JP2006279174A - Overlapping ip investigator - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an overlapping IP investigator capable of systematically scheduling the investigation of overlapped IP addresses periodically under convenient time-wise conditions. <P>SOLUTION: The overlapping IP address investigator 18 investigates the overlapped IP addresses in a first LAN 12. The overlapping IP address investigator 18 has an investigation schedule storage section 21 in which an investigation predetermined time is stored, an overlapping IP investigation control section 20 outputting an input IP investigation command when the investigation predetermined time and a present time coincide and an input IP list storage section 27. The investigator 18 further has an input IP investigating section 22 outputting ARP transmitting-receiving commands regarding the IP address of the input IP list storage section 27 by the input IP investigation command and an ARP demand transmitting-receiving section 23 transmitting the ARP demands of the IP addresses by the ARP transmitting-receiving commands and outputting the overlapped IP addresses and a result inscription command when receiving two or more of ARP responses. The investigator 18 further has a detection-result list storage section 25 and a result inscription section 24 storing the overlapped IP addresses in the detection-result list storage section 25 by the result inscription command. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a duplicate IP investigation device that investigates duplicate IP addresses, and more particularly to a duplicate IP investigation device that can schedule a duplicate IP investigation systematically and periodically.

  Installation of an IP network has been promoted, and the number of terminals (IP telephones and PCs) holding an IP address that is a logical address is increasing. Furthermore, since the movement of terminals across LANs and the movement of terminals by wireless connection are possible, the IP address frequently changes. The IP address is changed by manual input by the network administrator, etc. For the reasons described above, an IP address input error or forgetting to change the IP address occurs in the process of changing the IP address. An address may occur. When a duplicate IP address is generated, both the duplicated terminal and the duplicated terminal are in a state where communication is impossible, so the service is forced to stop, which is a very important problem.

  As a conventional method for detecting a duplicate IP address, for example, there is one disclosed in Patent Document 1. This conventional method extracts a transmission IP address for each packet, stores the extracted IP address, detects duplication between the newly extracted IP address and the stored IP address, and duplicates the IP address. When a message is detected, the repeater is provided with a function of creating a duplicate notification packet for notifying the network management terminal of this fact.

Japanese Patent Laid-Open No. 06-075900

  However, the conventional method has a problem that it is difficult to detect duplicate IPs under convenient time conditions.

  The present invention has been made in order to solve such a conventional problem, and provides a duplicate IP investigation device capable of regularly and regularly scheduling investigation of duplicate IP addresses under convenient time conditions. For the purpose.

  The duplicate IP investigation device of the present invention is a duplicate IP address investigation device that investigates duplicate IP addresses in a network, and stores the investigation schedule storage means in which the investigation date and time of duplicate IP addresses are stored, and the investigation schedule storage means stores the investigation schedule storage means. The current scheduled date and time are compared with the current survey date and time, and if both date and time match, the duplicate IP survey control means for outputting the input IP survey command and the input IP list in which the IP address to be surveyed are stored When the storage means and the input IP check command are input, the input IP check means for outputting the ARP transmission command for the IP address stored in the input IP list storage device and the ARP transmission command are input. ARP request transmitting means for transmitting an ARP request for the IP address in the network, and the ARP When an ARP response to a request is received and two or more ARP responses are received for an ARP request for one IP address, it is determined that the IP address is duplicated, and the duplicate IP address and a result entry command are output. When the ARP response receiving means, the detection result list storage means for storing the detected duplicate IP address, and the result entry command are input together with the duplicate IP address, the duplicate IP address is stored in the detection result list storage means. And a result entry means for storing.

  According to the present invention, even if a duplicate IP address occurs, there is an effect that the investigation of the duplicate IP address can be scheduled systematically and periodically under a convenient time condition.

  FIG. 1 is a configuration diagram of an IP network provided with a duplicate IP investigation device according to an embodiment of the present invention. 1 includes a public IP network 11, a first LAN 12, a second LAN 13, a first IP phone 14, a first PC (personal computer) 15, a second IP phone 16, The second PC 17 and the duplicate IP investigation device 18 according to the embodiment of this invention are provided.

