JP2007235535A - Communication device, communication processing method, and communication processing program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication device, a communication processing method, and a communication processing program capable of easily analyzing an error packet impossible to error correction. <P>SOLUTION: A data receiver 2 acquires a packet addressed to itself through a communication network and a network hardware 8. The data receiver 2 detects whether there is an error in the acquired packet or not, and performs correction for the packet by requesting resending to a packet transmission source if an error is detected. The data receiver 2 outputs the packet to a packet analyzer 3 as an error packet, when it is impossible to correct the packet. The packet analyzer 3 extracts a transmission source IP address at an header in the error packet, generates an analysis result information indicative of an error frequency for each transmission source IP address, and stores the information at an analysis result storage 4. When an error frequency does not satisfy a predetermined criterion, an OS (Operating System) management 5 outputs an information indicative of a corresponding transmission source IP address to a display means 7. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication apparatus, a communication processing method, and a communication processing program that are connected to a communication network and perform communication.

  In general, a communication device such as an electronic computer connected to a communication network performs error control on received packets in order to improve data transmission reliability. As error control, a CRC (Cyclical Redundancy Check) method, a Hamming code method, and the like are known. When an error is detected, a packet retransmission request is made to the transmission source, or self-correction is performed using redundant bits added for error detection. If correction is impossible, the number of packets in which errors are detected is counted and discarded. Hereinafter, a packet in which an error is detected in error control and cannot be corrected is referred to as an “error packet”.

  In a communication device on a network, when a fatal failure such as a broken interface unit occurs and a large number of error packets are transmitted, the entire network is often adversely affected. Therefore, it is necessary to identify and cope with the communication device that has transmitted the error packet immediately.

  There has been proposed a communication terminal capable of reliably and easily investigating and analyzing the cause of a fatal communication abnormality that has occurred during data communication and improving reliability (for example, see Patent Document 1). Patent Document 1 describes that when a communication abnormality occurs during data communication with an external device, the abnormality state is determined and the number of occurrences of abnormality is stored for each abnormality state. With such a configuration, when a fatal communication abnormality occurs, it is possible to easily investigate and analyze the cause of the abnormality.

  In addition, an attack packet countermeasure system has been proposed that can effectively protect against packet attacks (DoS attacks) on terminals and reduce the influence of authorized users on packets (see, for example, Patent Document 2). In Patent Literature 2, when packets are transmitted intensively to a specific terminal and congestion occurs, a temporary identifier of the packet causing the congestion is set, and the traffic volume of the packet corresponding to the temporary identifier Is automatically measured for each source address. With such a configuration, an attack packet causing congestion can be identified in units of source addresses, and an effective countermeasure against a DoS attack (packet attack) can be realized.

Japanese Patent Laid-Open No. 03-259642 JP 2004-356906 A (paragraphs 0028-0032)

  However, the method described in Patent Document 1 is configured to count the number of error occurrences corresponding to an error code when a communication abnormality occurs during data communication with an external device. Therefore, there is a problem that a communication device that causes an error is not specified.

  In addition, the method described in Patent Document 2 is configured to measure the traffic amount of attack packets for each source address. The attack packet is a packet that is determined to be normal in error control. For this reason, when an error packet in which an error is detected in error control is received and cannot be corrected, the error packet is discarded, and thus the transmission source cannot be specified.

  Accordingly, an object of the present invention is to provide a communication device, a communication processing method, and a communication processing program that can easily analyze an error packet that cannot be corrected.

  The communication device according to the present invention has a receiving means for receiving data addressed to itself, a correction judging means for judging whether error correction of the received data is possible, and an error correction is impossible by the correction judging means. Uncorrectable data input means for inputting the determined uncorrectable data, and a predetermined area in the uncorrectable data input by the uncorrectable data input means is extracted as transmission source information indicating the transmission source of the uncorrectable data. And analysis result information generating means for generating analysis result information indicating the number of uncorrectable data for each source information.

