JP2020031321A - Communication device - Google Patents

Abstract

To provide a communication device capable of reliably processing packets for communication protocol control.SOLUTION: The communication device has an L2 switch 100 that includes: a switch device 102 that relays data packets of terminal device connected and relays packets transmitted terminal device; a CPU 101 that controls the switch device; a first transfer path A105 for transferring packets necessary for controlling communication protocol as the transfer path of packets from the switch device to the CPU; and a second transfer path B106 for transferring packets for acquiring information of the terminal device. The CPU controls the communication protocol for the packets necessary for controlling the communication protocol using the first transfer path A and controls to acquire a piece of information unique to the terminal device from packets for acquiring information using the second transfer path B.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication device that relays data.

  In recent years, various terminal devices such as IoT devices based on the Internet of Things (IoT) are connected to a network. In order to prevent unauthorized connection of the terminal device to the network and malware infection by the terminal device using the vulnerable operating system (OS), in order to know what terminal device is connected to the network, Visualization of terminal device information is important for security.

  The plurality of terminal devices are connected to a network via a network device (communication device), and the communication device includes, for example, a switch (L2 switch, L3 switch), a router, and the like. By arranging a dedicated device (appliance product) for detecting unauthorized connection on the network, information on the terminal device connected to the network can be visualized.

  As a conventional technique, a technique has been disclosed in which a connection monitoring system arranged on a network detects and displays the connection of an illegally connected device (for example, see Patent Document 1 below). Also, a technology is disclosed in which an OS detector is provided in a node of a communication network to analyze communication between the nodes (for example, see Patent Document 2 below). In addition, a technique is disclosed in which, when a monitoring device detects an illegally used information device, a warning e-mail is transmitted to an e-mail address of a manager (for example, see Patent Document 3 below).

JP 2005-051579 A JP-T-2013-545196 JP 2005-318037 A

  However, the above-mentioned appliance product occupies one or more ports of the communication device for monitoring a packet of a terminal device connected to the port of the communication device such as an L2 switch. Further, the appliance product cannot detect under which port of the communication device the unauthorized terminal device is connected. The appliance product is a device different from the communication device, and does not have information on the port of the communication device.

  Also, as in Patent Document 1, there is a method of notifying a connection monitoring system of a connection position of an illegally connected terminal device using an SNMP trap. In this method, an unauthorized connection monitoring system is prepared separately from network devices. Must be done, resulting in high costs. In addition, it takes time and effort to set the SNMP and to set the SNMP trap to reach the unauthorized connection monitoring system.

  In the related art, it is not possible to realize visualization of information of a terminal device connected to the communication device using only a communication device such as a switch or a router. If the communication device alone implements the function of collecting device information of other devices in the network, the number of packets that must be processed by the CPU in the communication device increases, and the driver that performs reception processing from the switch device processes the packets. As a result, a packet is missed. If the dropped packet is a communication protocol control packet (for example, an STP BPDU packet), it becomes impossible to transmit the information of the own device to another communication device. Then, while the other communication device performs the recalculation for avoiding the loop configuration, the entire network is stopped. STP is an abbreviation of Spanning Tree Protocol, and BPDU is an abbreviation of Bridge Protocol Data Unit.

  An object of one aspect is to reliably relay a communication protocol control packet.

  In one case, the communication device is a communication device that relays a packet of data of a terminal device to be connected, a switch device that relays a packet transmitted from the terminal device, and a CPU that controls the switch device. A first transfer path for transferring a packet required for communication protocol control as a transfer path of a packet from the switch device to the CPU, and a second transfer path for transferring a packet for acquiring information of the terminal device. Wherein the CPU controls a communication protocol for a packet necessary for the communication protocol control using the first transfer path, and uses the second transfer path to control the communication protocol from the packet for information acquisition. It is a requirement to perform control for acquiring information unique to the terminal device.

  According to one embodiment, there is an effect that the relay processing of the communication protocol control packet can be reliably performed.

