JP2012249015A - Device, method and program for fallback detection - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a time required to start fallback.SOLUTION: A packet transmitted to a second terminal from a first terminal corresponding to a plurality of protocols is monitored. When there is obtained a monitoring result indicating that a communication start message is transmitted to the second terminal for a predetermined number of times within a predetermined period using a specific protocol among a plurality of protocols, identification information to identify the second terminal which is the transmission destination of the communication start message is stored into a predetermined storage device. Fallback control is performed for the first terminal, which is the transmission source of the communication start message destined according to the identification information stored in the predetermined storage device.

Description

  The present invention relates to a fallback detection device, a fallback detection method, and a fallback detection program.

  Conventionally, there are networks that support a plurality of protocols. A terminal in a network corresponding to a plurality of protocols communicates with another terminal by using, for example, one protocol with priority. In addition, when a terminal cannot communicate with another terminal using a preferential protocol, the terminal performs communication after falling back to another protocol.

  A dual stack network corresponding to IPv4 and IPv6 will be described as an example. In this case, the terminal connected to the dual stack network communicates with other terminals using, for example, IPv6 preferentially. If the terminal cannot communicate with another terminal using IPv6, the terminal falls back to IPv4 and then attempts to communicate with the other terminal using IPv4.

  If communication cannot be established, the terminal tries to reconnect several times with the same protocol after a certain period of time. That is, the terminal cannot connect even if it tries to reconnect several times after a certain period of time, and when it times out, it performs fallback and tries to connect using another protocol.

"RFC 5461 TCP's Reaction to Soft Errors", [online], [May 10, 2011 search], Internet [online] (URL: http://tools.ietf.org/html/rfc5461)

  However, in the method described above, it takes time until the fallback is performed.

  An embodiment of the disclosure has been made in view of the above, and an object thereof is to provide a fallback detection device, a fallback detection method, and a fallback detection program that can appropriately communicate.

  In one aspect, the disclosed fallback detection apparatus includes a monitoring unit that monitors a packet transmitted to a second terminal by a first terminal corresponding to a plurality of protocols. Further, the monitoring result that the communication start message requesting the start of communication is transmitted from the first terminal to the second terminal by a specific protocol among the plurality of protocols within a predetermined period of time is the monitoring result. A storage unit that stores identification information in the protocol for identifying the second terminal, which is a transmission destination of the communication start message, in a predetermined storage device. In addition, the storage device includes a fallback control unit that controls fallback for the first terminal that is the transmission source of the communication start message whose destination is the identification information stored in the predetermined storage device.

  According to one aspect of the disclosed fallback detection device, there is an effect that communication can be appropriately performed.

FIG. 1 is a diagram illustrating an example of a system configuration including a fallback detection device according to the first embodiment. FIG. 2 is a block diagram illustrating an example of the configuration of the fallback detection apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of records stored in the communication start message table according to the first embodiment. FIG. 4 is a diagram illustrating an example of records stored in the DNS packet table according to the first embodiment. FIG. 5 is a diagram illustrating an example of records stored in the internal terminal information table according to the first embodiment. FIG. 6 is a diagram illustrating an example of records stored in the fallback table according to the first embodiment. FIG. 7 is a sequence diagram illustrating an example of a process flow until the identification information is stored in the fallback table in the first embodiment. FIG. 8 is a flowchart illustrating an example of processing performed by the fallback control unit according to the first embodiment. FIG. 9 is a diagram showing that the information processing by the control program for executing a series of processes by the fallback detection device is specifically realized using a computer.

  Hereinafter, embodiments of the disclosed fallback detection device, fallback detection method, and fallback detection program will be described in detail with reference to the drawings. Note that the invention disclosed by this embodiment is not limited. Each embodiment can be appropriately combined within a range in which processing contents do not contradict each other.

  FIG. 1 is a diagram illustrating an example of a system configuration including a fallback detection device according to the first embodiment. In the example shown in FIG. 1, in addition to the fallback detection device 200, the internal terminal 100, the router 300, and the external terminal 400 are shown together. However, the present invention is not limited to this. For example, the system including the fallback detection device 200 may include devices other than the internal terminal 100, the fallback detection device 200, the router 300, and the external terminal 400. Further, for example, the fallback detection device 200 and the router 300 may be integrated, or the router 300 may not be provided. The internal terminal 100 is also referred to as a “first terminal”. The external terminal 400 is also referred to as a “second terminal”.

  Further, in the example illustrated in FIG. 1, for convenience of explanation, a case where there is one internal terminal 100 and one external terminal 400 is shown, but the present invention is not limited to this. For example, the number of internal terminals 100 and external terminals 400 may be arbitrary.

  In the following, a description will be given using a case where the internal terminal 100, the fork back detection device 200, and the router 300 are in the dual stack network and the external terminal 400 is outside the dual stack network. It is not a thing. In a dual stack network, a plurality of protocols are mixedly used. For example, a device in a dual stack network uses both IPv4 (Internet Protocol version 4) and IPv6 (Internet Protocol version 6) protocols. In the following, a case where IPv4 and IPv6 are used in a dual stack network will be described. However, the present invention is not limited to this, and a plurality of arbitrary protocols may be used.

  The internal terminal 100 is connected to the fallback detection device 200. The internal terminal 100 is in a dual stack network and supports a plurality of protocols. For example, the internal terminal 100 has an IPv4 address and an IPv6 address, and uses IPv4 and IPv6. Hereinafter, a case where the internal terminal 100 uses IPv6 preferentially will be described as an example. In other words, the case where the internal terminal 100 uses IPv4 when communication cannot be established using IPv6 will be described as an example. However, the present invention is not limited to this, and the internal terminal 100 may use IPv4 with priority.

  The internal terminal 100 transmits a packet toward the external terminal 400. Specifically, the internal terminal 100 transmits a DNS query request that requests identification information (Query) of the external terminal 400 that is a communication destination, and receives a DNS query response that is a response to the DNS query request. For example, the internal terminal 100 transmits a DNS query request for requesting the IP address of the external terminal 400 to the router 300 and receives a DNS query response. For example, when communicating with the external terminal 400, the internal terminal 100 transmits a DNS query request for requesting an IP address in IPv4 and also transmits a DNS query request for requesting an IP address in IPv6. The DNS query response is also referred to as a DNS response (Response).

