JP2010154475A - Network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain a technology which makes trace data associated with packet data easily, and obtains the trace data even if a time range where the packet data can be obtained exceeds a time range where the trace data can be obtained. <P>SOLUTION: A network system 1 which receives and stores the trace data showing operation states of a target apparatus 30 and the packet data transmitted from the target apparatus 30 through a network N includes: a time synchronizing part 11A for synchronizing a which is time-counted by a time-counting part 16 and a time-counting part 27; a control part 10 for generating and storing a capture event by giving a time stamp showing a time synchronized by the time synchronizing part 11A to the packet data when the packet data are received; and a control part 20 for giving the time stamp showing the time synchronized by the time synchronizing part 11A to trace data and storing the data when the trace data are received. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network system.

  In recent years, apparatuses that support operation analysis, performance measurement, and evaluation work such as debugging of devices (network devices) configuring a network have been implemented. Specifically, a trace device and a packet capture device are implemented as devices that support network devices.

  The trace device is a device that performs operation analysis and performance evaluation (hereinafter, operation analysis, etc.) such as debugging of software (program) of a network device (hereinafter, target device). Hereinafter, a series of operations executed in the trace apparatus will be described.

  First, the trace device collects trace information (information for grasping the execution state of a program operating on the target device) from the target device. Specifically, first, an on-chip trace mechanism (a mechanism for monitoring the execution state of a CPU (Central Processing Unit) on the target device to obtain trace information) or an external bus trace mechanism (a CPU on the target device). Trace information is acquired by a mechanism for monitoring the access sequence to the memory and using it as trace information when the program is executed. Then, the trace device receives the acquired trace information from the target device. Thereby, the trace device can collect the trace information.

  Then, the trace device adds a time stamp to the collected trace information and generates trace data. Then, from the generated trace data, trace data that matches specific conditions (for example, conditions such as the address range of the trace data, the number of occurrences of events, etc.) is selected. Then, the selected trace data is acquired (stored in the storage unit). Then, the stored trace data is analyzed. The series of operations described above are executed in the trace device.

  Next, the operation of the packet capture device will be described. The packet capture device is a device that collects packets (packets processed by a program operating on the target device) flowing on a network (a network connected to the packet capture device and the target device). Hereinafter, a series of operations executed in the packet capture device will be described.

  First, the packet capture device receives (collects) packets output (transmitted) from the target device and flowing on the network. Then, a time stamp is given to the collected packets to generate packet data. Then, from the generated packet data, packet data that matches a specific condition (for example, a condition of a protocol type and a destination address (value or range of IP address, port number, etc.)) is selected.

  Then, the selected packet data is acquired (stored in the storage unit). Then, the stored packet data is analyzed. The series of operations described above are executed in the packet capture device.

There is also known a trace data recording apparatus that manages a time stamp with a minimum amount of information and effectively uses a trace memory (for example, see Patent Document 1).
JP 2007-241431 A

  However, the above trace device can analyze the trace data but cannot analyze the packet data. That is, it is possible to grasp the execution state of a program running on the target device by analyzing the trace data and analyze the operation of the program, but analyze the packet processed by the program (for example, validity Cannot be verified). Further, the packet capture device can analyze the packet data but cannot analyze the trace data. That is, it is possible to analyze a packet processed by a program operating on the target device, but it is not possible to perform an operation analysis of the program. In this case, if the trace data and the packet data can be associated with each other, the operation analysis of the program operating on the target device and the analysis of the packet processed by the program can be performed. For this reason, there has been a demand for realizing a technique for associating trace data with packet data.

  In order to associate the trace data with the packet data, a method of manually associating is also conceivable. However, when the data amount of both the trace data and the packet data increases, the associating operation is not easy. In recent years, it has become common for trace data to have a huge amount of data on the order of gigabytes. For this reason, when the association work is performed manually, a huge number of work steps are required.

  Moreover, the above-described Patent Document 1 does not disclose a technique for associating trace data with packet data.

Further, as described above, the trace data has a data amount on the order of gigabytes (10 ⁹ ). In this case, when the trace data is acquired by the CPU operating at several hundred megahertz (100 × 10 ⁶ = 10 ⁸ ), the trace data is acquired in the order of 10 ns (1/10 ⁸ = 10 ⁻⁸ = 10 ns). Will be. Then, in the trace apparatus, trace data can be acquired continuously only for tens of seconds (10 ⁹ × 10 ⁻⁸ = 10).

