A network data acquisition section uses the mirroring function of the network switches to acquire network data, and registers the network data in a network data database (DB)  302 . However, when network data, which has the identical contents, except an Ethernet header, with acquired network data, has been registered, a network data acquisition section  301  does not register the network data, but passes the data for subsequent processing to a network data determination section.  
         [0029]     A data management section  303  abandons network data registered in the network data database  302 , under time-out control, and thereby manage the network data. While, an enormous amount of network data flows in the network, network data transfer based on a MAC transfer mode takes place in a mere instant. Accordingly, it is made possible to find overlapping network data without holding network data for a long time. Thus, the data management section  303  deletes the network data after a certain period of time. The deletion of network data may be performed in response to a flag representing a completion of a transaction containing the network data. When network data with the identical contents, except the Ethernet header, has been already registered, a network data determination section  304  specifies a source MAC address from the Ethernet header, and determines the load balancing server and the cluster node from the contents of a destination MAC address. Details of processing will be described later. A network configuration output section  306  associates the load balancing server with the cluster node for each cluster, and outputs resultant data.  
         [0030]      FIG. 4  shows an example of network data (a packet). Reference numeral  401  denotes the Ethernet header. The Ethernet header  401  contains a destination MAC address  402 , a source MAC address  403 , a type  404 , and the like. An IP header  411  contains a source IP address  412  and a destination IP address  413 . A TCP (Transmission Control Protocol) header  421  contains a source port  422 , a destination port  423  and a sequence number  424 . When the load balancing server transfers network data, which are destined for a virtual IP address, to the cluster node by the MAC transfer mode, two network data with the precisely identical contents except the Ethernet header come to exist. Specifically, in one of the two network data, the destination MAC address is the load balancing server. Since this data is transferred by the load balancing server, in the other network data, the destination MAC address is to be the cluster node, and the source MAC address is to be the load balancing server.  
         [0031]      FIG. 5A  shows a simple example  500  for explaining changes in the MAC and IP addresses, when network data from a client terminal is transferred by the load balancing server using the MAC transfer mode and reaches the cluster node. A client terminal  501  has an IP address named IP_C 1 . A network switch  502  has MAC addresses named MAC_S 1  and MAC_D 1 , respectively. Reference numeral  503  denotes a cluster of computers including a load balancing server. The cluster  503  is assigned a virtual IP address IP_V. The cluster  503  includes a load balancing server  504  and a cluster node  505 . The load balancing server  504  is assigned an IP address named IP_D and a MAC address named MAC_D.  
         [0032]     The cluster node  505  is assigned an IP address named IP_N 1  and a MAC address named MAC_N 1 . A network switch  506  has a MAC address MAC_S 2 . The network switch  506  has a connection to a server  507 , which is assigned an IP address named IP_O and a MAC address named MAC_O. The server  507  is the server of the following stage, such as a database, which is managed in a different segment in order to enhance security. The network data (the packet) originating from the client terminal  501  flows along through paths  1  to  4  in the configuration of the example  500 .  
         [0033]      FIG. 5B  shows how the IP and MAC addresses of network data change. The IP address in the network data path  1  is identical with that in the path  2 , but the destination MAC address in the path  1  is identical with the source MAC address in the path  2 . This indicates that the load balancing server  504  performs the MAC transfer of the network data. The network data in the path  1  is identical with that in the path  2 , exclusive of the Ethernet header. Comparison of the network data in the paths  3  and  4  shows that the source and destination MAC addresses thereof do not coincide with each other at all. This indicates that the network data is transferred via the network switch. Likewise, the network data in the path  3  is identical with that in the path  4 , exclusive of the Ethernet header.  
         [0034]      FIG. 6  shows an example of a table structure  600  of the network data database. The network data table includes the following items: a source MAC address  601 , a destination MAC address  602 , a data hash value  603 , registering time  604  and network data  605 . The source MAC address  601  and the destination MAC address  602  are extracted from the Ethernet header of network data. The data hash value  603  is determined based on the network data except the Ethernet header by means of a hash function. The purpose of using the hash value is to reduce a processing time by comparing the hash values, because it takes time to compare all data in order to determine whether or not two network data are identical.  