  When it is determined that the number of uncorrectable data included in the analysis result information generated by the analysis result information generation unit exceeds a predetermined specified value, Output means for outputting corresponding transmission source information. According to such a configuration, when the number of uncorrectable data exceeds a specified value, the corresponding transmission source information is output, so that the transmission source communication device of uncorrectable data can be easily identified.

  You may provide the memory | storage means to memorize | store the analysis result information produced | generated by the analysis result information production | generation means. According to such a configuration, it is possible to refer to analysis result information for all uncorrectable data.

  The analysis result information generation unit may discard the uncorrectable data after generating the analysis result information. According to such a configuration, efficient use of resources can be achieved.

  Communication control means for performing dedicated network protocol processing may be provided, and the communication control means may include analysis result information generation means. According to such a configuration, network processing can be speeded up.

  In the communication processing method according to the present invention, the control unit of the communication device receives the data addressed to the device according to the control program, determines whether the received data can be corrected, and the error correction is impossible. Input the determined uncorrectable data, extract a predetermined area in the input uncorrectable data as transmission source information indicating the transmission source of the uncorrectable data, and indicate the number of uncorrectable data for each transmission source information Analysis result information is generated.

  The communication processing program according to the present invention is a communication processing program installed in a communication device, and determines whether or not the communication device can receive data addressed to itself and can correct the received data. Processing, processing for inputting uncorrectable data determined to be impossible to correct, and extraction of a predetermined area in the input uncorrectable data as transmission source information indicating the transmission source of the uncorrectable data And processing for generating analysis result information indicating the number of uncorrectable data for each source information.

  According to the present invention, it is possible to easily identify a transmission source communication device of uncorrectable data that cannot be corrected because an error is detected in error control, failure management in the communication network is facilitated, and the communication network is restored. This has the effect of shortening the time required for.

Embodiment 1 FIG.
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. In the following description, an electronic computer 10 is exemplified as a communication device according to the present invention. FIG. 1 is a block diagram showing a first embodiment of an electronic computer 10 according to the present invention. An electronic computer 10 shown in FIG. 1 includes a data transmission unit 1, a data reception unit 2, a packet analysis unit 3, an analysis result storage unit 4, an OS (Operating System) management unit 5, an operation unit 6, and a display. Means 7 and network hardware 8 are provided. The electronic computer 10 is connected to other electronic computers via the network hardware 8 and the communication network.

  The data transmission unit 1 outputs the packet output from the OS management unit 5 to the network hardware 8 and transmits it on the communication network. The data transmission unit 1 has a function of requesting a response by transmitting data for partner confirmation prior to packet transmission.

  The data receiving unit 2 receives a packet via the communication network and the network hardware 8. The data receiving unit 2 acquires the packet when the destination of the received packet is addressed to itself, and discards the packet when not addressed to itself.

  The data receiving unit 2 has an error detection function for the acquired packet. When the data reception unit 2 confirms that the packet has been transmitted correctly, the data reception unit 2 transmits a response to the transmission source of the packet and outputs the packet to the OS management unit 5 to request processing. When an error is detected, the packet transmission source is requested to retransmit the received packet, and the received packet is corrected. If the error is corrected, a response is transmitted to the packet transmission source. If correction is impossible, the data reception unit 2 outputs an uncorrectable error packet to the packet analysis unit 3.

  The packet analysis unit 3 analyzes the error packet output by the data reception unit 2. The packet is information in which a header portion including a transmission source IP address is added to data. The packet analysis unit 3 extracts the source IP address in the header portion of the error packet, generates analysis result information, and stores it in the analysis result storage unit 4.

  FIG. 2 is an explanatory diagram illustrating an example of registration of analysis result information. As illustrated in FIG. 2, the analysis result information is information for each transmission source IP address, for example, information including error frequency (number of error packets). The packet analysis unit 3 may discard the error packet after generating the analysis result information.

  Further, the packet analysis unit 3 extracts the corresponding portion even when the portion corresponding to the transmission source IP address in the header portion cannot be extracted as the IP address due to an error packet error. For example, even if the part extracted as the source IP address is garbled, it is extracted and analysis result information is generated.

  The analysis result storage unit 4 is a storage device that stores analysis result information collected by the packet analysis unit 3. Note that the analysis result storage unit 4 may be connected to the electronic computer 10 as an external storage device.

