JP2002064507A - Network system and network monitoring method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network monitoring system that stops update of data depending on captured data. SOLUTION: An error detection section 23 of a computer 2 detecting an error outputs a packet addressed to a specific IP address. An LAN analyzer 1 is provided with a data capture section 121 that captures packets on a network and a packet storage section 122 that stores packets. A data discrimination section 14 discriminates whether or not the packet captured by the data capture section 121 is the packet addressed to the specific IP address, and a data acquisition control section 16 controls succeeding packets captured so as not to be overwritten on the packets stored in the data storage section 122 when the packet captured by the data capture section 121 is the packet addressed to the specific IP address.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a network monitoring technique, and more particularly to a technique for controlling the capture of packets from a network.

[0002]

2. Description of the Related Art In order to analyze the cause of a network trouble, a LAN analyzer that captures packets on a network and holds the captured packets is widely used. Since the storage area for holding the packet has a limited capacity, it is used cyclically.
Therefore, after a certain period of time, even the captured packet is overwritten and disappears.

In a conventional LAN analyzer, for example, if a network adopts TCP / IP as a protocol, a protocol error in a physical layer, a data link layer, a network layer, a transport layer, and a session layer is detected. can do. When this error is detected, there is a stop trigger function that stops data acquisition and prevents data stored in the storage area at that time from being lost.

[0004]

However, even if there is a cause in the communication process, if an error occurs in data in the application layer or the like, the LAN analyzer cannot recognize the error. Therefore, it is impossible to detect an error in the application layer or the like and apply a stop trigger. So, in this case,
There is a problem that the data in the storage area at the time of occurrence of the error cannot be kept.

An object of the present invention is to provide a network monitoring technique which focuses on such a conventional problem and stops updating of data in accordance with fetched data.

[0006]

In order to achieve the above object, the present invention performs the following processing. That is, when the occurrence of a predetermined event is detected, and when the occurrence of the event is detected, a specific packet is output to the network. A packet on the network is fetched, and it is determined whether the fetched packet is a specific packet. If it is determined that the captured packet is not a specific packet, the captured packet is held. As a result of the determination, if the fetched packet is a specific packet, the packet subsequent to that packet is not held.

[0007]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is an overall configuration diagram of a network system to which the first embodiment is applied. That is, LAN analyzers 1a and 1b which are network monitoring devices
And computers 2a and 2b and test computers 3a and 3b are LAN (Local Area Network) 8a,
8b. LAN 8 of the same configuration
a and 8b are connected by a WAN (Wide Area Network) 9. This network system uses TCP / IP as a communication protocol. However, the communication protocol is not limited to TCP / IP. For example, another communication protocol may be used, or an IP (Internet Protocol) and a higher-level protocol other than the TCP (Transmission Control Protocol) may be combined.

In this embodiment, the computers 2a, 2a
b detects the occurrence of a predetermined event and converts it into an event that can be detected by the LAN analyzers 1a and 1b. Specifically, when the computers 2a and 2b detect an error or the like in the application layer, a ping command of a ping command for a logically non-existent IP address (a newly assigned IP address) is detected for all computers on the network. Converted to the issue of issuance.

[0010] The LAN analyzer 1 is installed when a network trouble occurs or the like, and captures and holds packets on the LAN 8. The network maintainer is LA
The packet held in the N analyzer is analyzed to help determine the cause of the trouble. The detailed configuration of the LAN analyzer 1 will be described with reference to FIG.

As shown in FIG. 4A, the LAN analyzer 1 includes an input device 101 such as a keyboard, a CRT,
A display device 102 such as a liquid crystal display is connected. The LAN analyzer 1 includes a data acquisition unit 12 and an IP
An address storage unit 13, a data determination unit 14, a data acquisition control unit 16, and a display control unit 18 are provided as internal functions. These internal functions are realized by the processor reading a predetermined program and executing it.