  To explain with a more detailed example, the internal terminal 100 transmits a DNS query request in which the FQDN (Fully Qualified Domain Name) of the external terminal 400 is described to the router 300, and the DNS query is sent to the DNS query. A DNS query response in which the IP address corresponding to the described FQDN is described is received.

  Further, the internal terminal 100 transmits a communication start message requesting the start of communication to the external terminal 400 using the identification information received by the DNS query response using a preset priority protocol. For example, the internal terminal 100 transmits a TCP-SYN packet with the address in IPv6 described in the DNS query response as a transmission destination. The TCP-SYN packet is a packet with a “SYN” flag and is transmitted when communication is started.

  Here, when there is no response from the external terminal 400, the internal terminal 100 repeats the transmission of the TCP-SYN packet by the same protocol a predetermined number of times. For example, when a response cannot be obtained from the external terminal 400, the internal terminal 100 repeats transmission of the TCP-SYN packet three times.

  In the following, a case where the internal terminal 100 repeats transmission of the communication start message “3” times using the same protocol will be described as an example. However, the present invention is not limited to this and may be any number of times. .

  Further, the internal terminal 100 performs a fallback if a response is not obtained from the external terminal 400 even if the communication start message is transmitted a predetermined number of times using a preset priority protocol. Then, the internal terminal 100 transmits a communication start message to the external terminal 400 using another protocol. For example, when the internal terminal 100 times out after transmitting a TCP-SYN packet three times in IPv6, the internal terminal 100 performs fallback, and in IPv4, the IP address “192.168.100.1” which is the IPv4 address in the IPv4 of the external terminal 400 A TCP-SYN packet destined for is transmitted.

  Further, the fallback by the internal terminal 100 is also controlled by the control by the fallback detection apparatus 200 as described later. For example, when the internal terminal 100 receives a message indicating fallback from the fallback detection apparatus 200, the internal terminal 100 performs fallback. The internal terminal 100 is controlled not to perform fallback by changing the identification information included in the DNS query response by the fallback detection device 200. Details will be described later.

  The router 300 is connected to the fallback detection device 200 and the external terminal 400. When receiving the DNS query request from the internal terminal 100, the router 300 transmits a DNS query response to the internal terminal 100. That is, for example, the router 300 transmits the IP address of the external terminal 400 to the internal terminal 100.

  External terminal 400 is connected to router 300. When the external terminal 400 receives the communication start message from the internal terminal 100, the external terminal 400 communicates with the internal terminal 100. Note that the communication start message transmitted by the internal terminal 100 may be received by the external terminal 400 or may not be received. For example, when the internal terminal 100 transmits a communication start message using a protocol that the external terminal 400 does not support, the external terminal 400 does not receive it.

  In the following description, for convenience of explanation, the case where the IPv4 address of the internal terminal 100 is “192.168.1.10/32” and the IPv6 address is “2001: db8: 1 :: 100/128” will be described. Further, the case where the IPv4 address of the external terminal 400 is “192.168.100.1/32”, the IPv6 address is “2001: db8: 2 :: 1/128”, and the FQDN is “www.example.com”. It explains using. However, the present invention is not limited to this, and an arbitrary IP address or FQDN may be used.

  The fallback detection apparatus 200 will be described. The fallback detection apparatus 200 monitors packets transmitted toward the external terminal 400 by the internal terminal 100 corresponding to a plurality of protocols, as will be described in detail below. In addition, the fallback detection apparatus 200 receives the communication start message when the communication start message is transmitted from the internal terminal 100 to the external terminal 400 a predetermined number of times using a specific protocol among a plurality of protocols. Identification information for identifying the external terminal 400 as a transmission destination is stored in a predetermined storage device. Further, the fallback detection device 200 controls the fallback in the internal terminal 100 by transmitting a predetermined message based on the identification information stored in the predetermined storage device.

  That is, the fallback detection apparatus 200 generates, for example, an address list of the external terminal 400 that is to fall back, and thereafter, a communication start message to an address described in the generated address list is transmitted by the internal terminal 100. Then, control is performed so that the internal terminal 100 immediately performs fallback. Further, the fallback detection apparatus 200 considers that a fallback “occurs” when a predetermined number of communication start messages are received with a specific protocol within a predetermined period, and generates an address list. More specifically, the fallback detection apparatus 200 receives the Nth communication start message with a specific protocol within a predetermined period A, and then within a predetermined period B (A and B may be the same or different). When a communication start message is received by another protocol, an address list is generated assuming that a fallback has occurred. Note that the predetermined period A and the predetermined period B described above may be the same period or different periods.

  FIG. 2 is a block diagram illustrating an example of the configuration of the fallback detection apparatus according to the first embodiment. As shown in FIG. 2, the fallback detection apparatus 200 includes a storage unit 210 and a control unit 220.

  The storage unit 210 is connected to the control unit 220. The storage unit 210 stores data used for various processes performed by the control unit 220. The storage unit 210 is, for example, a semiconductor memory device such as a random access memory (RAM), a read only memory (ROM), or a flash memory, a hard disk, an optical disk, or the like. In the example illustrated in FIG. 2, the storage unit 210 includes a communication start message table 211, a DNS packet table 212, an internal terminal information table 213, and a fallback table 214.

  The communication start message table 211 stores information about the communication start message transmitted by the internal terminal 100. For example, the communication start message table 211 stores a record including a transmission source address, a destination address, and a monitoring time for a TCP-SYN packet transmitted by the internal terminal 100. The monitoring time indicates, for example, the time when the TCP-SYN packet is detected by the fallback detection device 200.

  FIG. 3 is a diagram illustrating an example of records stored in the communication start message table according to the first embodiment. In the example illustrated in FIG. 3, the communication start message table 211 includes a transmission source address “2001: db8: 1 :: 100/128”, a destination address “2001: db8: 2 :: 1/128”, and a monitoring time “12: Records including “00” are stored. In other words, the communication start message table 211 indicates that the TCP-SYN packet transmitted from “2001: db8: 1 :: 100/128” to “2001: db8: 2 :: 1/128” at “12:00”. It is memorized that was detected. Information stored in the communication start message table 211 is stored and used by the control unit 220 described later.

  The DNS packet table 212 stores identification information included in a DNS query request and a DNS query response. FIG. 4 is a diagram illustrating an example of records stored in the DNS packet table according to the first embodiment. In the example illustrated in FIG. 4, the DNS packet table 212 stores a record including “FQDN”, “IPv4 address”, and “IPv6 address”.