  A first LAN (denoted as “LAN1” in FIG. 1) 12 and a second LAN (denoted as “LAN2” in FIG. 1) 13 are connected via a public IP network 11. . The first LAN 12 includes a first IP telephone (referred to as “IP telephone 1” in FIG. 1) 14, a first PC (referred to as “PC1” in FIG. 1) 15, and The duplicate IP investigation device 18 is connected, and other IP terminals (not shown) are also connected. Further, the second LAN 13 includes a second IP telephone (denoted as “IP telephone 2” in FIG. 1) 15 and a second PC 17 (denoted as “PC2” in FIG. 1). Are connected, and other IP terminals (not shown) are also connected.

  The duplicate IP investigation device 18 includes a duplicate IP investigation control unit 20, an investigation schedule storage unit 21, an input IP investigation unit 22, an ARP (Address Resolution Protocol) request transmission / reception unit 23, a result entry unit 24, and a detection result list. A storage unit 25, a result display unit 26, an input IP list storage unit 27, a console unit 28, and a built-in clock 29 are provided. The duplicate IP investigation device 18 investigates the duplicate IP address in the first LAN 12.

  The duplicate IP investigation control unit 20 is connected to an investigation schedule storage unit 21, an input IP investigation unit 22, and a built-in clock 29.

  FIG. 2 is a flowchart for explaining the operation of the duplicate IP investigation control unit 20. As shown in FIG. 2, the duplicate IP investigation control unit 20 reads the investigation schedule from the investigation schedule storage unit 21 (step S21), and reads the investigation schedule that has been read into the current time (or the current time) from the built-in clock 29. (Step S22, S23) and if the survey schedule matches the current time, a process of issuing an input IP survey command to the input IP survey unit 22 (step S24) is executed.

  The input IP investigation unit 22 is connected to the duplicate IP investigation control unit 20, the ARP request transmission / reception unit 23, and the input IP list storage unit 27.

  FIG. 3 is a flowchart for explaining the operation of the input IP examining unit 22. As shown in FIG. 3, the input IP checking unit 22 reads the input IP list from the input IP list storage unit 27 (step S31), and the IP address specified in the read input IP list is normal. A process of comparing (checking and confirming) whether there is any (step S32) and a process of issuing an ARP request transmission command to the ARP request transmitting / receiving unit 23 if the input IP list is normal (steps S33 and S34).

  The ARP request transmission / reception unit 23 is connected to the input IP investigation unit 22 and the result entry unit 24.

  FIG. 4 is a flowchart for explaining the operation of the ARP request transmission / reception unit 23. As shown in FIG. 4, the ARP request transmission / reception unit 23 receives the input IP list (the input IP survey unit 22 has read from the input IP list storage unit 27 and confirmed that it is normal) from the input IP survey unit 22. A process of reading (step S41), a process of transmitting an ARP request for each IP address specified in the read input IP list (step S42), and an ARP response to one ARP request of the same IP address twice (step S42) 2) If the received IP address has been received twice or more (steps S43 and S44) for comparing (monitoring and checking) whether it has been received or not, it is determined that the investigated IP address is duplicated, and the result entry unit 24 The IP address that detected the duplication and the MAC (Media Access Control) address obtained from the ARP response are received. A process of delivering the result entry command (step S44) and a process of comparing whether the ARP request is transmitted to all IP addresses specified in the input IP list (steps S46 and S47) are executed.

  The result entry unit 24 is connected to the ARP request transmission / reception unit 23 and the detection result list storage unit 25.

  FIG. 5 is a flowchart for explaining the operation of the result entry unit 24. As shown in FIG. 5, the result entry unit 24 receives the IP address and the MAC address from the ARP request transmission / reception unit 23 (step S51), and stores a time stamp (investigation (implementation) date and time in the detection result list storage unit 25). And the process of entering the received IP address (duplicate IP address) and MAC address (MAC address where the IP address is duplicated) (step S52).