FIG. 1 is a diagram illustrating an example of a hardware configuration of a communication device according to an embodiment. FIG. 2 is a block diagram of software functions related to visualization of information of the terminal device according to the embodiment. FIG. 3 is a flowchart illustrating an example of a packet analysis process performed by the communication device according to the embodiment. FIG. 4A is a diagram illustrating a protocol analysis process performed by the communication device according to the embodiment. (Part 1) FIG. 4B is a diagram illustrating a protocol analysis process performed by the communication device according to the embodiment. (Part 2) FIG. 5 is a diagram illustrating an example of an output generation process of the communication device according to the embodiment. FIG. 6 is a diagram illustrating an example of an output result of the communication device according to the embodiment. FIG. 7 is a diagram illustrating another example of the hardware configuration of the communication device according to the embodiment. FIG. 8 is a diagram illustrating a congestion state of an internal port by a conventional communication device. FIG. 9 is a diagram illustrating avoidance of a congestion state of an internal port by the communication device according to the embodiment. FIG. 10 is a diagram illustrating a processing operation using the multi-core CPU of the communication device according to the embodiment.

(Embodiment)
The communication device according to the embodiment is applied to a switch (L2 switch, L3 switch), a router, and the like. In the embodiment, the visualization of the information of the terminal device connected to the communication device is realized by the communication device alone without providing a separate appliance product on the network separately from the communication device. The information of the terminal device is, for example, a MAC address of the terminal device, a connection port number, identification information of the terminal device, and the like. The visualization of information means that unique information capable of identifying a terminal device is output for display or the like. The communication device generates and outputs information in which, for example, a MAC address for each terminal device, a connection port number, and identification information of the terminal device are associated with each other.

  FIG. 1 is a diagram illustrating an example of a hardware configuration of a communication device according to an embodiment. FIG. 1 shows a configuration example when the communication device 100 is applied to an L2 switch or an L3 switch. The communication device 100 includes a CPU (Central Processing Unit) 101, a switch device 102, a memory 103, a nonvolatile memory 104, and the like.

  The CPU 101 functions as a control unit that controls the entire communication device 100, and controls data relay (transfer) between terminal devices connected to the communication device 100. The switch device 102 is configured by an ASIC (Application Specific Integrated Circuit) or the like, and controls data relay of a terminal device connected to a connection port P (P1 to Pn) such as a LAN.

  Reference numeral 101a denotes a console port, which is connected to an external console terminal such as a personal computer (PC). Based on a command input from the console terminal via the console port 101a, a setting operation of the communication device 100 and terminal identification information of the terminal device are performed. Information can be output. In the following description, data transmitted / received by the communication device 100 to / from the terminal device has a predetermined frame, is packetized, and is transmitted / received.

  The nonvolatile memory 104 stores a control program for the CPU 101, and the control program is loaded from the nonvolatile memory 104 to the memory 103 and executed by the CPU 101. At that time, the CPU 101 uses the memory 103 and the nonvolatile memory 104 as a work area. For example, a RAM or the like can be used as the memory 103, and a flash memory can be used as the nonvolatile memory 104. The memory 103 also functions as an auxiliary memory that holds, for example, setting data and information such as tables described later.

  In the communication apparatus 100 according to the embodiment, a transfer path (first transfer path) A, which is a signal line for transferring a communication protocol control packet, And a transfer path (second transfer path) B which is a signal line for transferring the use packet. The transfer path A is used for packet transfer similar to that of an existing communication device.

  Note that the terminal device transmits a predetermined (single) packet to the communication device 100, and the communication device 100 that has received the packet transmits the packet to the first transfer path A or The packet is distributed to the second transfer path B and transferred, or the same packet is broadcast to both. When a packet is used for both communication protocol control and other device information acquisition, it is necessary to transmit the same packet to both path A and path B.