  The OS management unit 5 includes a CPU (not shown) that controls each unit, and is a control device that performs various controls of the electronic computer 10 such as data communication by executing an OS and various programs. The OS management unit 5 refers to the analysis result information stored in the analysis result storage unit 4, and displays information indicating the corresponding transmission source IP address on the display unit 7 when the error frequency exceeds a predetermined value. Output.

  The operation means 6 is a keyboard or a mouse for inputting information, and the display means 7 is a display device, a printing device, or the like.

  The network hardware 8 converts the packet data output from the data transmission unit 1 into an electrical signal and transmits it to the communication network, or converts the electrical signal received from the communication network into packet data and outputs it to the data reception unit 2 To do.

  In the present embodiment, the receiving unit, the correction determining unit, and the uncorrectable data input unit are realized by the data receiving unit 2. The analysis result information generating means is realized by the packet analysis unit 3. The rule determining means is realized by the OS management unit 5. The output means is realized by the display means 7. The storage means is realized by the analysis result storage unit 4.

  The communication device can be realized by a computer, and each component constituting the communication device, that is, the data transmission unit 1, the data reception unit 2, the packet analysis unit 3, and the OS management unit 5, is a computer processing device (CPU). It can be realized as a program for realizing the functions described above.

  Next, the operation of the present embodiment will be described with reference to the drawings. FIG. 3 is a flowchart showing the operation of the electronic computer 10 in the first embodiment.

  The data receiving unit 2 receives the packet via the communication network and the network hardware 8, and acquires the packet addressed to itself (step S101). The data receiving unit 2 detects whether or not there is an error in the acquired packet (step S102). If an error is detected in step S102 (YES), the data reception unit 2 corrects the packet by requesting retransmission from the packet transmission source (step S103). If no error is detected (NO), the process proceeds to step S108.

  In step S103, if the packet cannot be corrected (NO), the data receiving unit 2 outputs the uncorrectable packet to the packet analysis unit 3 as an error packet (step S104). If the packet can be corrected (YES), the process proceeds to step S108. In step S108, the data receiving unit 2 transmits a response to the transmission source of the packet, and ends a series of processing.

  The packet analysis unit 3 analyzes the error packet output by the data reception unit 2, generates analysis result information, and stores it in the analysis result storage unit 4 (step S105). The packet analysis unit 3 extracts the transmission source IP address in the header part of the error packet, generates information indicating the error frequency for each transmission source IP address as analysis result information, and stores it in the analysis result storage unit 4.

  The OS management unit 5 refers to the analysis result information stored in the analysis result storage unit 4 to determine whether or not the error frequency exceeds a predetermined standard (step S106). In step S106, when the error frequency exceeds a predetermined standard (YES), the OS management unit 5 outputs information indicating the corresponding transmission source IP address to the display unit 7 (step S107). In step S106, when the error frequency falls below a predetermined standard (NO), the series of processes is terminated.

  As described above, according to the first embodiment, an error is detected in error control, a source IP address of a packet that cannot be corrected is extracted, and an analysis indicating an error frequency for each source IP address is performed. Since the result information is generated, there is an effect that the failure management in the communication network becomes easy. In addition, there is an effect that the time required for recovery of the communication network can be shortened.

Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described with reference to the drawings. In the second embodiment, the electronic computer 20 is equipped with a TOE (TCP / IP Offload Engine).

  FIG. 4 is a block diagram showing a second embodiment of the electronic computer 20 according to the present invention. The computer 20 shown in FIG. 4 includes a data transmission unit 1, a data reception unit 2, a packet analysis unit 3, an analysis result storage unit 4, an OS management unit 5, an operation unit 6, a display unit 7, A network hardware 8 and an offload engine 9 are provided. Components similar to those of the electronic computer 10 in the first embodiment are denoted by the same reference numerals as those in FIG.

  The offload engine 9 is a control device that executes TCP / IP processing, and is realized by the TOE. The offload engine 9 includes a packet analysis unit 3. In the second embodiment, the communication control means is realized by the off-road engine 9.