  The console unit 28 is a console operated by the administrator of the duplicate IP investigation device 18 and is connected to the result display unit 26.

  FIG. 6 is a flowchart for explaining the operation of the console unit 28. As shown in FIG. 6, the console unit 28 performs processing for determining whether a command is input from the administrator (steps S61 and S62) and processing for issuing a result display command to the result display unit 26 (step S63). Execute.

  The result display unit 26 is connected to the detection result list storage unit 25 and the console unit 28.

  FIG. 7 is a flowchart for explaining the operation of the result display unit 26. As shown in FIG. 7, the result display unit 26 executes a process of reading the detection result list from the detection result list storage unit 25 (step S71) and a process of displaying the detection result list on the screen (step S72). .

  As shown in FIG. 8, the survey schedule storage unit 21 includes a survey schedule table of data contents having a date (“20040929”, etc.) scheduled to be surveyed and a time (“18:30”, etc.) as a pair. 81 is held. The survey schedule in the survey schedule table 81 is input by manual input by a network administrator and stored in advance.

  As shown in FIG. 9, the input IP list storage unit 27 holds an input IP list table 91 of data contents in which IP addresses (“192.168.1.1”, etc.) to be investigated are arranged. The list of IP addresses to be investigated in the input IP list table 91 is input by manual input by a network administrator and stored in advance.

  The detection result list storage unit 25 has a time stamp (such as “200404029 18:30”) and an IP address (“192.168.1.1”) including the date and time when the investigation was performed as shown in FIG. ”) And the MAC address (“ 00: 00: 00: 00: 00: 00 ”and“ 01: 01: 01: 01: 01: 01 ”, etc.) are stored as a pair. . The detection results in the detection result table 101 are written and stored by the result detection entry unit 24.

  The built-in clock 29 is connected to the duplicate IP investigation control unit 20 and outputs the current date and time (year / month / day and time) to the duplicate IP investigation control unit 20. Note that the built-in clock 29 may have a function of calibrating the built-in clock based on, for example, a reference time supplied from the outside of the duplicate IP investigation device 18 at regular time intervals. The built-in clock 29 may be connected to the result entry unit 24 in order to generate the time stamp that the result entry unit 24 stores in the detection result list storage unit 25.

  The operation of the duplicate IP investigation device 18 of the embodiment of the present invention configured as described above will be described below.

  First, in FIG. 2, the duplicate IP investigation control unit 20 reads the investigation schedule table 81 (see FIG. 8) of the investigation schedule storage unit 21 (step S21), and the investigation scheduled time (or investigation schedule) in this investigation schedule table 81. (Date and time) and the current time (current date and time) from the built-in clock 29 are compared (step S22).

  If there is a scheduled survey time that coincides with the current time in the survey schedule table 81 (Yes in step S23), an input IP survey command is issued to the input IP survey unit (step S24), and the process is terminated. If there is no scheduled survey time that coincides with the current time in the survey schedule table 71 (No in step S23), the process returns to step S22.

  In FIG. 3, when the input IP investigation command is issued from the duplicate IP investigation control unit 20, the input IP investigation unit 22 reads the input IP list table 91 (see FIG. 9) in the input IP list storage unit 27 (step S31). Then, it is compared (checked and confirmed) whether the IP address specified in the read input IP list table 91 is normal (step S32).

  If any IP address is abnormal (No in step S33), the process ends. If all the IP addresses are normal (Yes in step S33), an ARP request transmission command is issued to the ARP request transmission / reception unit 23 (step S34), and the process ends.

  In the input IP list storage unit 27, the IP address used in the first LAN 12 (see FIG. 1) is stored in advance by manual input of the network administrator, etc., but in step S32 (FIG. 3) above. In the process, the input IP checking unit 22 confirms whether the IP address is a correct IP address.

