JP5851251B2 - Communication packet storage device - Google Patents

Description

  The present invention relates to a communication packet storage device that acquires and stores data communicated via a data communication network, and reproduces a web page by reading the stored data.

  Conventionally, a technique for acquiring and storing a communication packet flowing through a communication network is known, and is called packet capture. By using packet capture, for example, communication packets flowing in a corporate LAN (Local Area Network) can be stored, and thereby, a web page viewed by a communication client (such as a personal computer) in the LAN can be managed by an administrator. Can be reproduced. The packet capture can be used, for example, for monitoring whether or not an employee is cheating using a personal computer.

  As an apparatus for performing packet capture, for example, an apparatus disclosed in Patent Document 1 below is known. In this device, communication packets flowing in the communication network are acquired and stored in the work memory, and these communication data are analyzed and stored in the analysis result database. The administrator reproduces the web page using the web browser of the management unit.

  In this type of conventional apparatus, an HTTP response including an HTML (HyperText Markup Language) file is extracted from communication packets stored in an analysis result database, and a web page is reproduced using the HTML file.

International Publication No. 2002/029579

  In recent years, there are many web pages that perform dynamic display using files such as XML (Extensible Markup Language) and JSON (JavaScript (registered trademark) Object Notation). Such a web page cannot be accurately reproduced by the conventional reproduction technique as described above.

  Generally, browsers such as personal computers check the validity of the cached data by inquiring to the web server the date and time of modification of the web page if there is cached data in the browser when browsing the web page. To do. If the cache data is found to be valid, the web page is displayed using the cache data without acquiring new data from the web server. When the browser uses cache data as website data, a communication packet corresponding to the website data is not stored in the work memory. In such a case, the conventional communication packet storage device cannot accurately reproduce the web page.

  Furthermore, in a conventional communication packet storage device, when a website is configured so that the display transitions within the same URL (Uniform Resource Locator) using an HTTP cookie (for example, a login screen, etc.), it is accurate. Reproduction could not be performed.

  An object of the present invention is to provide a communication packet storage device that can accurately reproduce a web page.

The communication packet storage device of the present invention includes a packet storage unit that captures and stores communication packets transmitted and received by a plurality of communication clients, reads the communication packets stored in the packet storage unit, and stores communication contents of the communication clients. A communication packet storage device comprising a website reproduction unit for generating website data for reproduction, wherein the website reproduction unit browses a website to be reproduced from a received reproduction request And extracting at least the IP address of the website, the URL of the website, the browsing time of the website , and the cookie information specified in advance for each URL, and acquiring website data corresponding to the reproduction request A packet communication unit to transmit and a reception from the packet communication unit A packet corresponding to the IP address and the URL and communicated within a predetermined time before and after the browsing time from the packet storage unit, and a packet for sending the communication packet specified by the search to the packet communication unit A search unit , and the packet search unit receives the packet communication unit received from the packet communication unit when the site display transitions within the same URL and the information stored in the cookie is different before and after the site display transition. The site display to be reproduced is specified using cookie information .

  In the communication packet storage device of the present invention, when it is determined that the cache data of the communication client has been used for browsing the website, the packet search unit displays the website of the URL with a communication time rather than the browsing time. Preferably, the website data corresponding to the reproduction request is generated using the newest website data among the website data of the old communication packet.

  In the communication packet storage device of the present invention, when the packet communication unit receives an HTTP request as the reproduction request, the packet communication unit is a proxy server that transmits the website data as an HTTP response corresponding to the HTTP request. desirable.

  According to the present invention, when data of a website to be reproduced is read from the packet storage unit, the website corresponds to the IP address of the communication client that has browsed the website to be reproduced and the URL of the website. Communication packets communicated within a predetermined time before and after the browsing time can be searched. Thereby, according to this invention, it becomes possible to reproduce a dynamic web page correctly.

  Further, in the present invention, when it is determined that the communication client cache data is used for browsing the website, the communication client uses the website data of the communication packet previously received by the communication client. It becomes possible to reproduce accurately.

  Furthermore, in the present invention, by performing a search using cookie information in addition to the IP address, URL, and browsing time included in the reproduction request, the website display that transitions within the same URL is accurately reproduced. It becomes possible.

  In addition, in the present invention, by configuring the packet communication unit as a proxy server, it is easy for the administrator to browse the reproduction website, and the configuration of the website reproduction unit can be simplified.