The data acquisition unit 12 includes a data acquisition unit 121
And a data holding unit 122. Data acquisition unit 121
Captures packets on the LAN. The fetched packet is temporarily stored in a buffer (not shown).

The data holding unit 122 includes the data acquisition unit 12
1 holds the captured packet. Data holding unit 12
2 is composed of, for example, a cyclic buffer having a certain capacity. In other words, for example, a packet having a capacity of about 100 megabytes is sequentially stored, and when data is stored in all areas, the oldest data is overwritten and stored.

The IP address storage section 13 has an area for storing an IP address 80 set in the test computer 3 connected to the same LAN 8 as the LAN analyzer 1. For example, the IP address 80c (***. ***. 34.56) of the test computer 3a is stored in the IP address storage unit 13 of the LAN analyzer 1a.

The data discriminating section 14 discriminates whether or not the packet captured by the data capturing section 12 is a specific packet. For example, the IP address of the destination of the captured packet
The IP address whose address is stored in the IP address storage unit 13
It is determined whether the address matches the P address. Specifically, in the LAN analyzer 1a, the destination IP address of the captured packet is set to the IP address 80c (***. ***.
34.56). More preferably, it may also be determined whether the captured packet is a Ping command.

If the result of the determination is that the packet is a specific packet, the fact is notified to the data acquisition control unit 16. If it is not a specific packet, the data acquisition unit 121
An instruction is given to write a packet stored in a buffer (not shown) to the data holding unit 122.

The data acquisition control unit 16 includes the data acquisition unit 1
2 controls data acquisition. For example, upon receiving a notification from the data determination unit 14, the data acquisition unit 12
Instructs not to keep packets after a particular packet. Preferably, LA after the specific packet
The packet transmitted on N may be restricted so that the data capturing unit 121 does not capture it. Alternatively, a packet transmitted on the LAN after the specific packet and captured by the data capturing unit 121 may not be written from a buffer (not shown) to the data holding unit 122.

In this way, after receiving a specific packet, the storage contents of the data holding unit 122 are updated, and
It is possible to avoid being rewritten. As a result, the packet existing on the network immediately before receiving the specific packet can be maintained without being overwritten.

The input / output controller 18 controls the input device 101 and the display device 102. For example, the input device 10
1 and causes the display device 102 to display the data held in the data holding unit 122.

The computers 2a and 2b are assigned IP addresses 80a and 80b, respectively, and communicate with each other to execute a predetermined application. The detailed configuration of the computer 2 is shown in FIG.
This will be described with reference to FIG. As shown in FIG. 4B, the computer 2 includes a communication control unit 21 and one or more data processing units 2.
2, an error detection unit 23 for detecting occurrence of an error in the data processing unit 22, and an IP address storage unit 24 as its internal functions. These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control unit 21 controls communication with other devices on the network. For example, a packet on the LAN 8 is acquired, and a packet addressed to the own computer 2 is accepted. In addition, a packet is generated and transmitted to the LAN 8 for transmission to another device on the network.

The data processing section 22 performs a predetermined application process defined by the user based on the information indicated by the packet received by the communication control section 21.

The error detecting section 23 monitors whether or not a predetermined event has occurred in the data processing section 22, and detects the occurrence of the event as an error. The event to be detected by the error detection unit 23 can be arbitrarily designated by the user. For example, data processing unit 2
2, an abnormal termination of the process, a communication failure such as a timeout in a communication process with another device, an error in an upper layer of the protocol, or the like may be detected. More preferably, a minor defect such as a so-called warning may be detected as an error.

Further, when the error detecting section 23 detects an error, the error detecting section 23 stores the IP address stored in the IP address storing section 24.
The device at the P address is notified of the error detection. For example, it instructs the communication control unit 21 to issue a Ping command to the IP address stored in the IP address storage unit 24.