  In general, an IP address is normal (a correct IP address) is defined by RFC (Request For Comment) 791 and RFC796, which are texts officially issued by the IETF, an organization that establishes technical standards related to the Internet. That the IP address is described in a format. This is summarized as (1) below.

(1) The IP address is expressed in 32 [bits] divided into four 8 [bits].

  Furthermore, in this embodiment, that the IP address is normal means that, in addition to the above (1), the following (2) to (2)- The IP address satisfies a total of four requirements including (4).

(2) It is not a broadcast address.
For example, when the IP address of the duplicate IP investigation device 18 is “192.168.1.2” and the netmask is “255.255.255.0”, the IP address “192.168.1.200” and “192.168.1.210” is all OK (ie, satisfies the broadcast address requirement), but the IP address “192.168.1.'255” ”is NG (ie, the broadcast address Does not meet the requirements).

(3) The IP address of the same segment as the duplicate IP investigation device 18 itself.
Here, the segment means a range of host addresses specified by the netmask when an IP address and a netmask are set, and the IP address of the same segment is an IP address having the same host address. To tell. For example, when the IP address of the duplicate IP investigation device 18 is “192.168.1.2” and the netmask is “255.255.255.0”, the IP address “192.168.1.10”, "192.168.1.11" and "192.168.1.135" are both OK (same segment), but the IP address "192.168.'2'.12" is NG (different segment) It becomes.

(4) The IP address to be checked is not the IP address of the duplicate IP checking device 18 itself.
For example, when the IP address of the duplicate IP investigation device 18 is “192.168.1.2” and the netmask is “255.255.255.0”, the IP address “192.168.8.1. 3 ”is OK (that is, this requirement is satisfied), but the IP address“ 192.168.1.2 ”to be investigated is NG (that is, this requirement is not satisfied).

  In the input IP checking unit 22, it is automatically determined whether or not the IP addresses to be checked read from the IP list storage unit 27 meet all the requirements (1) to (4). It is processed as an IP address.

  Therefore, even when the IP address is not correctly input due to an input error or the like, it is determined as an abnormal IP address. However, if the IP address is input to the input IP list storage unit 27 and it is confirmed in advance that the IP address is correct, the process of step S32 (FIG. 3) is not necessary.

  In FIG. 4, when an ARP request transmission command is issued from the input IP survey unit 22, the ARP request transmission / reception unit 23 reads the input IP list table 91 (the input IP survey unit 22 reads from the input IP list storage unit 27 and specifies it. From the input IP survey unit 22 (step S41), and an ARP request is transmitted for each IP address specified in the input IP list table 91 (step S42). ), It compares (ie, monitors and checks) whether the ARP responses following the ARP request have been received twice (two) or more (step S43).

  If the ARP response is received twice or more for one ARP request (one IP address) (Yes in step S44), it is determined that the investigated IP address is duplicated, and the result entry unit 24 The IP address from which the duplication is detected and all the MAC addresses acquired from the two or more received ARP responses for the IP address are delivered, and a result entry command is issued (step S45).

  Further, it is compared (checked) whether ARP requests have been transmitted for all IP addresses in the input IP list table 81 (step S46). If ARP requests have been transmitted for all IP addresses (Yes in step S47). If the process is terminated and ARP requests have not been transmitted for all IP addresses (No in step S47), the process returns to step S42.

  If an ARP request is not received twice or more for one ARP request (one IP address) (No in step S44), the process proceeds to step S46 without performing the process in step S45.

  ARP (Address Resolution Protocol) is a protocol that associates an IP address set to a device with a MAC address. Based on the IP address, the ARP request uses which MAC address the IP address uses. Is inquired.

  In FIG. 1, since the first LAN 12 is one segment (the same segment), in the above-described step 42, the duplicate IP investigation device 18 is connected to the first IP phone 14 and the first PC 15, and the first LAN 12. An ARP request is broadcast to other IP terminals.