On the other hand, the order in which the packet capture device acquires packet data (the timing of packet transmission / reception and the order of time required for the protocol sequence observed in combination of packet transmission / reception) is from microseconds to seconds, minutes, and hours. Or up to more hours. For example, the sequence of the protocol is advanced by human operation or an event of a device on the network that occurs intermittently, so the order of time for acquiring packet data increases.
Further, as described above, the trace device can continuously acquire trace data for only several tens of seconds. Then, even if the packet data and the trace data can be associated with each other, the trace data associated with the packet data cannot be obtained when the time order for obtaining the packet data is large (for example, an order of minutes or more). .
Therefore, even when the trace data and the packet data are easily associated and the time range in which the packet data can be acquired (minute, time order) exceeds the time range in which the trace data can be acquired (second order), There was a request to realize a technology that can acquire trace data.

  An object of the present invention is a technique capable of easily associating trace data and packet data, and acquiring trace data even when the time range in which packet data can be acquired exceeds the time range in which trace data can be acquired. Is to realize.

In order to solve the above-mentioned problem, a network system according to an embodiment of the present invention provides:
In a network system for receiving and storing trace data indicating an execution state of a target device and packet data transmitted from the target device via a network,
A time synchronizer that synchronizes the time counted by the first and second timers;
A first control unit that generates and stores a capture event by giving a time stamp indicating the time synchronized by the time synchronization unit to the packet data when the packet data is received;
A second control unit configured to add and store a time stamp indicating the time synchronized by the time synchronization unit to the trace data when the trace data is received.

The invention according to claim 2 is the network system according to claim 1,
The network system includes:
The packet data and the trace data are stored in association with each other.

The invention according to claim 3 is the network system according to claim 1 or 2,
The second controller is
The trace data is selected and stored based on a filter condition set in advance for selecting the trace data and a time stamp included in the capture event.

The invention according to claim 4 is the network system according to claim 3,
A buffer for temporarily storing the trace data;
The second controller is
The capture event is selected based on a condition for selecting the capture event included in the filter condition, a time stamp included in the selected capture event is set as a reference time, and a predetermined time before the reference time is indicated Trace data having a time stamp included in a time width from a previous time to a subsequent time indicating a predetermined time after the reference time is selected from the buffer and stored.

The invention according to claim 5 is the network system according to claim 4,
The time span from the previous time to the subsequent time is
The target device is defined based on a time width for processing one packet.

  According to the first to fifth aspects of the present invention, the packet data can be easily associated with the trace data, and the time range in which the packet data can be acquired exceeds the time range in which the trace data can be acquired. Even in this case, trace data can be acquired.

  Embodiments according to the present invention will be described below in detail with reference to the accompanying drawings. However, the scope of the invention is not limited to the illustrated examples.

  Embodiments according to the present invention will be described with reference to FIGS. First, a schematic configuration of the network system 1 according to the present embodiment will be described with reference to FIG. As shown in FIG. 1, the network system 1 includes a packet capture device 10 and a trace device 20.

The packet capture device 10 is a device that collects packets flowing on the network N (packet data before being given a time stamp). For example, when a packet is transmitted / received between the target device 30 and an external device (not shown) on the network N by a program that operates on the target device 30 (flows on the network N), the packet capture device 10 Collects packets to be processed (transmission / reception processing) by the program. The packet capture device 10 verifies the validity of the collected packets.
The trace device 20 is a device that performs operation analysis such as debugging of software (program) of the target device 30 and performance evaluation. The operation analysis of the program of the target device 30 by the trace device 20 is performed by analyzing the trace information (trace data before the time stamp is given). Here, the trace information indicates information for grasping the execution state of the program operating on the target device 30 (information indicating the instruction execution state by the CPU on the target device; for example, address, read / write data, etc.).

  Next, the internal configuration of the packet capture device 10 will be described with reference to FIG. As shown in FIG. 2, the packet capture device 10 includes a control unit 11 as a first control unit, a display unit 12, a storage unit 13, a network I / F (interface) unit 14, a communication unit 15, And a timer unit 16 as a first timer unit.