  In the example illustrated in FIG. 4, the DNS packet table 212 includes a record including an FQDN “www.example.com”, an IPv4 address “192.168.100.1/32”, and an IPv6 address “2001: db8: 2 :: 1/128”. Remember. The record stored in the DNS packet table 212 is stored and used by the control unit 220 described later. Specifically, the DNS packet table 212 is associated with the FQDN included in the DNS query request transmitted / received by the internal terminal 100 and the IPv4 address or IPv6 address included in the DNS query response, and then is controlled by the control unit 220. Stored as a record.

  The internal terminal information table 213 stores identification information for identifying the internal terminal 100. Specifically, the internal terminal 100 stores each identification information indicating the internal terminal 100 for each protocol used by the internal terminal 100. The internal terminal information table 213 stores the identification information of the internal terminal 100 in association with each other in advance, so that the control unit 220 can easily determine whether the communication start message is transmitted from the same internal terminal 100. It becomes possible to grasp.

  FIG. 5 is a diagram illustrating an example of records stored in the internal terminal information table according to the first embodiment. In the example illustrated in FIG. 5, the internal terminal information table 213 stores a record including “IPv4 address” and “IPv6 address” of the internal terminal 100. For example, the internal terminal information table 213 stores a record including an IPv4 address “192.168.1.10/32” and an IPv6 address “2001: db8: 1 :: 100/128”.

  Further, when there are a plurality of internal terminals 100, the internal terminal information table 213 stores a record for each of the plurality of internal terminals 100. Records stored in the internal terminal information table 213 are stored in advance by the user, for example.

  The fallback table 214 stores identification information of the external terminal 400 as a processing result by the control unit 220. Specifically, the fallback table 214 stores identification information indicating a communication destination with which the internal terminal 100 could not establish communication among identification information indicating the external terminal 400 that is the communication destination of the internal terminal 100. That is, the fallback table 214 stores identification information that is used when establishing communication by the internal terminal 100 and that identifies a communication destination that has failed to establish communication. In other words, the fallback table 214 stores identification information that causes the internal terminal 100 to fall back when communication is attempted. The fallback table 214 is also referred to as “predetermined storage device”. In other words, when the communication start message is transmitted a predetermined number of times from the same internal terminal 100 to the same external terminal 400 using the same protocol, the fallback table 214 identifies the external terminal that is the transmission destination in the protocol concerned. Store information.

  FIG. 6 is a diagram illustrating an example of records stored in the fallback table according to the first embodiment. In the example illustrated in FIG. 6, the fallback table 214 stores “2001: db8: 2 :: 1/128”. That is, the fallback table 214 stores that when the internal terminal 100 transmits a communication start message toward “2001: db8: 2 :: 1/128”, a fallback is performed. That is, the fallback table 214 stores that communication is not established when the internal terminal 100 transmits a communication start message toward “2001: db8: 2 :: 1/128”.

  The control unit 220 is connected to the storage unit 210. The control unit 220 includes an internal memory that stores a program that defines various processing procedures and the like, and controls various processes. The control unit 220 is an electronic circuit such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a central processing unit (CPU), or a micro processing unit (MPU). In the example illustrated in FIG. 2, the control unit 220 includes a monitoring unit 221, a storage unit 222, and a fallback control unit 223.

  The monitoring unit 221 monitors packets transmitted toward the external terminal 400 by the internal terminal 100 corresponding to a plurality of protocols. Specifically, the monitoring unit 221 monitors information transmitted and received by the internal terminal 100 by relaying communication performed by the internal terminal 100. More specifically, the monitoring unit 221 monitors a communication start message, a DNS query request, and a DNS query response among packets transmitted and received by the internal terminal 100. Further, the monitoring unit 221 outputs the monitoring result to the storage unit 222 and the fallback control unit 223.

  For example, the monitoring unit 221 monitors a TCP-SYN packet, a DNS query request, and a DNS query response among communication packets from the internal terminal 100 to the external terminal 400 in the dual stack network.

  A more detailed example will be described. The monitoring unit 221 captures a packet transmitted / received by the internal terminal 100 and determines whether it is a DNS query request, a DNS query response, or a TCP-SYN packet. Here, when the monitoring unit 221 determines that the fetched packet is a DNS query request or a DNS query response, the monitoring unit 221 associates the DNS, the FQDN, the IPv4 address, and the IPv6 address included in the DNS query request or the DNS query response with each other. Store in the packet table 212. If the monitoring unit 221 determines that the captured packet is a TCP-SYN packet, the communication start message table 211 associates the source address, the destination address, and the monitoring time of the captured TCP-SYN packet with each other. To store.

  For example, the monitoring unit 221 takes in a DNS query request and a DNS query response, and the FQDN “www.example.com”, the IPv4 address “192.168.100.1”, and the IPv6 address “2001: db8: 2” of the external terminal 400 serving as a communication destination. :: 1 ”is acquired and stored in the DNS packet table 212 in association with each other. Further, for example, the monitoring unit 221 takes in the TCP-SYN packet, transmits the source address “2001: db8: 1 :: 100/128”, the destination address “2001: db8: 2 :: 1/128”, and the monitoring time “ 12:02 ”is stored in the communication start message table 211.

  When the monitoring unit 221 stores a new record in the communication start message table 211, the monitoring unit 221 determines whether a predetermined number of records having the same source address and destination address are stored within a predetermined time, and stores the predetermined number. If it is determined that it is stored, the record determined to be stored is output to the storage unit 222. That is, the monitoring unit 221 determines whether or not the communication start message is transmitted from the same internal terminal 100 to the same external terminal 400 by the same protocol a predetermined number of times. In other words, the monitoring unit 221 determines whether the communication start message has been transmitted from the same internal terminal 100 to the external terminal 400 a predetermined number of times using a specific protocol among a plurality of protocols.

  An example will be described with reference to FIG. Here, the process when the record whose monitoring time is “12:02” is stored will be described as an example. Further, the case where the monitoring unit 221 uses “3” as the predetermined time will be described as an example. Further, the case where the monitoring unit 221 uses “5 minutes” as the fixed time will be described. In this case, the monitoring unit 221 records the source address “2001: db8: 1 :: 100/128”, the destination address “2001: db8: 2 :: 1/128”, and the monitoring time “12:02”. Is stored in the communication start message table 211, the destination address “2001: db8: 2 :: 1/128”, “source address“ 2001: db8: 1 :: 100/128 ””, and monitoring time “12:00” It is determined whether there are three or more records whose monitoring time is within “5 minutes” from “12:02”. In the example illustrated in FIG. 3, since there are three records, the monitoring unit 221 determines that there are, for example, the transmission source address “2001: db8: 1 :: 100/128” and the destination address “2001: db8: 2”. The record including :: 1/128 ”and the monitoring time“ 12:02 ”is output to the storage unit 222. In the above description, the example in which the record including the monitoring time is output has been described. However, the present invention is not limited to this, and the monitoring time may not be included.