  FIGS. 11 to 14 are diagrams for explaining transmission / reception of an ARP request and an ARP response in a network environment having no duplicate IP address. FIGS. 15 to 18 are diagrams illustrating an ARP in a network environment in which a duplicate IP address occurs. It is a figure explaining transmission and reception of a request and an ARP response.

  In FIG. 11 to FIG. 18, the duplicate IP investigation apparatus of the present invention, the first PC (PC1), the second PC (PC2), and the third PC (PC3) are connected to a network such as a LAN. Are connected to each other.

  First, in the network environment from FIG. 11 to FIG. 14 where there is no duplicate IP address, as shown in FIG. 11, the duplicate IP investigation device has an IP address “192.168.1.2” and a MAC address “00-00-”. 00-00-00-02 ”is set, and the IP address“ 192.168.1.3 ”and the MAC address“ 00-00-00-00-00-03 ”are set in the first PC. The IP address “192.168.1.4” and the MAC address “00-00-00-00-00-04” are set in the second PC, and the third PC is set in the second PC. The IP address “192.168.1.5” and the MAC address “00-00-00-00-00-05” are set.

  In FIG. 12, the duplicate IP examination apparatus attaches its own IP address “192.168.1.2” and MAC address “00-00-00-00-00-02”, and adds the IP address “192.168.”. When the ARP request for “.1.3” is broadcast, the ARP request is received by the first PC, the second PC, and the third PC.

  The above ARP request is for inquiring about the device having the IP address “192.168.1.3”, and requesting the ARP response to be returned from the device in which the IP address is set to the duplicate IP investigation device. is there.

  In FIG. 13, when the first PC receives the ARP request, the request IP address “192.168.1.3” of the ARP request is its own IP address “192.168.1.3”. ARP response with its own IP address “192.168.1.3” and MAC address “00-00-00-00-00-03” attached is returned to the duplicate IP investigation device.

  However, even if the second PC and the third PC receive the ARP request, the request IP address “192.168.1.3” of the ARP request is its own IP address “192.168.1. Since it is not “5”, an ARP response is not returned.

  In FIG. 14, the duplicate IP investigation device receives the ARP response returned from the first PC, and the device with the IP address “192.168.1.3” is the first PC from the received ARP response. And that the MAC address of the first PC is “00-00-00-00-00-03”.

  Both the IP address and the MAC address are unique addresses, and one MAC address exists for one IP address. The IP address is a logical address set for a device connected to the network by a network administrator, and the MAC address is a physical address set in a manufacturing factory by a manufacturer that manufactures a device connected to the network.

  Accordingly, in a network environment without duplicate IP addresses as shown in FIGS. 11 to 14, only one corresponding device returns an ARP response to one ARP request for one IP address. No more than one ARP response is made for a single ARP request.

  Next, in the network environment from FIG. 15 to FIG. 18 in which duplicate IP addresses have occurred, as shown in FIG. 15, the duplicate IP investigation device has an IP address “192.168.1.2” and a MAC address “00− 00-00-00-00-02 ”is set, and the first PC has an IP address“ 192.168.1.3 ”and a MAC address“ 00-00-00-00-00-03 ”. The IP address “192.168.1.'3” ”and the MAC address“ 00-00-00-00-00-04 ”are set in the second PC. The IP address “192.168.1.5” and the MAC address “00-00-00-00-00-05” are set in the PC. That is, the IP addresses of the first PC and the second PC overlap.

  In FIG. 16, the duplicate IP investigation device attaches its own IP address “192.168.1.2” and MAC address “00-00-00-00-00-02”, and adds the IP address “192.168.”. When the ARP request for “.1.3” is broadcast, the ARP request is received by the first PC, the second PC, and the third PC.

  In FIG. 17, when the first PC receives the ARP request, the request IP address “192.168.1.3” of the ARP request is its own IP address “192.168.1.3”. ARP response with its own IP address “192.168.1.3” and MAC address “00-00-00-00-00-03” attached is returned to the duplicate IP investigation device.