The IP address storage unit 24 stores an IP address 80 set in the test computer 3 connected to the same LAN 8 as the LAN analyzer 1 and a WA.
IP address 80 set on the test computer 3 connected to another LAN 8 connected via N9
Is stored. For example, the IP addresses 80c (***. ***. 34.56) and 80d (***. ***. 12.78) of the test computers 3a and 3b are stored in the IP address storage units 24 of the computers 2a and 2b. ) Is stored.

The test computers 3a and 3b are computers installed for analyzing network troubles. Therefore, it is not necessary to install the device at normal times. IP addresses 80c and 80d are assigned to the test computers 3a and 3b, respectively. The test computer 3 may be any device as long as it can assign an IP address and connect to the LAN 8.

The processing procedure in this embodiment will be described with reference to FIG.

FIG. 7 shows a processing procedure of the LAN analyzer 1a. The LAN analyzer 1b is the same except that the LAN 8a and the LAN 8b are different.

Upon receiving a predetermined instruction from the input device 101,
The data acquisition 121 starts data acquisition (S1).
01). The captured packet is the test computer 3
It is determined whether or not it is addressed to a (S102).
If the packet is not addressed to the test computer 3a, the packet is written and held in the data holding unit 122 (S
103). Thereafter, the process returns to S101 to repeat the processing.
This includes communication between the computers 2a and 2b,
Packets on the LAN 8a are held.

At this time, for example, it is assumed that an error has occurred in the data processing unit 22 of the computer 2b. Then, the error detection unit 23 of the computer 2b detects an error. Then, a Ping command is issued from the computer 2b to the test computers 3a and 3b.

When the LAN analyzer 1a captures a packet addressed to the test computer 3a (S101, S101
102), the data acquisition control unit 16 inhibits acquisition of a packet transmitted on the LAN 8a after the packet (S104). Thereby, the data holding unit 122
Is not updated. That is, when the packet addressed to the test computer 3a is obtained, the packet stored in the data holding unit 122 is held as it is.

Next, FIG. 2 shows an overall configuration diagram of a network system to which the second embodiment of the present invention is applied.
That is, a LAN analyzer 1, which is a network monitoring device, a computer 2, and a test computer 3
And are connected to the LAN 8. Monitoring computer 5
Are connected to the LAN 8b, and the LANs 8a and b are connected to the WAN 9. In the following embodiments, the first
The same components as those of the embodiment are denoted by the same reference numerals, and description thereof may be omitted.

The LAN analyzer 1 used in this embodiment,
The configurations of the computer 2 and the test computer 3 are the same as in the first embodiment.

The monitoring computer 5 monitors the status of the computer 2. As shown in FIG. 5, the configuration of the monitoring computer 5 includes a communication control unit 51, a monitoring control unit 52,
An address storage unit 53 is provided as an internal function.
These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control unit 51 controls communication with other devices on the network. For example, a packet on the LAN 8 is acquired, and a packet addressed to the self-monitoring computer 5 is accepted. In addition, a packet is generated and transmitted to the LAN 8 for transmission to another device on the network.

The monitoring control unit 52 monitors the operation state of the computer 2. For example, a message is periodically output to the computer 2 to check whether there is a response. If there is no response, the computer 2 is regarded as having some abnormality, and the test computer 3 is notified of that. Specifically, the P to the computer 2 is periodically
It instructs the communication control unit 51 to output the ing command. A response to the ping is received via the communication control unit 51. If there is no response within a predetermined time, the communication control unit 51 is instructed to output a Ping command to the test computer 3.

The IP address storage unit 53 has at least
The computer 21 and the IP addresses 80a and 80c set in the test computer 3 are stored.

The processing procedure of the monitoring computer 5 in this embodiment will be described. The processing procedure of the LAN analyzer 1 is the same as that of FIG.

The computer 2 performs predetermined processing while communicating with other devices (not shown). At this time, the monitoring computer 5 periodically sends a Ping command to the computer 2 and confirms the response (S201, S202). When an abnormality is detected, such as when there is no response within a predetermined time, the monitoring computer 5 issues a Ping to the test computer 3 (S203).