  In the above description, the case where the monitoring unit 221 uses “3” as the predetermined number of times has been described as an example. However, the present invention is not limited to this, and an arbitrary number may be used. In the above description, the case where the monitoring unit 221 uses “5 minutes” as the fixed time has been described. However, the present invention is not limited to this, and an arbitrary time may be used. In the above description, the monitoring unit 221 exemplifies a case where, when records are stored in the communication start message table 211, it is determined whether there are a predetermined number of records having the same transmission source address and destination address. However, the present invention is not limited to this, and determination may be made at an arbitrary timing.

  In the following description, the monitoring unit 221 determines whether or not the communication start message has been transmitted a predetermined number of times, and when it is determined that the message has been transmitted, the case where the record is output to the storage unit 222 will be described. Is not to be done. For example, the monitoring unit 221 may not determine whether the communication start message has been transmitted a predetermined number of times. In this case, for example, the storage unit 222 described later determines based on the communication start message table 211.

  The storage unit 222 becomes a transmission destination of the communication start message when the monitoring unit 221 obtains a monitoring result that the communication start message requesting the start of communication is transmitted from the internal terminal 100 to the external terminal 400 a predetermined number of times. Identification information for identifying the external terminal 400 is stored in the fallback table 214. For example, the storage unit 222 stores the destination address included in the record output by the monitoring unit 221 in the fallback table 214. In the example illustrated in FIG. 3, the storage unit 222 stores the destination address “2001: db8: 2 :: 1/128” in the fallback table 214.

  That is, when the storage unit 222 detects a communication start message with the same protocol for the same destination address from the same source address a predetermined number of times within a certain time, the storage unit 222 considers that a fallback occurs in the internal terminal 100 and sets the destination address. Store in the fallback table 214. In other words, when the monitoring unit 221 detects that a communication start message has been transmitted from the internal terminal 100 to the external terminal 400 a predetermined number of times using a specific protocol among a plurality of protocols, the monitoring unit 221 considers that a fallback has occurred, Is stored in the fallback table 214. That is, the storage unit 222 stores identification information indicating the external terminal 400 that has triggered the fallback table 214.

  In addition, the storage unit 222 stores the communication start message after the monitoring result is obtained by the monitoring unit 221 that the communication start message is transmitted from the same internal terminal 100 to the same external terminal 400 by the same protocol. The identification information may be stored in the fallback table 214 only when a communication start message is transmitted to the same external terminal 400 using a protocol different from the protocol used for transmission. Note that the destination address stored by the storage unit 222 is not the identification information in another protocol but the destination address in the protocol transmitted a predetermined number of times.

  For example, when the storage unit 222 further detects that a TCP-SYN packet is transmitted in IPv4 after a TCP-SYN packet for the same destination address has been transmitted a predetermined number of times in IPv6 from the same source address For the first time, the destination address indicating the external terminal 400 in IPv6 may be stored in the fallback table 214.

  This will be described using a detailed example. The storage unit 222 acquires a record including the FQDN corresponding to the destination address included in the record received from the monitoring unit 221 from the DNS packet table 212. Then, the storage unit 222 acquires an IP address for a protocol different from the protocol of the TCP-SYN packet detected by the monitoring unit 221 a predetermined number of times among the IP addresses included in the acquired record. For example, in the example illustrated in FIG. 3, a TCP-SYN packet in IPv6 is detected, and the storage unit 222 acquires an IP address in IPv4. Then, the storage unit 222 searches the communication start message table 211 to obtain IPv4 addressed to the acquired IP address within a certain period of time after the monitoring unit 221 detects a predetermined number of TCP-SYN packets. The presence or absence of a TCP-SYN packet transmitted in this way is determined. That is, after the communication start message is transmitted a predetermined number of times from the same transmission source to the same destination within a certain time in IPv6, the storage unit 222 sends a communication start message to the same destination in IPv4 within a certain time. Determine if it has been sent. If the storage unit 222 determines that a fallback has occurred, it stores the IPv6 destination address included in the record received from the monitoring unit 221 in the fallback table 214.

  As described above, when the storage unit 222 further determines whether the communication start message is transmitted to the same external terminal 400 using a protocol different from the protocol used for transmitting the communication start message, a fallback occurs. Therefore, it is possible to improve the accuracy of detecting the occurrence of fallback.

  That is, as a result of not limiting the internal terminal 100 that transmits the communication start message to the same external terminal 400 using another protocol, in other words, the internal terminal 100 different from the internal terminal 100 that transmitted the communication start message using the first protocol. Even if a communication start message is transmitted, it can be detected as a fallback.

  For example, a communication start message is first transmitted from the same internal terminal 100 to the same external terminal 400 by IPv6 three times, and then a communication start message is transmitted from another internal terminal 100 to the same external terminal 400 by IPv4. Even in this case, it can be detected as a fallback.

  In this case, even if the communication is established by the third communication start message in the first IPv6, it is regarded as a fallback, but the probability that the communication will be established after the third time is low. It becomes effective. In addition, the fallback detection apparatus 200 does not store information about the correspondence between the identification information of the predetermined protocol of the internal terminal 100 and the identification information of another protocol (IPv6 address and IPv4 address) or an unknown situation Even so, fallback can be detected.

  Further, the storage unit 222 may store the identification information in the fallback table 214 only when a communication start message is transmitted from the same transmission source to the same destination using a different protocol. Specifically, the storage unit 222 uses the protocol used for transmitting the communication start message after the monitoring unit 221 obtains a monitoring result that the communication start message has been transmitted from the internal terminal 100 to the external terminal 400 a predetermined number of times. The identification information is stored in the storage unit 210 only when the monitoring unit 221 obtains a monitoring result that the communication start message is transmitted from the same internal terminal 100 to the same external terminal 400 using a different protocol. You may do it. Note that the destination address stored by the storage unit 222 is a destination address in a protocol transmitted a predetermined number of times before being transmitted in another protocol. In this case, the fallback can be detected with higher accuracy than in the case where the internal terminal 100 is not questioned.