  The transfer path B is a transfer path for a terminal information acquisition packet, and is newly provided for acquiring information unique to the terminal device connected to the connection port of the communication device 100. For example, a part of an internal port connecting the CPU 101 and the switch device 102 is dedicated to transfer of a communication protocol control packet, and another part is dedicated to transfer of a terminal information acquisition packet of a terminal device.

  In the transfer path A, for example, an internal port 105 of a standard such as PCI-Express for transmitting and receiving packets with control information can be used. For the transfer path B, a port (internal port) 106 such as a serial gigabit media independent interface (SGMII) can be used.

  Further, a predetermined VLAN ID (Virtual LAN IDentifier) is assigned to the transfer path B. By allocating the ID (predetermined identifier) of the VLAN segment to be monitored to the internal port 106 of the transfer path B, the switch device 102 can send both the broadcast and multicast packets transmitted by the terminal device to the CPU 101.

  FIG. 2 is a block diagram of software functions related to visualization of information of the terminal device according to the embodiment. The function of each component shown in FIG. 2 can be realized by executing a program of the CPU 101 in FIG.

  The CPU 101 includes a packet analysis unit 201, an output generation unit 202, a command reception unit 203, a switch device control unit 204, a communication device control unit 205, and a console device control unit 206. The terminal identification information table DB and the MAC address table T are provided in a storage area of the memory 103 or the nonvolatile memory 104 illustrated in FIG. 1, for example.

  The communication device control unit 205 functions as a driver that controls a communication controller built in the CPU 101, and outputs a packet received via the switch device 102 to the packet analysis unit 201 via a packet input / output interface (IF). . The communication device control unit 205 controls input and output of packets to and from the terminal device using the transfer path B (internal port 106).

  The console device control unit 206 functions as a driver that controls input and output to and from the console port 101a. The console device control unit 206 outputs a command such as an operation input via the console port 101a to the command receiving unit 203 via a command input / output IF.

  The packet analysis unit 201 receives a packet input from a terminal device via the internal port 106 and performs analysis for each packet type. The packet analysis unit 201 determines the type of the received packet, and passes the packet to the analysis unit 211 for each packet type.

  The analysis unit 211 for each packet type has a plurality of protocol analysis units 221 (221a, 221b ...) for each communication protocol. Each protocol analyzer 221 converts the value of a specific field of the received packet into identification information of the terminal device, and registers the acquired MAC address and the identification information of the terminal device in the terminal identification information table DB.

  The protocol analysis unit 221 obtains the identification information of the terminal device by, for example, a fingerprinting technique. Fingerprinting is a method of extracting a value of a specific field of a packet transmitted from a terminal device, and estimating an operating system (OS) type, an OS version, and a model name of the terminal device based on the value of the field. Further, the MAC address of the terminal device that is the transmission source of the packet is obtained from the information in the packet. Then, the protocol analysis unit 221 registers the obtained MAC address and the identification information of the terminal device in the terminal identification information table DB as a database.

  The MAC address table T stores, in a table format, information on the MAC address of each terminal device by MAC learning and information on the port number of the connection port P of the communication device 100 to which the terminal device of this MAC address is connected. The switch device control unit 204 is a functional unit of a driver that accesses the MAC address table T. In response to a request from the output generation unit 202, the switch device control unit 204 refers to the MAC address table T, reads information on the MAC address and port number of each terminal device, and outputs the information to the output generation unit 202.

  The command receiving unit 203 analyzes a command input from an external console terminal via the console device control unit 206, and outputs an output generation request corresponding to the requested command to the output generation unit 202. The output result generated by the output generation unit 202 is output to an external console terminal via the console device control unit 206.

  When receiving the output generation request from the command receiving unit 203, the output generation unit 202 refers to the terminal identification information table DB and the MAC address table T. The output generation unit 202 generates information for visualizing the corresponding terminal device from the terminal identification information table DB and the MAC address table T, and outputs the information to the console terminal via the command reception unit 203 as an output result. A detailed generation example of the information for visualizing the terminal device will be described later.