         [0035]     The data hash value  603  can be replaced with anything, such as the sequence number of a TCP header, which is determined uniquely. The registering time  604  is used for deleting data. After one or more seconds since registering, for example, the data management section  303  shown in  FIG. 3  deletes a record, based on the data processing time of the registering time  604 . The network data  605  is network data registered as it is. Information, such as the IP address, a port number or the start and end of a transaction, is extracted from the network data  605 . However, if the IP address or port number is registered as a different item, it is not necessary to register the network data  605 .  
         [0036]      FIG. 7  shows a flow  700  for detecting a component of a load balancing system based on the MAC transfer mode. Processing starts at step  701 . Network data is acquired at step  702 . At step  703 , a determination is made as to whether network data identical with the acquired network data has been registered in a network data management database. Comparison by use of the data hash values speeds up the process of the determination. When it is determined that overlapping network data has not been registered (No) at step  703 , the processing returns to step  702 , where next data is then registered.  
         [0037]     On the other hand, when it is determined that overlapping network data has been registered (Yes) at step  703 , the processing goes to step  704 . At step  704 , a determination is made as to whether or not the destination MAN addresses of the overlapping network data coincide with each other. When it is determined that the destination MAN addresses coincide with each other, (Yes) at step  704 , the processing returns to step  702 , where next data is then registered. This is because the coincidence of the destination MAC addresses with each other leads to a determination that the network data is the retransferred one.  
         [0038]     On the other hand, when it is determined that the destination MAC addresses do not coincide with each other (No) at step  704 , the processing goes to step  705 . At step  705 , a determination is made as to whether or not a destination MAC address set and a source MAC address set coincide with each other. Herein, the reason for using the MAC address set is that the MAC addresses can be grasped as a set, since the load balancing server performs many MAC transfers even in a short time. Although a grasp of the MAC address set achieves higher accuracy, the MAC addresses are not necessarily limited to being grasped as the set. When it is determined that there is no coincidence (No) at step  705 , the processing goes to step  707 . At step  707 , the server located at the following stage across the network switch, such as the server  507  shown in  FIG. 5 , is specified based on the MAC address of the network switch. After that, the processing goes to step  709 .  
         [0039]     When it is determined that there is a coincidence (Yes) at step  705 , the processing goes to step  706 . At step  706 , the coinciding MAC address at step  705  is set to be the MAC address of the load balancing server. In addition, the destination MAC address of network data having, as the source MAC address, the MAC address of the load balancing server is set to be the MAC address of the cluster node. Then, the processing returns to step  702  to be repeated. At step  708 , the destination MAC address of the network data having, as the source MAC address, the MAC address of the above-mentioned load balancing server is set to be the MAC address of the cluster node. At step  709 , a determination is made as to whether or not the processing will be further repeated. When it is determined that the processing will be repeated (Yes) at step  709 , the processing returns to step  702 . When it is determined that the processing will not be repeated (No) at step  709 , the processing goes to step  710 , where the processing ends.  
         [0040]      FIGS. 8A and 8B  show examples of network components found by the load balancing system detecting apparatus.  FIG. 8A  shows that two clusters having virtual IP addresses V_IP 1  and V_IP 2 , respectively, are specified, and that moreover, ND_MAC 11  is connected to the server of the following stage via the network switch.  FIG. 8B  shows that clusters, although using an identical virtual IP address, are divided according to the port number.  
         [0041]     As described above, the load balancing system detecting apparatus according to the present invention, without relying on a system administrator, causes currently active system configuration information to be detected and acquired. Accordingly, it is made possible to grasp a relationship between a cluster and cluster nodes (servers) constituting the cluster, and to perform a business impact analysis and an impact analysis upon availability of IT systems.  
         [0042]     The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.  
         [0043]     The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.  
         [0044]     Having thus described the invention of the present application in detail and by reference to embodiments thereof, it will be apparent that modifications and variations are possible without departing from the scope of the invention defined in the appended claims.