  In this case, the storage unit 222 further acquires a source address of another protocol corresponding to the source address included in the record received from the monitoring unit 221 from the internal terminal information table 213. For example, when the internal terminal 100 transmits a TCP-SYN packet in IPv6, the storage unit 222 uses the IPv4 IP address associated with the IPv6 IP address included in the record received from the monitoring unit 221. Is acquired from the internal terminal information table 213. Then, the storage unit 222 searches the communication start message table 211 to search for IPv4 addressed to the same external terminal 400 within a certain time after the monitoring unit 221 detects a predetermined number of TCP-SYN packets. It is determined whether or not there is a TCP-SYN packet that is transmitted from the internal terminal information table 213 and has an IPv4 IP address acquired from the internal terminal information table 213 as a transmission source address. If the storage unit 222 determines that there is a fallback, the storage unit 222 determines that a fallback has occurred, and stores the destination address included in the record received from the monitoring unit 221 in the fallback table 214.

  The fallback control unit 223 controls fallback for the internal terminal 100 that is the transmission source of the communication start message whose destination is the identification information stored in the fallback table 214 by the storage unit 222.

  Specifically, the fallback control unit 223 transmits a communication start message requesting the start of communication with the second terminal identified by the IP address stored in the fallback table 214 using the protocol of the IP address. In the case of being performed, a message for causing the internal terminal 100 to fall back is transmitted to the internal terminal 100. In other words, the fallback control unit 223 determines whether the destination of the communication start message transmitted by the internal terminal 100 matches the identification information stored in the fallback table. Send a message to make 100 fall back.

  For example, the fallback control unit 223 constantly monitors a TCP-SYN packet among communication packets from the internal terminal 100 to the external terminal 400 in the dual stack network, and stores the destination address of the TCP-SYN packet in the fallback table 214. It is determined whether it is done. When the fallback control unit 223 determines that the packet is stored, the fallback control unit 223 transmits a TCP-RST packet, which is a TCP packet in which the RST flag is set, to the internal terminal 100 that is the transmission source of the TCP-SYN packet. To do. Note that the fallback control unit 223 acquires an IP address indicating a transmission source and TCP session information from the TCP-SYN packet, and generates a TCP-RST packet based on the acquired information. For example, in the TCP-RST, the fallback control unit 223 uses the destination address of the TCP-RST packet as the source address, the source port of the TCP-RST packet as the destination port, and the destination port of the TCP-RST packet as the source Port.

  That is, when the communication start message is transmitted by the internal terminal 100 to the transmission destination of communication regarded as fallback, the fallback control unit 223 transmits a message to the internal terminal 100 serving as a transmission source, thereby requesting a communication request. Even if communication is not established, the internal terminal 100 that attempts a communication request to a destination that falls back will be fallback. As a result, for example, communication NG can be performed without waiting for the timeout of the internal terminal 100.

  After that, the internal terminal 100 that receives the TCP-RST packet transmits a communication start message to the external terminal 400 after performing fallback.

  In the above description, the case where the fallback control unit 223 transmits a TCP-RST packet has been described as an example. However, the present invention is not limited to this, and an arbitrary packet may be output as a message. For example, the fallback control unit 223 transmits an ICMP (Internet Control Message Protocol) (v6) packet to indicate that the address of the external terminal 400 that is the transmission destination of the TCP-SYN packet cannot be reached. The terminal 100 may be notified. For example, an ICMP packet describing “destination unreachable” may be transmitted.

[Process to store identification information]
FIG. 7 is a sequence diagram illustrating an example of a process flow until the identification information is stored in the fallback table in the first embodiment. In the following, description will be given using a case where the internal terminal 100 whose IPv4 address is “192.168.1.10/32” and whose IPv6 address is “2001: db8: 1 :: 100/128” transmits a communication start message. . In the following, the external terminal 400 whose IPv4 address is “192.168.100.1/32”, IPv6 address is “2001: db8: 2 :: 1/128”, and FQDN is “www.example.com”. A case where the internal terminal 100 transmits a communication start message will be described.

  In the following description, the fallback detection apparatus 200 detects that an IPv4 TCP-SYN packet is transmitted from the same internal terminal 100 to the same destination after detecting the IPv6 TCP-SYN packet three times. Thus, a case where it is considered that a fallback has occurred will be described as an example. Hereinafter, a description will be given using a case where a response cannot be obtained from the external terminal 400 even if the internal terminal 100 transmits a TCP-SYN packet using IPv6.

  As illustrated in FIG. 7, the internal terminal 100 acquires the IP address of the external terminal 400 by transmitting a DNS query that is the FQDN of the external terminal 400 and receiving a DNS query response to the DNS query request (step S101). ). In other words, the internal terminal 100 performs TCP communication with the external terminal 400 that becomes the FQDN “ww.example.com”, and therefore, the router 300 performs name resolution of the external terminal 400 with both IPv4 and IPv6.

  For example, the internal terminal 100 transmits a DNS query for acquiring an IPv4 IP address corresponding to the FQDN “www.example.com” to the router 300 (step S1011). Further, for example, the internal terminal 100 transmits a DNS query for acquiring an IPv6 IP address corresponding to the FQDN “www.example.com” to the router 300 (step S1012). Thereafter, the internal terminal 100 receives from the router 300 a DNS query response describing the IPv4 IP address “192.168.100.1” corresponding to the FQDN “www.example.com” (step S1013). Further, the internal terminal 100 receives a DNS query response describing the IPv6 IP address “2001: db8: 2 :: 1/128” corresponding to the FQDN “www.example.com” from the router 300 (step S1014). ).

  Here, the monitoring unit 221 of the fallback detection apparatus 200 monitors the DNS packet transmitted / received by the internal terminal 100, whereby the FQDN “www.example.com” and the IPv4 address “192.168” of the external terminal 400 that is the communication destination. .100.1 ”and the IPv6 address“ 2001: db8: 2 :: 1/128 ”are acquired, stored in the DNS packet table 212 in association with each other (step S102).

  That is, the monitoring unit 221 monitors the DNS packet, and the FQDN “www.example.com” has two IP addresses “192.168.100.1” and “2001: db8: 1 :: 100/128”. The information that it has is stored in the DNS packet table 212.