It is a conceptual diagram which shows the structural example of the communication network to which the communication packet storage apparatus which concerns on Embodiment 1 is connected. 2 is a block diagram schematically showing a functional configuration of a communication packet storage device according to Embodiment 1. FIG.

  Embodiment 1 of the Invention

  A communication packet storage device according to Embodiment 1 of the present invention will be described with reference to FIG. 1 and FIG.

  FIG. 1 is a conceptual diagram showing a configuration example of a communication network 100 to which a communication packet storage device according to the first embodiment is connected.

  As shown in FIG. 1, in the communication network 100, a LAN (Local Area Network) 120, a web server 130, and the like are connected to the Internet 110.

  The LAN 120 includes a plurality of terminal computers 121-1 to 121-n as communication clients.

  The terminal computers 121-1 to 121-n are communicatively connected to each other via the switching hub 123. These terminal computers 121-1 to 121-n are connected to the Internet 110 via the switching hub 123, firewall 124, and router 125. As a result, the terminal computers 121-1 to 121-n can access the web server 130 and the like via the Internet 110.

  Since the switching hub 123, the firewall 124, and the router 125 can use the same thing as the past, description is abbreviate | omitted.

  In the present embodiment, a communication packet storage device 140 is connected between the switching hub 123 and the firewall 124. However, the communication packet storage device 140 can be connected to another position in the LAN 120.

  FIG. 2 is a functional block diagram showing an example of the internal structure of the communication packet storage device 140.

  As shown in FIG. 2, the communication packet storage device 140 according to the first embodiment includes a packet storage unit 210 and a website reproduction unit 220.

  When the terminal computers 121-1 to 121-n communicate with a server (for example, the web server 130) on the Internet 130, the packet storage unit 210 captures a communication packet (that is, traffic) related to this communication, A copy of the communication packet is stored. A well-known technique can be used as a technique for capturing a communication packet (see, for example, Patent Document 1 above). In the first embodiment, a normal IP packet is used as a communication packet. The IP packet includes the source and destination IP addresses and communication time information (time stamp information), and further includes an HTTP request or an HTTP response. The HTTP request is a request for transmitting web page data to the web server 130 or the like, and includes information for specifying a URL. The HTTP response is information for responding to the HTTP request, and includes web page data and the like.

  The website reproduction unit 220 reproduces a website or the like browsed by the terminal computers 121-1 to 121-n using the communication packet stored in the packet storage unit 210. For this purpose, the website reproduction unit 220 includes a proxy server 221, a packet search unit 222, and a management computer 223.

  The proxy server 221 corresponds to the packet communication unit of the present invention, and includes a reproduction request including the IP address of the terminal computer that browsed the website to be reproduced, the URL of the website, the browsing time of the website, cookie information, and the like. Is sent from the management computer 223 to the packet search unit 222. The proxy server 221 receives a communication packet storing website data corresponding to the reproduction request from the packet search unit 222 and transmits the communication packet to the management computer 223. In the first embodiment, since the proxy server is used as the packet communication unit of the present invention, the communication packet received from the packet search unit 222 can be provided to the management computer 223 with a simple configuration. Further, by using a proxy server as the packet communication unit, the management computer 223 can browse the reproduced website as it is using the same browser as the terminal computers 121-1 to 121-n. Become.

  The packet search unit 222 receives the IP address, URL, browsing time, cookie information, and the like included in the above-described reproduction request from the proxy server 221. The packet search unit 222 stores, in the packet storage unit 210, communication packets corresponding to the IP address and URL and communicated within a predetermined time before and after the browsing time (for example, 1 hour before and after several hours before and after). The retrieved communication packet is searched as described later. The retrieved communication packet is transmitted to the proxy server 221.

  The management computer 223 is operated by an administrator and reproduces web data browsed by the terminal computers 121-1 to 121-n. As the management computer 223, for example, a normal personal computer can be used. In the first embodiment, since the proxy server 221 is used as the packet communication unit, the reproduction website can be browsed only by setting the connection destination of the browser installed in the management computer 223 to the proxy server 221. Can do. In the first embodiment, the management computer 223 is provided in the website reproduction unit 220. However, any one or more of the terminal computers 121-1 to 121-n can be used as the management computer. It is. In the first embodiment, only the management computer 223 can browse the reproduction website. For example, the terminal computers 121-1 to 121-n may be permitted to browse the reproduction website.

  Hereinafter, the operation of the communication packet storage device 140 will be described.

  First, the operation of the packet storage unit 210 will be described. The operation of the packet storage unit 210 is the same as that of the conventional packet capture device.