  The control unit 11 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory) (all not shown), a time synchronization unit 11A, a time stamp assigning unit 11B, a capture event generating unit 11C, The packet filtering unit 11D is configured to centrally control each unit of the packet capture device 10. The control unit 11 expands a program designated from among the system program and various application programs stored in the ROM, and executes various processes in cooperation with the program expanded in the RAM and the CPU.

  The time synchronization unit 11 </ b> A synchronizes the current time measured by the time measuring unit 27 (described later) of the trace device 20 with the current time measured by the time measuring unit 16. Specifically, the time synchronization unit 11A periodically receives (acquires) the count value (current time) measured (counted) by the time measuring unit 27 (described later) of the trace device 20 via the communication unit 15, The current time measured by the time measuring unit 16 is synchronized with the acquired current time. Thereby, the time precision time-measured by the time measuring part 16 can be made the same as the time precision (nanosecond order precision) time-measured by the time measuring part 27 of the trace device.

  When receiving the packet (packet data before the time stamp is added) from the target device 30, the time stamp adding unit 11B is synchronized with the current time measured by the time measuring unit 16 (that is, synchronized with the time synchronizing unit 11A). A time stamp indicating the current time is attached to the packet, and packet data (packet data to which the time stamp is attached) is generated.

  The capture event generation unit 11C generates packet data as a capture event. Then, the capture event generation unit 11C transmits the capture event to the trace device 20 via the communication unit 15. Here, the capture event has a time stamp and received packet information. The time stamp is a time stamp assigned by the time stamp assigning unit 11B. The received packet information is information related to the received packet (for example, information such as an IP address indicating the transmission destination and transmission source of the packet).

  The packet filtering unit 11D filters the packet data based on the capture filter conditions stored in the storage unit 13. The capture filter condition indicates a condition for capturing packet data. As the conditions of the capture filter, for example, a protocol type, a destination address (a value and a range such as an IP address and a port number), and the like are defined.

  The display unit 12 is configured by an LCD (Liquid Crystal Display) or the like, and performs screen display according to an instruction from the control unit 11.

  The storage unit 13 stores various data. The storage unit 13 stores capture filter conditions and packet data.

  The network I / F unit 14 is an interface with the target device 30 and receives a packet transmitted from the target device 30 and flowing on the network N. Then, the received packet is output to the communication unit 15.

  The communication unit 15 receives the packet output from the network I / F unit 14 and outputs the received packet to the control unit 11. The communication unit 15 transmits and receives information (capture event and current time) to and from the trace device 20.

  The timer unit 16 measures the current time. Specifically, the timer unit 16 includes a timer provided by an OS (Operating System), and measures the current time. Then, the current time measured is output to the control unit 11.

  Next, the internal configuration of the trace device 20 will be described with reference to FIG. As shown in FIG. 3, the trace device 20 includes a control unit 21 as a second control unit, a display unit 22, a storage unit 23, a trace data temporary buffer 24 as a buffer, and a trace I / F unit 25. And a communication unit 26 and a time measuring unit 27 as a second time measuring unit.

  The control unit 21 includes a CPU, ROM, RAM (all not shown), a time stamp assigning unit 21A, an event filter applying unit 21B, and a trace data narrowing unit 21C, and centrally controls each unit of the trace device 20. The control unit 21 develops a program designated from the system program and various application programs stored in the ROM in the RAM, and executes various processes in cooperation with the program expanded in the RAM and the CPU.

  When receiving the trace information (trace data before the time stamp is given) from the target device 30, the time stamp giving unit 21A gives the time stamp indicating the current time measured by the time measuring unit 27 to the trace information. Then, trace data (trace data to which a time stamp is given) is generated.

  The event filter application unit 21B filters the trace information based on the event filter conditions stored in the storage unit 23. As the event filter conditions, for example, an address range of trace data, the number of occurrences of events, and the like are defined. Trace data satisfying the event filter condition is stored in the trace data temporary buffer 24.

  The trace data narrowing unit 21C selects trace data from the trace data temporary buffer 24 based on the conditions of the trace data narrowing filter and the time stamp included in the capture event.

  Specifically, the conditions for the trace data narrowing filter include a filter, a pre-time, and a post-time. The filter indicates a condition for selecting a capture event. For example, information such as a specific destination port number is defined in the filter. In this case, the trace data narrowing-down unit 21C refers to the received packet information included in the capture event, and selects a capture event that matches the destination port number defined in the filter.