  Specifically, the monitoring unit 221 captures a packet transmitted and received by the internal terminal 100 and determines whether it is a DNS query request, a DNS query response, or a TCP-SYN packet. When the monitoring unit 221 determines in step S102 that the request is a DNS query request or DNS query response, the FQDN, IPv4 address, and IPv6 address included in the DNS query request or DNS query response are associated and stored in the DNS packet table 212. .

  After that, the internal terminal 100 transmits a TCP-SYN packet to the IPv6 address “2001: db8: 2 :: 1/128” of the external terminal 400 in order to perform TCP communication with the external terminal 400 using IPv6 (Step 1). S103). Here, as a result of not receiving a response from the external terminal 400, the internal terminal 100 times out after transmitting the TCP-SYN packet three times.

  For example, the internal terminal 100 transmits the first TCP-SYN packet whose destination is “2001: db8: 2 :: 1/128” (step S1031), and the destination is “2001: db8: 2 :: 1/1 /”. A second TCP-SYN packet “128” is transmitted (step S1032), and a third TCP-SYN packet whose destination is “2001: db8: 2 :: 1/128” is transmitted (step S1033). Here, the source address of the TCP-SYN packet transmitted by the internal terminal 100 is “2001: db8: 1 :: 100/128”.

  Here, the monitoring unit 221 of the fallback detection apparatus 200 monitors the TCP-SYN packet transmitted by the internal terminal 100, thereby the IPv6 address “2001: db8: 2 :: 1 /” transmitted by the internal terminal 100. A record including a transmission source address, a destination address, and a monitoring time for a TCP-SYN packet destined for “128” is stored in the communication start message table 211 (step S104). At this time, for example, when the monitoring unit 221 stores a new record in the communication start message table 211, the monitoring unit 221 determines whether a predetermined number of records having the same source address and destination address are stored within a predetermined time. If it is determined that the predetermined number is stored, the record determined to be stored is output to the storage unit 222.

  The internal terminal 100 then transmits a TCP-SYN packet destined for the IPv4 address “192.168.100.1/32” of the external terminal 400 in order to perform TCP communication with IPv4 as a result of the time-out of the IPv6 TCP communication (step). S105). Here, the source address of the TCP-SYN packet transmitted by the internal terminal 100 is “2001: db8: 1 :: 100/128”.

  Here, after a monitoring result that the communication start message has been transmitted from the internal terminal 100 to the external terminal 400 a predetermined number of times is obtained by the monitoring unit 221, a protocol different from the protocol used for transmitting the communication start message is used. Since the communication start message is transmitted to the same external terminal 400, the storage unit 222 of the fallback detection apparatus 200 considers that a fallback has occurred, and sets the destination address included in the record output by the monitoring unit 221 to the fallback table 214. (Step S106). For example, the storage unit 222 stores the destination address “2001: db8: 2 :: 1/128” in the fallback table 214.

  In addition, said process procedure is not limited to said order, You may change suitably in the range which does not contradict a process content.

[Processing by fallback control unit]
FIG. 8 is a flowchart illustrating an example of processing performed by the fallback control unit according to the first embodiment.

  As illustrated in FIG. 8, the fallback control unit 223 determines whether the destination of the communication start message transmitted by the internal terminal 100 matches the identification information stored in the fallback table 214 (step S201). Here, if the fallback control unit 223 determines that they match (Yes at Step S201), the fallback control unit 223 generates a message for causing the internal terminal 100 to fall back (Step S202). For example, the fallback control unit 223 generates a TCP-RST packet.

  Then, the fallback control unit 223 transmits to the internal terminal 100 (step S203). As a result, the internal terminal 100 does not repeat transmission of the communication start message using a protocol in which communication is not established, but immediately falls back.

  On the other hand, if the fallback control unit 223 determines that they do not match (No in step S201), the process ends. After that, the fallback control unit 223 transfers the captured communication start message to the external terminal 400 as it is.

[Effect of Example 1]
As described above, according to the first embodiment, packets transmitted from the internal terminal 100 to the external terminal 400 are monitored. In addition, when a monitoring result indicating that a specific protocol among a plurality of communication start messages has been transmitted to the external terminal 400 a predetermined number of times within a predetermined period is obtained, the external terminal 400 that is a transmission destination of the communication start message Is stored in the fallback table 214. Further, the fallback is controlled for the internal terminal 100 that is the transmission source of the communication start message whose destination is the identification information stored in the fallback table 224. As a result, the time required for establishing communication can be shortened. For example, the time until the fallback is performed can be shortened, and communication can be appropriately performed.

  In other words, according to the first embodiment, for example, the occurrence of fallback is estimated by monitoring the TCP-SYN packet used when the internal terminal 100 performs TCP communication. That is, in the first embodiment, it is detected that the connection to the destination using either protocol (IPv4 or IPv6) is not possible. In addition, the internal terminal 100 quickly falls back by monitoring subsequent communication and performing specific processing for the destination for which fallback is detected. The specific process corresponds to, for example, sending a TCP-RST packet to the internal terminal 100 or sending an ICMP error.

  In other words, if it is regarded as fallback, an address list of the external terminal 400 that cannot establish communication is generated and stored, and a process for forcibly falling back the internal terminal 100 based on the generated address list is performed. Do. That is, the internal terminal 100 that first accesses the external terminal 400 that is not in the list is likely to fall back often, but by listing this experience, the same or This can be handled when another internal terminal 100 tries to access the external terminal 400 using the same protocol.

  As a result, for example, by detecting a fallback of TCP communication of a terminal in a specific dual stack network environment, communication using IPv4 or IPv6 cannot be performed from a terminal in the specific dual stack network to a specific destination. Can be detected. Also, for example, when the TCP communication of the terminal in the subsequent network tries to communicate using a protocol (IPv4 or IPv6) incapable of communicating with a specific destination based on the detected information, the communication is forcibly performed. It is possible to communicate quickly by falling back to a possible protocol.

  Further, according to the first embodiment, the storage unit 222 performs communication after the monitoring result is obtained by the monitoring unit 221 that the communication start message is transmitted from the internal terminal 100 to the external terminal 400 by a specific protocol a predetermined number of times. When the monitoring unit 221 obtains a monitoring result that the communication start message is transmitted to the external terminal 400 using a protocol different from the specific protocol used for transmitting the start message, the identification information is stored in the storage unit 210. Store. That is, for example, after observing a predetermined number of communication start messages in IPv6 and confirming the communication start message to the same external terminal 400 in IPv4, the source of the communication start message transmitted in IPv4 is the same internal A fallback is detected without worrying about whether the terminal 100 is used. As a result, when a communication start message is transmitted to the external terminal 400 using a protocol different from the specific protocol, the fallback can be detected with high accuracy by detecting the fallback.