  First, when the operator operates any of the terminal computers 121-1 to 121-n to browse the website of the web server 130, an HTTP request is generated by the terminal computer. This HTTP request includes information for specifying the URL of the website to be browsed. This HTTP request is stored in a communication packet together with information such as communication time information, a source IP address (IP address of the terminal computer), a destination IP address (IP address of the web server 130), and the like. Sent to. The communication packet is copied when passing through the communication packet storage device 140 and stored in the packet storage unit 210.

  Upon receiving this communication packet, the web server 130 generates an HTTP response including web data corresponding to the URL. The web server 130 stores this HTTP response in a communication packet together with information such as communication time information, a transmission source IP address (IP address of the web server 130), a transmission destination IP address (IP address of the terminal computer), and the like. Then, the data is transmitted to the corresponding terminal computer. This communication packet is also copied when passing through the communication packet storage device 140 and stored in the packet storage unit 210.

  Next, the operation of the website reproduction unit 220 will be described.

  First, the administrator operates the management computer 223 to specify browsing contents to be reproduced from the access history for each IP address used by the terminal computers 121-1 to 121-n.

  The management computer 223 generates a reproduction request based on this identification result. This reproduction request includes the IP address of the terminal computer that browsed the website to be reproduced, the URL of the website, the browsing time of the website, cookie information, and the like. This reproduction request can be generated as an HTTP request of the HTTP protocol. Then, the management computer 223 stores this reproduction request in a communication packet and transmits it to the proxy server 221.

  The proxy server 221 receives this reproduction request from the management computer 223, and extracts the above-described IP address, URL, browsing time, cookie information, and the like. Then, these pieces of information are transmitted to the packet search unit 222.

When the packet search unit 222 receives the IP address, URL, browsing time, cookie information, and the like from the proxy server 221, the packet search unit 222 performs the following processing.
(1) HTTP response search processing with matching URL

  First, from the HTTP request of the communication packet stored in the packet storage unit 210, the packet search unit 222 matches the source IP address with the IP address to be reproduced, the URL specifying information matches the URL to be reproduced, In addition, a search is made for a transmission time within a predetermined time before and after the browsing time to be reproduced (for example, 1 hour before and after and several hours before and after).

  Further, a search process using information in the HTTP cookie is performed on the search result. Some websites are configured such that the display transitions within the same URL. For example, the login screen of the member site generally has the same URL in the screen before login and the screen after login. Normally, in such a login screen, the information stored in the HTTP cookie is different before and after login. Therefore, by performing a search using information in the HTTP cookie in addition to the URL, such a website display can be accurately reproduced.

  Of the information contained in the HTTP cookie, the information that can be used for the search is different for each website. For this reason, it is desirable to collect information about HTTP cookies in advance and to specify the HTTP cookie information to be used for each URL. Information regarding HTTP cookies may be collected artificially or automatically using a crawler or the like. In the first embodiment, setting information for determining whether or not to use an HTTP cookie and the contents of HTTP cookie information to be used are registered in advance in the proxy server 221 for each URL. Then, in accordance with this registration information, the HTTP cookie information stored in the reproduction request is read out, sent to the packet search unit 222, and used for search processing.

  When there are a plurality of HTTP requests that match such a search, the following selection process is further performed to select one HTTP request.

  First, the packet search unit 222 extracts a corresponding HTTP response from the packet storage unit 210 for each HTTP request that matches the search condition. Then, an HTTP status code is read from the extracted HTTP response. Then, an HTTP response having the smallest HTTP status code is specified, and an HTTP request corresponding to the HTTP response is set as a selection result (first selection step).

  When a plurality of HTTP responses are selected in the first selection step, the HTTP response corresponding to the HTTP response is selected as a selection result by specifying the HTTP response communication time closest to the reproduction request browsing time. (Second sorting step).

  When a plurality of HTTP requests are selected in the second selection step, the HTTP requests are selected by a desired procedure or arbitrarily (third selection step).

  When one HTTP request is specified in this way, the packet search unit 222 next specifies one or a plurality of HTTP responses corresponding to the specified HTTP request.

On the other hand, if there is no HTTP response that matches such a search process, the packet search unit 222 transmits information indicating that fact to the proxy server 221. The proxy server 221 transmits the HTTP status code “404 Not Found” to the management computer 223.
(2) Browser cache emulation processing

  Next, the packet search unit 222 checks the HTTP status code of the HTTP response specified by the search process described above. When the HTTP status code is “304 Not Modified”, the packet search unit 222 uses the browser cache to display the website data (that is, the website data is acquired from the web server 130). Judgment) Then, the packet search unit 222 extracts an HTTP response that satisfies both of the following two conditions from the packet storage unit 210.