  Hereinafter, a processing example of each functional unit of the communication device 100 performed to generate information for visualizing the terminal device will be described.

  FIG. 3 is a flowchart illustrating an example of a packet analysis process performed by the communication device according to the embodiment. Mainly, processing contents performed by the packet analysis unit 201 in FIG. 2 will be described.

  First, the packet analysis unit 201 determines the type of the packet transmitted by the terminal device (Step S301a). In determining the packet type, a protocol, for example, a Dynamic Host Configuration Protocol (DHCP) or a Link Layer Discovery Protocol (LLDP) is determined with reference to the header of the packet.

  Then, the packet analysis unit 201 passes the received packet to the analysis unit 211 for each packet type for each determined protocol. For example, if the packet type is $ protocol (Step S301a: Case1), the packet analysis unit 201 passes this packet to the corresponding protocol analysis unit 221 (#protocol analysis unit 221a in FIG. 1). Then, the processing of step S302a is executed by the protocol analysis unit 221a. If the received packet is a different protocol (step S301a: other), the packet type is determined again (step S301b).

  In step S302a, the protocol analysis unit 221 (〇〇protocol analysis unit 221a) performs the analysis processing of the XX protocol. First, the protocol analysis unit 221 extracts a specific field of the packet by a method such as fingerprinting (step S303), and converts the value of the extracted specific field into identification information (step S304). Further, the MAC address of the terminal device is extracted from the source MAC field of the packet (step S305).

  Next, the protocol analysis unit 221 searches the terminal identification information table DB using the extracted MAC address as a key (step S306), and determines whether or not the corresponding MAC address is registered (step S307). Here, it is assumed that the corresponding MAC address is an unregistered entry in the terminal identification information table DB (Step S307: Yes). In this case, the protocol analysis unit 221 newly registers the MAC address and the entry of the identification information of the terminal device extracted in step S305 in the terminal identification information table DB (step S308).

  On the other hand, it is assumed that the corresponding MAC address has been registered in the terminal identification information table DB (step S307: No). In this case, the protocol analysis unit 221 updates the terminal identification information table DB with the MAC address and the content of the terminal device identification information extracted in step S305 (step S309). By the processing of step S308 or step S309, the packet analysis unit 201 ends a series of packet analysis processing for one protocol ($ protocol).

  If the received packet has a different protocol in step S301a (step S301a: other), the packet analysis unit 201 determines the packet type again (step S301b). For example, if the packet type is $ protocol (step S301b: Case2), the packet analysis unit 201 passes this packet to the corresponding protocol analysis unit 221 (# protocol analysis unit 221b in FIG. 1). Then, the process of step S302b is executed by the protocol analysis unit 221b.

  In step S302b, the protocol analyzing unit 221 (〇 △ protocol analyzing unit 221b) analyzes the こ の protocol. The procedure of the protocol analysis in step S302b is the same as that in steps S303 to S309. In the protocol analysis processing, processing equivalent to steps S303 to S309 may be performed for each different protocol.

  Note that the process in FIG. 3 is an example, and for example, one of a plurality of packet types may be specified in one step S301a. In this case, in step S302a, in each process of the branch destination corresponding to the packet type specified in step S301a, the protocol analysis process of the specified packet type can be directly executed.

  FIGS. 4A and 4B are diagrams illustrating a protocol analysis process performed by the communication device according to the embodiment. The flow of the protocol analysis process shown in step S302a of FIG. 3 will be described with reference to these drawings.

  FIG. 4A shows an example in which communication device 100 receives a DHCP packet from terminal device 400 (400a) connected to connection port P. The DHCP packet 410 includes a field 410a of the value of the source MAC address of the terminal device 400a that is the source of the packet, and a field 410b of the value of Option 55. The Option 55 field 410b has a different value corresponding to the OS of the terminal device 400a.