  Further, according to the first embodiment, the storage unit 222 receives the communication start message after the monitoring unit 221 obtains the monitoring result that the communication start message is transmitted from the internal terminal 100 to the external terminal 400 by the protocol a predetermined number of times. When the monitoring unit 221 obtains a monitoring result that the communication start message is transmitted from the internal terminal 100 to the external terminal 400 using a protocol different from the protocol used for the transmission of the identification information, the storage unit 210 stores the identification information. To store. That is, for example, after observing a predetermined number of communication start messages in IPv6 and then confirming the communication start message to the same external terminal 400 in IPv4, it is transmitted in IPv6 and IPv4 by using internal terminal information. It is possible to detect the occurrence of fallback with high accuracy by detecting whether the communication start message is transmitted from the same internal terminal 100 and then detecting the fallback.

  Further, according to the first embodiment, the fallback control unit 223 receives a communication start message for requesting to start communication with the external terminal 400 identified by the identification information stored in the storage unit 210 using the protocol of the identification information. When the monitoring result is transmitted, a message for causing the internal terminal 100 to fall back is transmitted to the internal terminal 100 that is the transmission source of the communication start message. As a result, it is possible to cause the internal terminal 100 to quickly fall back.

  Further, according to the first embodiment, the internal terminal 100 is a terminal connected in a dual stack network corresponding to a plurality of protocols, and the internal terminal 100 is a terminal connected outside the dual stack network. As a result, the internal terminal 100 connected in the dual stack network can be quickly fallback when attempting to establish communication using a protocol that cannot establish communication.

  As a result, in a closed network, it is a situation where it is not known in advance which terminal can communicate with a packet for a wide area network and which terminal cannot communicate with a packet for a wide area network. Also, as a result of the storage unit 222 storing the identification information in the fallback table 214 and accumulating it, it becomes possible to cope with it.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in other embodiments besides the above-described embodiments. Therefore, other embodiments will be described below.

[Fallback control unit]
For example, when the monitoring unit 221 obtains the monitoring result that the DNS query response including the identification information stored in the storage unit 210 is obtained, the fallback control unit 223 displays the identification information included in the DNS query response. You may delete and transmit to the internal terminal 100. FIG. Similarly, the fallback control unit 223 includes identification information when the monitoring unit 221 obtains a monitoring result indicating that a DNS query request for requesting identification information stored in the fallback table 214 is obtained. A DNS query response not generated may be generated and transmitted to the internal terminal 100.

  That is, the storage unit 222 associates the identification information of the external terminal 400 described in the DNS query response with the identification information used when the internal terminal 100 performs communication of the external terminal 400 that will fall back. Remember. For example, the storage unit 222 stores the IP address in the fallback table 214 in association with the URL or FQDN of the external terminal 400. In addition, when the monitoring unit 221 obtains a monitoring result that the DNS query request for requesting the IP address for the URL or the FQDN stored in the fallback control unit 223 is obtained, the fallback control unit 223 receives the DNS query request. The IP address stored in the fallback table 214 is not transmitted to the internal terminal 100 in the DNS query response.

  For example, the fallback control unit 223 may generate a DNS query response in which the no error flag is set and Answers is emptied, or may generate a DNS query response in which the nxdomain flag is set. Further, for example, the fallback control unit 223 may not return a DNS query response to the internal terminal 100. As a result, the internal terminal 100 is not notified of the IP address of the external terminal 400 that will fall back, and fallback in the internal terminal 100 can be prevented.

  For example, when communicating with the external terminal 400, the internal terminal 100 transmits a DNS query request for requesting an IP address in IPv4 and also transmits a DNS query request for requesting an IP address in IPv6. Here, the case where the IPv6 IP address of the external terminal 400 is stored in the fallback table 214 will be described. In other words, a description will be given using a case where the internal terminal 100 performs fallback when attempting to communicate with the external terminal 400 using IPv6. In this case, the DNS query request for which the IPv6 of the external terminal 400 is requested matches the IP address stored in the fallback table 214, so that the fallback control unit 223 sends a DNS query response to the internal terminal 100. Does not return, or generates and returns a DNS query response with the nxdomain flag set. On the other hand, the fallback control unit 223 returns the DNS query request for which the IPv4 of the external terminal 400 is requested, because it does not match the IP address stored in the fallback table 214. As a result, the internal terminal 100 tries to communicate with the external terminal 400 using IPv4 from the beginning instead of IPv6. As a result, it is possible to prevent the internal terminal 100 from causing a fallback. That is, in the first place, it is possible to prevent the fallback from occurring in the internal terminal 100.

  In the above description, the case where the fallback control unit 223 processes a DNS query response or a DNS query request is described as an example, but the present invention is not limited to this. For example, the router 300 may refer to the fallback table 214 of the fallback detection apparatus 200 and then transmit a DNS query response that prevents acquisition of an IP address where the fallback occurs.

[Fallback]
Further, for example, in the above-described embodiment, the case where the internal terminal 100 falls back from IPv6 to IPv4 has been described as an example. However, the present invention is not limited to this, and may fall back from IPv4 to IPv6. You may fall back from any protocol to another protocol.

[Fallback control unit]
Further, the fallback control unit 223 may perform the process immediately after the storage unit 222 stores the identification information in the fallback table 214. For example, a TCP-RST packet may be transmitted to the internal terminal 100 serving as a transmission source whose identification information is stored by the storage unit 222.

  Further, for example, the fallback control unit 223 sends a message to the internal terminal 100 to immediately perform fallback when the internal terminal 100 confirms the transmission of the “predetermined number of times” communication start message. May be sent.

[Fallback table]
Further, for example, in addition to the identification information indicating the external terminal 400 that is the communication destination, the identification information indicating the internal terminal 100 that is the transmission source may be further stored in the fallback table 214. In this case, the fallback control unit 223 matches the combination of the identification information indicating the external terminal 400 and the identification information indicating the internal terminal 100 stored in the fallback table 214 with the communication start message transmitted by the internal terminal 100. In this case, a TCP-RST packet may be transmitted.