  Condition 1: The URL corresponding to the HTTP response matches the URL of the reproduction request.

  Condition 2: The communication time of the HTTP response is the newest among those within a predetermined time (for example, within 14 days) before the reproduction request viewing time.

  For example, by sequentially checking HTTP requests that meet the condition 1 and whose communication time is earlier than the reproduction request viewing time, the HTTP responses that meet these conditions 1 and 2 are efficiently extracted. can do.

  If an HTTP response that satisfies the conditions 1 and 2 can be extracted, the extracted HTTP response is replaced with an HTTP response with an HTTP status code of “304 Not Modified” and sent to the proxy server 221.

  On the other hand, if an HTTP response matching the conditions 1 and 2 cannot be extracted, an HTTP response with an HTTP status code of “304 Not Modified” is sent to the proxy server 221 as it is.

  When the fixed IP addresses are used for the terminal computers 121-1 to 121-n, in addition to the conditions 1 and 2, the HTTP response with the HTTP status code “304 Not Modified” matches the IP address. This may be added to the conditions.

  As described above, the packet search unit 222 specifies and acquires the HTTP response corresponding to the reproduction website from the packet storage unit 210. Then, the packet search unit 222 transmits the acquired HTTP response to the proxy server 221.

  The proxy server 221 extracts website data from the received HTTP response, and creates response information for the above-described reproduction request. This response information is created as an HTTP response for responding to an HTTP request as a reproduction request. This response information (HTTP response) is stored in a communication packet and transmitted to the management computer 223.

  The management computer 223 receives the response information and sequentially displays the response information on the browser, thereby reproducing the website.

  As described above, according to the first embodiment, when the data of the website to be reproduced is read from the packet storage unit 210, the IP address of the terminal computer that browsed the website to be reproduced and the web Since a communication packet corresponding to the URL of the site and communicated within a predetermined time before and after the browsing time of the website is searched, even a dynamic web page can be accurately reproduced.

  In the first embodiment, if the HTTP status code of the HTTP response specified by the search is “304 Not Modified”, it is determined that the cache data of the terminal computer has been used for browsing the website. Then, since the terminal computer specifies the website data used as the browser cache from the website data of the communication packet communicated before that, the website can be accurately reproduced.

  Further, in the first embodiment, in addition to the IP address, URL, and browsing time included in the reproduction request, a search using cookie information is performed to accurately display a website display that transits within the same URL. It becomes possible to reproduce.

  In addition, in the first embodiment, since the proxy server 221 is used as the packet communication unit, it is easy for the administrator to browse the reproduction website, and the configuration of the website reproduction unit can be simplified.

100 communication network 110 internet 120 LAN
121-1 to 121-n Terminal computer 123 Switching hub 124 Firewall 125 Router 130 Web server 140 Communication packet storage device 210 Packet storage unit 220 Website reproduction unit 221 Proxy server 222 Packet search unit 223 Management computer

Claims (3)

A packet storage unit that captures and stores communication packets transmitted and received by a plurality of communication clients, and generates website data for reproducing the communication contents of the communication client by reading the communication packets stored in the packet storage unit A communication packet storage device comprising a website reproduction unit for
The website reproduction unit
From the received reproduction request, the IP address of the communication client that browsed the website to be reproduced, the URL of the website, the browsing time of the website , and the cookie information designated in advance for each URL A packet communication unit for extracting and transmitting website data corresponding to the reproduction request,
The packet storage unit is searched for a communication packet corresponding to the IP address and the URL received from the packet communication unit and communicated within a predetermined time before and after the browsing time, and the communication packet specified by the search is A packet search unit to be sent to the packet communication unit;
Equipped with a,
The packet search unit uses the cookie information received from the packet communication unit when the site display changes within the same URL and the information stored in the cookie before and after the site display transition is different. A communication packet storage device characterized by specifying the site display to be reproduced .   When it is determined that the cache data of the communication client has been used for browsing the website, the packet search unit selects the website data of the communication packet whose communication time is older than the browsing time. The communication packet storage device according to claim 1, wherein the website data corresponding to the reproduction request is generated using the newest website data. 3. The proxy server that transmits the website data as an HTTP response corresponding to the HTTP request when the packet communication unit receives an HTTP request as the reproduction request. The communication packet storage device described.

Images