  When the specific field is extracted (step S303), the packet type analyzing unit 211 of the packet analyzing unit 201 extracts the source MAC address “00: 23: 26: 01: 23:” from the source MAC address value field 410a. 45 ”is obtained. The analysis unit 211 for each packet type fingerprints the Option55 field 410b, and the value of “1,15,3,6,44,46,47,31,33,249,43” is set to “Windows XP” ( It is determined that the OS type is (registered trademark).

  Then, the analysis unit 211 for each packet type stores the MAC address “00: 23: 26: 01: 23: 45” as a new entry corresponding to the acquired terminal device 400a in the terminal identification information table DB. Also, information of “Windows XP” is stored as terminal identification information corresponding to the MAC address.

  FIG. 4B shows an example in which communication device 100 receives an LLDP packet from terminal device 400 (400b) connected to connection port P. LLDP is an abbreviation for Link Layer Discovery Protocol. The LLDP packet 420 includes a field 420a of the value of the source MAC address of the terminal device 400b that is the source of the packet, and a System Description field (system type) 420b. The System Description field 420b has a different value corresponding to the type of the terminal device 400b.

  When extracting a specific field (step S303), the analyzing unit 211 for each packet type of the packet analyzing unit 201 extracts the source MAC address “00: 23: 26: 0a: bc: de” from the source MAC address value field 420a. To get. Further, the analysis unit 211 for each packet type acquires the value “Fujitsu IP Phone” of the System Description field 420b.

  Then, the analysis unit 211 for each packet type stores the MAC address “00: 23: 26: 0a: bc: de” as a new entry corresponding to the acquired terminal device 400b in the terminal identification information table DB. Also, information of “Fujitsu IP Phone” is stored as terminal identification information corresponding to the MAC address.

  FIG. 5 is a diagram illustrating an example of an output generation process of the communication device according to the embodiment. 3 illustrates an example of an output result generation process performed by the output generation unit 202 illustrated in FIG. 2. When receiving the output generation request from the command receiving unit 203, the output generation unit 202 refers to the MAC address table T and the terminal identification information table DB. Then, the output generation unit 202 acquires terminal identification information for each MAC address from the terminal identification information table DB. Further, connection port number information for each MAC address is obtained from the MAC address table T. Then, an output result 500 in which connection port number information for each MAC address is associated with terminal identification information is generated.

  FIG. 5 shows an example of generating an output result 500 relating to the terminal device 400a (see FIG. 4A) that has transmitted the DHCP packet. The output generation unit 202 acquires the terminal identification information “Windows XP” corresponding to the MAC address from the terminal identification information table DB using the MAC address “00: 23: 26: 01: 23: 45” of the terminal device 400a as a key. . In addition, the output generation unit 202 uses the acquired MAC address “00: 23: 26: 01: 23: 45” of the terminal device 400a as a key to connect port number information “1” corresponding to the MAC address from the MAC address table T. To get.

  Then, the output generation unit 202 generates an output result 500 in which the connection port number information “1” of the MAC address “00: 23: 26: 01: 23: 45” is associated with the terminal identification information “Windows XP”. .

  The output result 500 includes, for each MAC address, that is, connection port number information and terminal identification information of all terminal devices 400 (400a, 400b,...) Connected to all ports (connection ports P) of the communication device 100. Contains associated information.

  The output result 500 generated by the output generation unit 202 returns a command line to the external console terminal via the console port 101a (see FIG. 1) that has issued the output generation request. In addition, the output destination of the output result 500 may be displayed on the Web browser of the predetermined terminal device that has issued the output generation request, or may be filed and transmitted to the predetermined terminal device that has issued the output generation request. It may be.

  In the communication device 100 described above, the ID of the VLAN segment to be monitored is assigned to the internal port 106 of the transfer path B. In addition to this configuration, a packet input / output to a specific external port (for example, one or all ports) may be mirrored to the internal port 106 using the port mirroring function of the switch device 102. As a result, packets other than broadcast and multicast packets can be monitored.