[System configuration]
Also, among the processes described in this embodiment, all or a part of the processes described as being automatically performed can be manually performed, or the processes described as being performed manually can be performed. All or one part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-mentioned document and drawings (FIGS. 1 to 8) are arbitrarily changed unless otherwise specified. be able to.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part of the distribution / integration may be functionally or physically distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the fallback detection device 200 and the router 300 may be integrated into one device, or the fallback table 214 may be connected to the fallback detection device 200 via a network as an external device.

  Further, for example, a device that detects the occurrence of fallback and stores identification information in the fallback table 214 is different from a device that controls fallback in the internal terminal 100 based on the information stored in the fallback table 214. It may be a device. That is, for example, a device that transmits a TCP-RST packet or an ICMP packet may be different from a device that stores an IP address in the fallback table 214.

[program]
FIG. 9 is a diagram showing that the information processing by the control program for executing a series of processes by the fallback detection device is specifically realized using a computer. As illustrated in FIG. 9, the computer 3000 includes, for example, a memory 3010, a CPU (Central Processing Unit) 3020, and a network interface 3070. Each part of the computer 3000 is connected by a bus 3100.

  The memory 3010 includes a ROM 3011 and a RAM 3012 as illustrated in FIG. The ROM 3011 stores a boot program such as BIOS (Basic Input Output System).

  Here, as illustrated in FIG. 9, the hard disk drive 3080 stores, for example, an OS 3081, an application program 3082, a program module 3083, and program data 3084. In other words, the control program according to the disclosed technique is stored in, for example, the hard disk drive 3080 as the program module 3083 in which instructions executed by the computer are described. Specifically, a program module in which a procedure for executing the same information processing as each unit of the control unit 220 described in the above embodiment is described is stored in the hard disk drive 3080.

  Further, like data stored in each table of the storage unit 210 described in the above embodiment, data used for information processing by the fallback detection program is stored as, for example, the hard disk drive 3080 as program data 3084. The CPU 3020 reads the program module 3083 and program data 3084 stored in the hard disk drive 3080 to the RAM 3012 as necessary, and executes various procedures.

  Note that the program module 3083 and the program data 3084 related to the fallback detection program are not limited to being stored in the hard disk drive 3080. For example, the program module 3083 and the program data 3084 may be stored in a removable storage medium. In this case, the CPU 3020 reads data via a removable storage medium such as a disk drive. Similarly, the program module 3083 and program data 3084 related to the update program may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). . In this case, the CPU 3020 reads various data by accessing another computer via the network interface.

[Others]
Note that the fallback detection program described in the present embodiment can be distributed via a network such as the Internet. The fallback detection program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, a DVD, or a Blu-ray disc, and is executed by being read from the recording medium by the computer. You can also.

100 Internal terminal 200 Fallback detection device 210 Storage unit 211 Communication start message table 212 DNS packet table 213 Internal terminal information table 214 Fallback table 220 Control unit 221 Monitoring unit 222 Storage unit 223 Fallback control unit 300 Router 400 External terminal

Claims (8)

A monitoring unit that monitors packets transmitted to the second terminal by the first terminal corresponding to a plurality of protocols;
A monitoring result indicating that a communication start message requesting the start of communication has been transmitted from the first terminal to the second terminal a predetermined number of times within a predetermined period by a specific protocol among the plurality of protocols is received by the monitoring unit A storage unit that stores identification information in the protocol for identifying the second terminal that is the transmission destination of the communication start message in a predetermined storage device,
A fallback control unit that controls fallback for the first terminal that is a transmission source of the communication start message whose destination is the identification information stored in the predetermined storage device by the storage unit. A fallback detection device.   The storage unit receives the communication start message after the monitoring result that the communication start message has been transmitted from the first terminal to the second terminal by the specific protocol a predetermined number of times is obtained by the monitoring unit. When the monitoring unit obtains a monitoring result indicating that the communication start message is transmitted to the second terminal using a protocol different from the specific protocol used for transmission of the identification information, The fallback detection apparatus according to claim 1, wherein the fallback detection apparatus is stored in a predetermined storage device.   The storage unit receives the communication start message after the monitoring result that the communication start message has been transmitted from the first terminal to the second terminal by the specific protocol a predetermined number of times is obtained by the monitoring unit. When the monitoring unit obtains a monitoring result indicating that the communication start message is transmitted from the first terminal to the second terminal using a protocol different from the specific protocol used for transmission of The fallback detection device according to claim 2, wherein the identification information is stored in the predetermined storage device.   The fallback control unit sends the first terminal to the first terminal serving as a transmission source of the communication start message whose identification information is stored in the predetermined storage device by the storage unit. The fallback detection apparatus according to claim 1, wherein a message for fallback is transmitted. The first terminal transmits a DNS query request for requesting identification information of the second terminal, receives a DNS query response that is a response to the DNS query request,
The monitoring unit monitors information transmitted and received by the first terminal by relaying communication by the first terminal,
The fallback control unit is included in the DNS query response when the monitoring unit obtains a monitoring result that the DNS query response including the identification information stored in the predetermined storage device is obtained. The fallback detection apparatus according to any one of claims 1 to 3, wherein the fallback detection apparatus transmits the identification information to the first terminal that is a transmission source of the DNS query request. The first terminal transmits a DNS query request that requests identification information of an arbitrary protocol of the second terminal, receives a DNS query response that is a response to the DNS query request,
The monitoring unit monitors information transmitted and received by the first terminal by relaying communication by the first terminal,
The fallback control unit does not include the identification information when the monitoring unit obtains a monitoring result that the DNS query request for requesting the identification information stored in the predetermined storage device is obtained. The fallback detection apparatus according to claim 1, wherein after generating a DNS query response, the DNS query response is transmitted to the first terminal that is a transmission source of the DNS query request. A monitoring step of monitoring packets transmitted toward the second terminal by the first terminal corresponding to a plurality of protocols;
A monitoring result indicating that a communication start message for requesting the start of communication has been transmitted from the first terminal to the second terminal a predetermined number of times within a predetermined period by a specific protocol among the plurality of protocols is obtained by the monitoring step. A storage step of storing, in a predetermined storage device, identification information for identifying the second terminal that is the transmission destination of the communication start message, if obtained.
A fallback control step of controlling fallback for the first terminal that is the transmission source of the communication start message whose destination is the identification information stored in the predetermined storage device by the storage step. A feature fallback detection method.   A fallback detection program for causing a computer to function as the fallback detection device according to any one of claims 1 to 6.

Images