  The prior time indicates a time before a predetermined time of the time stamp (for example, a time 10 ms before the time stamp) with a time stamp included in the capture event satisfying the filter condition as a reference time. The posterior time indicates a time after a predetermined time from the time stamp (for example, a time after 500 ms from the time stamp) using the time stamp included in the capture event as a reference time.

  In addition, the time width from the previous time to the subsequent time is determined based on the time width in which the target device 30 processes (transmits / receives) one packet. Here, for example, it is assumed that the time width during which the target device 30 processes one packet is 500 ms. In this case, “500 ms” is determined as the posterior time. Also, the capture event occurrence time (the time when the packet was captured) is written in a time stamp included in the capture event. By setting the time before the predetermined time from the time stamp as the prior time, it is possible to trace the execution state of the program just before the event (capture event) occurs. Therefore, for example, “10 ms” is determined as the prior time. That is, the time span is determined from the previous time “10 ms” (10 ms before the reference time) to the subsequent time “500 ms” (500 ms after the reference time).

  Further, the pre-time and the post-time are set or changed in advance by the user in consideration of the size (storage capacity) of the trace data temporary buffer 24.

  Then, the trace data narrowing unit 21 selects, from the trace data stored in the trace data temporary buffer 24, the trace data included in the time width from the previous time to the subsequent time using the time stamp included in the capture event as the reference time. select. For example, when the above-mentioned pre-time and post-time are set and the time stamp included in the capture event is “10 o'clock”, the pre-time “9: 59: 59.99 seconds” is stored in the trace data temporary buffer 24. ”(10: 00-10 ms) to the subsequent time“ 10: 0: 0.5 ”(10: 00 + 500 ms) is selected.

  The display unit 22 is configured by an LCD or the like, and performs screen display according to an instruction from the control unit 21.

  The storage unit 23 stores various data. Specifically, the storage unit 23 stores filter conditions (corresponding to the above-described event filter conditions and trace data narrowing conditions) and trace data set in advance by the user to select trace data.

  The trace data temporary buffer 24 is constituted by, for example, a ring buffer having a finite size, and temporarily stores the trace data. When the trace data is stored in the entire storage area of the trace data temporary buffer 24, the trace data is stored from the head of the ring buffer. The size of the trace data temporary buffer 24 can be specified.

  The trace I / F unit 25 is an interface with the target device 30 and receives trace information transmitted from the target device 30. Then, the trace I / F unit 25 outputs the received trace information to the communication unit 26.

  The communication unit 26 receives the trace information output by the trace I / F unit 25 and outputs the received trace information to the control unit 21. The communication unit 26 transmits and receives information (capture event and current time) to and from the packet capture device 10.

  The timer unit 27 counts signals input from a hardware counter (not shown) to obtain the current time. Then, the current time is output to the control unit 21.

  Next, the operation of the network system 1 will be described with reference to FIGS. First, referring to FIG. 4, a packet capture process executed by the packet capture device 10 will be described. The packet capture process is a process for generating a packet data by adding a time stamp to the packet and transmitting the generated packet data to the trace device 20 as a capture event.

  It is assumed that “A address” indicating the IP address of the target device 30 is set by the user in advance as a capture filter condition, and the set “A address” is stored in the storage unit 13.

  For example, in the packet capture device 10, triggered by the start of reception of a packet transmitted from the target device 30 via the network I / F unit 14 and the communication unit 15, the packet capture device 10 is read from the ROM and appropriately expanded in the RAM. Packet capture processing is executed in cooperation with the packet capture program and the CPU.

  First, packet reception and time synchronization are performed via the network I / F unit 14 and the communication unit 15 (step S1). The packet reception operation and the time synchronization operation in this step are executed in parallel.

  After execution of step S2, a time stamp is given to the packet, and packet data is generated (step S2). Specifically, when the packet is received, the current time (ie, the current time synchronized by the time synchronization unit 11A) timed by the timekeeping unit 16 is added to the packet as a type stamp, and packet data is generated. . Then, it is determined whether or not a capture filter exists (step S3). Specifically, the storage unit 13 is referred to, and it is determined whether or not the capture filter condition is stored in the storage unit 13.