The Pin addressed to the test computer 3
The LAN analyzer 1 receiving g operates according to the flow of FIG.

In the first embodiment, the computer 2 detects an error by itself and detects a Pin to the test computer 3.
g issued. For this reason, when the computer 2 hangs up or down and cannot issue a Ping by itself, an error cannot be detected. However, in the present embodiment, an error can be detected even in such a case.

Further, in the first embodiment, it is necessary to provide the error detection unit 23 inside the computer 2. However, in reality, there is a case where it is not desirable to provide an error detection unit inside the computer 2. In such a case, with the configuration as in the present embodiment, the same function can be realized by simply adding the monitoring computer 5 to the network without changing the computer 2.

Next, FIG. 3 shows an overall configuration diagram of a network system to which the third embodiment of the present invention is applied.
That is, the computers 2a and 2b and the network monitoring device computers 6a and 6b are connected to the LANs 8a and 8b.
It is connected to the. LANs 8a, 8 each having the same configuration
b is connected by WAN9. Each of the network monitoring computers 6a and 6b has an IP address 80
e, 80f are allocated.

The computers 2a, 2 used in the present embodiment
The configuration of b is the same as in the first embodiment. FIG. 6 shows the configuration of the network monitoring computers 6a and 6b.

The network monitoring computer 6 is configured as shown in FIG.
1, an input device 101 such as a keyboard and a display device 102 such as a CRT and a liquid crystal display are connected. The network monitoring computer 6 includes a communication control unit 61, a data acquisition unit 12, an IP address storage unit 13, a data determination unit 14, a data acquisition control unit 16,
And a display control unit 18 as its internal functions.
These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control section 61 controls communication with other devices on the network. For example, to generate a packet for transmission to another device on the network,
8 is output. Specifically, if the network monitoring computer 6a receives the notification from the data discriminating unit 14, the network monitoring computer 6a acquires the IP address 80f of the network monitoring computer 6b from the IP address storage unit 13 and
Send g.

The IP address storage unit 13 stores an area for storing the IP address 80 assigned to the own network monitoring computer 6 and the IP address 80 assigned to the network monitoring computer 6 connected to another LAN 8. Prepare. For example, in the case of the network monitoring computer 6a, the IP address 80e (***. ***. 34.78) is stored in the area for the own computer 6, and the IP address 8 is stored in the area of the other network monitoring computer.
0f (***. ***. 12.89) is stored.

The data discriminating section 14 discriminates whether or not the destination IP address of the fetched packet matches the IP address stored in the own device IP address storage area of the IP address storage section 13. That is, in the network monitoring computer 6a, the destination IP address of the captured packet is the IP address 80e (***. **
* .12.89). As a result of the determination, if they match, the communication control unit 61 and the data acquisition control unit 16 are notified of that.

Since an IP address is assigned to the network monitoring computer 6 of this embodiment, it is not necessary to provide the test computer 3 unlike the other embodiments. That is, when a packet addressed to the own computer 6 is received, the data holding unit 122 is not updated. As a result, when the packet addressed to the own computer 6 is obtained, the packet stored in the data holding unit 122 is
It is kept as it is.

Further, since the packet can be transmitted to another device on the network, the computer 2 only has to send a Ping for notifying the network monitoring computer 6 on the same LAN 8 of the error detection.

Note that, in the first embodiment, the LAN analyzer 1 and the computer 2 may be configured integrally, and in the third embodiment, the network monitoring computer 6 and the computer 2 may be configured integrally. . In addition, each configuration described in the above embodiment can be changed, added, or omitted as much as possible.

Furthermore, in any of the above embodiments, the two LANs 8a and 8b connected by the WAN 9
However, even if the number of LANs 8 is more than this, the same applies.

[0053]

According to the present invention, it is possible to prevent the held data from being updated according to the data taken in by the network monitoring device.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of a network system according to a first embodiment to which the present invention is applied.