  The TOE is a control device that executes basic TCP / IP processing such as connection, management, and disconnection using the TCP / IP protocol. Generally, TCP / IP processing is executed by a CPU mounted on a computer. In particular, in a computer that performs a large-capacity packet transfer process or the like, the CPU load for the TCP / IP process is large, so that not only the TCP / IP process but also the overall processing efficiency is deteriorated. By shifting the TCP / IP processing to the TOE, the CPU load can be reduced and the speed of the TCP / IP processing can be increased.

  The data transmission unit 1 outputs the packet output from the offload engine 9 to the network hardware 8 and transmits it on the communication network.

  The data receiving unit 2 receives the packet addressed to itself and performs error detection. If an error is detected, the packet is corrected. If the error cannot be corrected, the data receiving unit 2 outputs an uncorrectable error packet to the offload engine 9.

  The offload engine 9 outputs the error packet output by the data reception unit 2 to the packet analysis unit 3.

  The packet analysis unit 3 analyzes the error packet output by the offload engine 9. The packet analysis unit 3 extracts the source IP address in the header portion of the error packet, generates analysis result information, and stores it in the analysis result storage unit 4.

  According to the second embodiment, as in the first embodiment, failure management within the communication network is facilitated, and the time required for recovery of the communication network can be shortened. Furthermore, since the packet analysis unit 3 is included in the TOE, the processing speed can be increased.

  In the first embodiment and the second embodiment described above, the electronic computer is exemplified as the communication device. However, other communication devices may be used. Further, although the case where the data receiving unit requests retransmission from the packet transmission source and corrects the received packet is illustrated, self-correction may be performed using redundant bits added for error detection.

  The present invention can be effectively applied to a communication apparatus that is connected to a communication network and performs communication.

It is a block diagram which shows 1st Embodiment of the electronic computer by this invention. It is explanatory drawing which shows the example of registration of analysis result information. It is a flowchart which shows operation | movement of the electronic computer in 1st Embodiment. It is a block diagram which shows 2nd Embodiment of the electronic computer by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Data transmission part 2 Data reception part 3 Packet analysis part 4 Analysis result preservation | save part 5 OS management part 6 Operation means 7 Display means 8 Network hardware 10 Electronic computer

Claims (7)

Receiving means for receiving data addressed to the device;
Correction judging means for judging whether or not error correction of received data is possible;
When it is determined by the correction determining means that error correction is impossible, a predetermined area in uncorrectable data that cannot be corrected is extracted as transmission source information indicating the transmission source of the uncorrectable data And an analysis result information generating means for generating analysis result information indicating the number of uncorrectable data for each source information. Definition determining means for determining whether or not the number of uncorrectable data included in the analysis result information generated by the analysis result information generating means exceeds a predetermined specified value;
The communication device according to claim 1, further comprising: an output unit that outputs corresponding transmission source information when it is determined that the specified value is exceeded. The communication apparatus according to claim 1, further comprising a storage unit that stores analysis result information generated by the analysis result information generation unit. The communication apparatus according to any one of claims 1 to 3, wherein the analysis result information generation unit discards uncorrectable data after generation of the analysis result information. Provided with communication control means dedicated to network protocol processing,
The communication device according to any one of claims 1 to 4, wherein the communication control unit includes an analysis result information generation unit. The control unit of the communication device follows the control program,
Receive data addressed to your device,
Determine whether the received data can be corrected,
When it is determined that error correction is impossible, a predetermined area in uncorrectable data that cannot be corrected is extracted as transmission source information indicating the transmission source of the uncorrectable data, and the transmission source information A communication processing method characterized by generating analysis result information indicating the number of uncorrectable data for each. A communication processing program installed in a communication device,
In the communication device,
A process of receiving data addressed to its own device;
A process for determining whether error correction of received data is possible;
When it is determined that error correction is impossible, a predetermined area in uncorrectable data that cannot be corrected is extracted as transmission source information indicating the transmission source of the uncorrectable data, and the transmission source information A communication processing program for executing processing for generating analysis result information indicating the number of uncorrectable data for each.

Images