  Similarly, when the second PC also receives the ARP request, the request IP address “192.168.1.3” of the ARP request is its own IP address “192.168.1.3”. Therefore, an ARP response attached with its own IP address “192.168.1.3” and MAC address “00-00-00-00-00-04” is returned to the duplicate IP investigation device.

  However, even if the third PC receives the ARP request, the request IP address “192.168.1.3” of the ARP request is not its own IP address “192.168.1.5”. ARP response is not returned.

  In FIG. 18, the duplicate IP investigation device receives the ARP response sent back from the first PC, and the device with the IP address “192.168.1.3” is the first PC from the received ARP response. And that the MAC address of the first PC is “00-00-00-00-00-03”. At the same time, the duplicate IP investigation device receives the ARP response returned from the second PC, and the device having the IP address “192.168.1.3” is also the second PC from the received ARP response. , And the MAC address of the second PC is “00-00-00-00-00-04”.

  Then, the duplicate IP investigation device can recognize from the above two received ARP responses that the IP addresses of the first PC and the second PC are the same “192.168.1.3” and are duplicated. .

  As described above, in a network environment in which duplicate IP addresses occur as shown in FIGS. 15 to 18, two or more corresponding devices return ARP responses to one ARP request for one IP address. The duplicate IP investigation device receives two or more ARP responses, and can recognize that a duplicate IP address has been generated by receiving two or more ARP responses, and two or more received ARPs. Based on the MAC address attached to the response, two or more devices having overlapping IP addresses can be recognized.

  In addition, in such an ARP communication procedure, the fact that an ARP request and an ARP response could be transmitted and received between the duplicate IP investigation device and another terminal means that two-way communication was possible between both terminals. It is. Therefore, if Layer 2 ARP is used, the connectivity (whether or not communication is possible) at Layer 2 can be confirmed based on whether or not the ARP request and ARP response can be transmitted and received.

  That is, by transmitting and receiving an ARP request and an ARP response at layer 2, it is possible to detect duplicate IP addresses and at the same time check whether there is a connection between terminals at the layer 2 level.

  In FIG. 5, the result entry unit 24 receives the IP address and all MAC addresses from the ARP request transmission / reception unit 23 (step S51), and stores the time stamp in the detection result table 101 (see FIG. 10) of the detection result list storage unit 25. (Survey date and time) and the received IP address (duplicate IP address) and MAC address (all MAC addresses with duplicate IP addresses) are entered (step S52), and the process ends.

  In FIG. 6, the console unit 28 determines whether or not an instruction is input from the administrator (step 61). When the administrator inputs a result display command to the console unit 28, the result display command is input. (Yes in step 62), and issues a result display command to the result display unit 26 (step S63).

  In FIG. 7, when the result display unit 26 receives a result display command from the console unit 28, the result display unit 26 reads the detection result table 91 of the detection result list storage unit 25 (step S71), and displays the detection result list of the detection result table 91 on the screen. It is displayed (step S72).

  The screen display function of the detection result list allows the network administrator to view the investigation result instantaneously when he / she wants to confirm the duplicate IP address investigation result (detection result).

  As described above, according to the embodiment of the present invention, even when a duplicate IP address occurs, the investigation of the duplicate IP address can be scheduled systematically and periodically under a convenient time condition. Addresses can be discovered systematically and regularly.

  The present invention is characterized in that the investigation of duplicate IP addresses can be scheduled systematically and periodically. A duplicate IP investigation device is installed for each LAN, and a detection result table in a detection result list is collected. Further, by adding a predetermined function, it is possible to specify a mobile terminal between segments based on the MAC address, and therefore, it can be applied to an inter-segment movement survey of terminals.