FIG. 2 is an overall configuration diagram of a network system according to a second embodiment to which the present invention is applied.

FIG. 3 is an overall configuration diagram of a network system according to a third embodiment to which the present invention is applied.

FIG. 4A is a diagram illustrating L in the embodiment according to the present invention.
FIG. 3 is an explanatory diagram illustrating a configuration of an AN analyzer, and FIG.
FIG. 1 is an explanatory diagram illustrating a configuration of a computer according to an embodiment of the present invention.

FIG. 5 is an explanatory diagram illustrating a configuration of a monitoring computer according to the embodiment of the present invention.

FIG. 6 is an explanatory diagram illustrating a configuration of a network monitoring computer according to the embodiment of the present invention.

FIG. 7 is a flowchart showing a processing procedure of the LAN analyzer according to the present invention.

FIG. 8 is a flowchart showing a processing procedure of a monitoring computer according to the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... LAN analyzer, 2 ... computer, 3 ... test computer, 5 ... monitoring computer, 6 ... network monitoring computer, 8 ... LAN, 9 ... WAN.

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Reiwa Yamagishi 504-2 Shinanomachi, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture Inside Hitachi Electronics Service Co., Ltd. (72) Mutsuji Takesada 504-2 Shinanomachi, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture F-term in Hitachi Electronics Service Co., Ltd. (reference) 5K033 AA06 BA04 BA08 CB06 CC01 DA01 DA06 DB20 EA03 EA04 EA07 5K035 AA02 AA03 BB03 DD01 EE01 GG13 JJ01 MM04

Claims (6)

[Claims] 1. A network system in which a network monitoring device and a computer are connected via a network, wherein the computer detects the occurrence of a predetermined event and detects the occurrence of the event. Then, the network monitoring device includes an event detection unit that outputs a specific packet to the network, wherein the network monitoring device sequentially captures and holds a packet on the network, and a packet acquisition unit that retains the packet. A determination unit that determines whether the packet is the specific packet; and, as a result of the determination by the determination unit, when the packet captured by the packet acquisition unit is the specific packet,
A control unit configured to control the packet acquisition unit not to hold a packet subsequent to the packet. 2. The network system according to claim 1, wherein the packet acquiring unit includes: a capturing unit that captures the packet from the network; and a holding unit that retains the packet captured by the capturing unit. As a result of the discrimination by the discriminating unit, when the packet captured by the capturing unit is the specific packet, the control unit causes the capturing unit to stop capturing a packet after the packet. . 3. The network system according to claim 1, wherein the packet acquisition unit includes: a holding unit that holds a packet; and a capturing unit that captures the packet from the network and writes the packet into the holding unit. As a result of the determination by the determination unit, when the packet captured by the capture unit is the specific packet, the control unit stops writing of the packet captured by the capture unit and subsequent to the packet to the holding unit. A network system characterized by: 4. The network system according to claim 1, wherein a communication protocol of the network is an Internet protocol, and a packet on the network is at least a packet of the packet. The specific packet includes an IP address of a destination device, and the IP address of the destination device of the packet includes a specific I
A network monitoring device, which is a packet of a ping command in which a P address is set. 5. When a predetermined event is detected, and when the event is detected, a process of outputting a specific packet to the network, a packet on the network is captured, and the captured packet is A process of determining whether or not the packet is a specific packet; as a result of the determination, if the captured packet is not the specific packet, the captured packet is held, and if the captured packet is the specific packet, A method of not storing a packet subsequent to the packet. 6. A process for outputting a specific packet to a network when detecting the occurrence of a predetermined event and detecting the occurrence of the event, capturing a packet on the network, and detecting the captured packet. A process of determining whether or not the packet is a specific packet; as a result of the determination, if the captured packet is not the specific packet, the captured packet is held, and if the captured packet is the specific packet, A computer-readable recording medium recording a program for causing a computer to execute a process that does not hold a packet subsequent to the packet.