  If it is determined in step S3 that no capture filter exists (step S3; NO), the process proceeds to step S5 described later. If it is determined in step S3 that a capture filter exists (step S3; YES), it is determined whether or not a capture filter condition is satisfied for the packet data (step S4). Specifically, the generated packet data (corresponding packet data) and the capture filter condition (A address) stored in the storage unit 13 are referenced, and whether the corresponding packet data and the capture filter condition match. It is determined whether or not.

  If it is determined in step S5 that the capture filter condition is not satisfied for the packet (step S4; NO), the packet capture process is terminated. If it is determined in step S4 that the capture filter condition is satisfied for the packet (step S4; YES), the packet data is transmitted to the trace device 20 as a capture event via the communication unit 15 (step S5).

  After execution of step S5, the packet data is stored in the storage unit 13 (step S6). After execution of step S6, the packet capture process is terminated.

  Next, with reference to FIG. 5 and FIG. 6, the trace processing executed by the trace device 20 will be described. The trace process is a process of selectively acquiring trace data based on the time stamp included in the capture event and the condition of the trace data narrowing filter.

  It is assumed that the event filter condition and the trace data narrowing filter condition are set in advance by the user, and the set event filter condition and trace data narrowing filter condition are stored in the storage unit 23 in advance. Here, it is assumed that “the destination port number of address A is 80”, the pre-time “10 ms”, and the post-time “500 ms” are set as the conditions for the trace data narrowing filter. It is assumed that the time stamp included in the capture event is “10 o'clock”.

  For example, in the trace device 20, a trace program read from the ROM and appropriately expanded in the RAM triggered by the start of reception of trace information via the trace I / F unit 25 and the communication unit 26, and the CPU Trace processing is executed by cooperation.

  First, trace information is received from the target device 30 via the trace I / F unit 25 and the communication unit 26 (step S11). Then, a time stamp is given to the trace information, and trace data is generated (step S12). Specifically, when the trace information is received, the current time measured by the timer unit 27 is given as a type stamp to the trace information, and trace data is generated.

  After execution of step S12, the trace data is stored in the trace data temporary buffer 24 (step S13). Then, one trace data is referred from the trace data temporary buffer 24 (step S14). And it is discriminate | determined whether an event filter exists (step S15). Specifically, the storage unit 23 is referred to, and it is determined whether or not the event filter condition is stored in the storage unit 23.

  If it is determined in step S15 that no event filter exists (step S15; NO), the process proceeds to step S17 described later. If it is determined in step S15 that an event filter exists (step S15; YES), it is determined whether or not an event filter condition is satisfied for the trace data (step S16). Specifically, the referenced trace data (corresponding trace data) and the event filter condition stored in the storage unit 23 are referenced, and whether the referenced trace data matches the event filter condition. It is determined whether or not.

  If it is determined in step S16 that the event filter condition is not satisfied for the trace data (step S16; NO), the trace process is terminated. If it is determined in step S16 that the event filter condition is satisfied for the trace data (step S16; YES), it is determined whether or not a trace data narrowing filter exists (step S17). Specifically, it is determined whether or not the trace data narrowing filter condition exists in the storage unit 23.

  If it is determined in step S17 that there is no trace data narrowing filter (step S17; NO), the process proceeds to step S21 described later. If it is determined in step S17 that a trace data narrowing filter exists (step S17; YES), it is determined whether a capture event has been received from the packet capture device 10 (step S18).

  If it is determined in step S18 that a capture event has not been received from the packet capture device 10 (step S18; NO), the process proceeds to step S18. If it is determined in step S18 that a capture event has been received from the packet capture device 10 (step S18; YES), it is determined whether or not a trace data narrowing filter condition is satisfied for the capture event (step S19). . Specifically, whether or not the received packet information included in the capture event received from the packet capture device 10 matches the “destination port number of the A address is 80” set in the filter of the trace data narrowing filter. Determined.

  If it is determined in step S19 that the trace data narrowing filter condition is not satisfied for the capture event (step S19; NO), the trace processing is terminated. In step S19, when it is determined that the condition for the trace data narrowing filter is satisfied for the capture event (step S19; YES), the trace data within the range from the previous time to the subsequent time is determined based on the time stamp included in the capture event. Is selected (step S20). Specifically, the trace data having a time stamp within the range of the previous time “10 ms” and the subsequent time “500 ms” with the time stamp “10:00” included in the capture event as the reference time is stored in the trace data temporary buffer 24. Selected from.