It is a block diagram of an IP network provided with a duplicate IP investigation device of an embodiment of the present invention. 2 is a flowchart for explaining the operation of a duplicate IP investigation control unit in the duplicate IP investigation apparatus of FIG. 1. 3 is a flowchart for explaining the operation of an input IP investigation unit in the duplicate IP investigation apparatus of FIG. 1. 6 is a flowchart for explaining the operation of an ARP request transmission / reception unit in the duplicate IP investigation device of FIG. 1. It is a flowchart explaining operation | movement of the result entry part in the duplication IP investigation apparatus of FIG. It is a flowchart explaining operation | movement of the console part in the duplication IP investigation apparatus of FIG. It is a flowchart explaining operation | movement of the result display part in the duplication IP investigation apparatus of FIG. It is a block diagram of the investigation schedule in the duplication IP investigation apparatus of FIG. It is a block diagram of the input IP list in the duplicate IP investigation apparatus of FIG. It is a block diagram of the detection result list in the duplication IP investigation apparatus of FIG. FIG. 6 is a diagram (part 1) for explaining transmission / reception of an ARP request and an ARP response in a network environment without a duplicate IP address. FIG. 10 is a diagram (part 2) illustrating transmission / reception of an ARP request and an ARP response in a network environment without a duplicate IP address. FIG. 10 is a diagram (part 3) illustrating transmission / reception of an ARP request and an ARP response in a network environment without a duplicate IP address. FIG. 10 is a diagram (part 4) illustrating transmission / reception of an ARP request and an ARP response in a network environment without a duplicate IP address. FIG. 6 is a diagram (part 1) for explaining transmission / reception of an ARP request and an ARP response in a network environment in which a duplicate IP address occurs. FIG. 10 is a diagram (part 2) illustrating transmission / reception of an ARP request and an ARP response in a network environment in which a duplicate IP address occurs. FIG. 10 is a diagram (part 3) illustrating transmission / reception of an ARP request and an ARP response in a network environment in which a duplicate IP address occurs. FIG. 10 is a diagram (part 4) illustrating transmission / reception of an ARP request and an ARP response in a network environment in which a duplicate IP address occurs.

Explanation of symbols

11 Public IP network 12, 13 LAN
14,16 IP phone 15,17 PC
DESCRIPTION OF SYMBOLS 18 Duplicate IP investigation apparatus 20 Duplicate IP investigation control part 21 Investigation schedule memory | storage part 22 Input IP investigation part 23 ARP request transmission / reception part 24 Result entry part 25 Detection result list memory part 26 Result display part 27 Input IP list memory part 28 Console part 29 Built-in clock

Claims (4)

In the duplicate IP address investigation device that investigates duplicate IP addresses in the network,
A survey schedule storage means for storing the scheduled survey time of the duplicate IP address;
The survey scheduled time stored in the survey schedule storage means is compared with the current time, and if both times match, a duplicate IP survey control means for outputting an input IP survey command;
Input IP list storage means in which the IP address to be investigated is stored;
When the input IP check command is input, the input IP check means for outputting an ARP transmission command for the IP address stored in the input IP list storage means;
When the ARP transmission command is input, ARP request transmission means for transmitting an ARP request for the IP address into the network;
When an ARP response to the ARP request is received and two or more ARP responses are received for an ARP request for one IP address, it is determined that the IP address is duplicated, and the duplicate IP address and a result entry command are entered. An ARP response receiving means for outputting;
A detection result list storage means for storing the detected duplicate IP address;
When the result entry command is input together with the duplicate IP address, the duplicate IP examination apparatus has a result entry means for storing the duplicate IP address in the detection result list storage means.   When the input IP check command is input, the input IP check means determines whether the IP address stored in the input IP list storage means is normal, and if normal, outputs the ARP transmission command. The duplication IP investigation device according to claim 1, wherein: The ARP response receiving means outputs the MAC address acquired from the detected duplicate IP address and two or more ARP responses received for the duplicate IP address together with the result entry command,
The duplicate IP investigation device according to claim 1, wherein the result entry means stores the input duplicate IP address and the MAC address in the detection result list storage means together with the investigation execution date and time.   4. The duplicate IP according to claim 1, further comprising a result display means for displaying the detection results stored in the detection result list storage means when a result display command is inputted. Survey equipment.

Images