  After execution of step S20, the selected trace data is stored in the storage unit 23 (step S21). In other words, the trace data associated with the packet data is stored in the storage unit 23 based on the time stamp included in the capture event. In the case of step S17; NO, the above-described corresponding trace data (trace data satisfying the condition of the event filter) is stored in the storage unit 23. After execution of step S21, the trace process is terminated.

  As described above, according to the present embodiment, trace data having a time stamp within the time width (time range) from the previous time to the subsequent time using the time stamp included in the capture event as the reference time is stored in the trace data temporary buffer 24. And the selected trace data is stored (obtained) in the storage unit 23. For this reason, the association between the packet data and the trace data can be easily performed, and the labor of the association work can be reduced. Further, the time width from the previous time to the subsequent time is determined based on the time (for example, “ms” order) in which the target device 30 processes (transmits / receives) one packet. For this reason, if trace data acquisition is repeated from the previous time to the posterior time (time range), the time range (minutes, time order) from which packet data can be acquired becomes the time range (seconds) from which trace data can be acquired. Even in the case of exceeding (order), trace data associated with packet data can be acquired.

  The description in the above embodiment is an example of the network system 1 according to the present invention, and the present invention is not limited to this.

  For example, although the packet capture device 10 and the trace device 20 have been described as separate configurations in the above embodiment, the present invention is not limited to this. For example, it may be a single device having a configuration including the packet capture device 10 and the trace device 20. In this case, a time stamp indicating the current time synchronized by the time synchronization unit 11A may be added to the packet and the trace information to generate packet data and trace data, respectively.

  Further, the packet data may be displayed on the display unit 12 of the packet capture device 10 after executing the packet capture process. At this time, the trace data related to the packet data (trace data included in the time range from the previous time to the subsequent time) may be displayed together with the packet data. In addition, after execution of the trace processing, the narrowed trace data may be displayed on the display unit 22 of the trace device 20. At this time, packet data related to the trace data (packet data having a capture event time stamp) may be displayed together.

  In addition, the detailed structure and detailed operation of the network system 1 in the present embodiment can be changed as appropriate without departing from the spirit of the present invention.

It is a figure which shows schematic structure of the network system of embodiment which concerns on this invention. It is a figure which shows the internal structure of a packet capture apparatus. It is a figure which shows the internal structure of a trace apparatus. It is a flowchart which shows the flow of a packet capture process. It is a flowchart which shows the flow of a trace process. It is a flowchart which shows the flow of a trace process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network system 10 Packet capture apparatus 11, 21 Control part 11A Time synchronization part 11B Time stamp provision part 11C Capture event generation part 11D Packet filtering part 12, 22 Display part 13, 23 Storage part 14 Network I / F part 15, 26 Communication Units 16 and 27 Timing unit 20 Trace device 21A Time stamp assigning unit 21B Event filter applying unit 21C Trace data narrowing unit 24 Trace data temporary buffer 25 Trace I / F unit 30 Target device N Network

Claims (5)

In a network system for receiving and storing trace data indicating an execution state of a target device and packet data transmitted from the target device via a network,
A time synchronizer that synchronizes the time counted by the first and second timers;
A first control unit that generates and stores a capture event by giving a time stamp indicating the time synchronized by the time synchronization unit to the packet data when the packet data is received;
A network system comprising: a second control unit that, when receiving the trace data, adds and stores a time stamp indicating the time synchronized by the time synchronization unit to the trace data. The network system includes:
The network system according to claim 1, wherein the packet data and the trace data are stored in association with each other. The second controller is
3. The network according to claim 1, wherein the trace data is selected and stored based on a filter condition set in advance for selecting the trace data and a time stamp included in the capture event. system. A buffer for temporarily storing the trace data;
The second controller is
The capture event is selected based on a condition for selecting the capture event included in the filter condition, a time stamp included in the selected capture event is set as a reference time, and a predetermined time before the reference time is indicated 4. The network system according to claim 3, wherein trace data having a time stamp included in a time width from a previous time to a subsequent time indicating a predetermined time after the reference time is selected from the buffer and stored. The time span from the previous time to the subsequent time is
5. The network system according to claim 4, wherein the target device is determined based on a time width for processing one packet.

Images