  Regarding the processing of each functional unit (see FIG. 2) performed by the CPU 101 of the communication device 100, a core different from the main function may be allocated so as not to affect the main function of transferring data as a network device. Information for the CPU 101 to visualize the terminal obtained by packet analysis is not limited to the MAC address and the identification information of the terminal device 400. For example, the IP address, the host name, the NetBIOS name (corresponding to the computer name), and the vendor name may be added, or any combination of them may be used.

  FIG. 6 is a diagram illustrating an example of an output result of the communication device according to the embodiment. In the example illustrated in FIG. 6, the output generation unit 202 acquires the output result 500 from the terminal device 400 in addition to the MAC address, the terminal identification information, and the connection port number information for each terminal device 400 (400a, 400b,...). Includes IP address and computer name. This output result 500 is stored and held in the terminal identification information table DB.

  As shown in the drawing, the communication device 100 is a different OS as the MAC address of each of the plurality of terminal devices 400 and the terminal identification information, and information visualizing the connection port number information, the IP address, and the computer name for the communication device 100. Can be output as

  FIG. 7 is a diagram illustrating another example of the hardware configuration of the communication device according to the embodiment. The communication device 100 shown in FIG. 7 shows a configuration example when applied to a router. In the case of a router configuration example, in addition to the components shown in FIG. 1, the CPU 101 may include a port W of an external network such as a WAN.

  Next, in the communication apparatus 100 according to the above-described embodiment, a configuration in which a transfer path B (internal port 106) is newly provided between the CPU 101 and the switch device 102 illustrated in FIG. I do.

  FIG. 8 is a diagram illustrating a congestion state of an internal port by a conventional communication device. In the conventional communication apparatus 800, the CPU 801 and the switch device 802 transmit and receive packets necessary for controlling a communication protocol via a data path 803 (corresponding to the internal port 105 in FIG. 1) called a CPU port. Is going.

  The CPU port (data path 803) is used, for example, for transmitting and receiving BPDU packets used in STP. STP is a communication protocol for preventing a terminal device in a LAN from forming a loop configuration. Then, as described in the embodiment, it is assumed that, in order to visualize the information of the terminal device, packets F2 of a plurality of terminal devices to be monitored are acquired using the CPU port (data path 803).

  In this case, as shown in FIG. 8, the packets F2 to be monitored at the plurality of connection ports (P1, P2, Pn-1, Pn) are concentrated on the CPU port (data path 803) and congestion is likely to occur. As a result, the packet F1 (connection port P3) necessary for controlling the communication protocol may be missed.

  For example, in the case of STP, if the CPU 801 drops a BPDU packet, it is necessary to perform a recalculation process to avoid a loop configuration, and the entire network configuring the STP may be in a communication suspended state for a while. Occurs.

  FIG. 9 is a diagram illustrating avoidance of a congestion state of an internal port by the communication device according to the embodiment. The communication device 100 according to the embodiment uses the transfer path A of the CPU port (the internal port 105) as the transfer path of the existing communication protocol control packet F1.

  In addition to the transfer path A (internal port 105), a transfer path B is provided as a data path for the packet F2 to be monitored. Thus, the transfer path B is used exclusively for the packet F2 to be monitored. In this case, the information of the terminal device 400 is obtained by monitoring the packets of the connection ports P1, P2, Pn-1, and Pn.

  At this time, the transfer path A can continue the transfer of the existing communication protocol control packet F1 of the connection port P3 without being involved in the packet monitoring. In the embodiment, as the packet F1 for controlling the communication protocol, the present invention can be applied to an SNMP (Simple Network Management Protocol).

  As a result, it is possible to avoid the occurrence of a loss of the communication protocol control packet due to the congestion factor in the communication device 100. Then, even when the communication device 100 performs the information acquisition process of the terminal device 400, it is possible to avoid the influence on the communication protocol control which is one of the main functions of the network device.

  FIG. 10 is a diagram illustrating a processing operation using the multi-core CPU of the communication device according to the embodiment. An example of CPU processing when a data path (transfer path B) for monitoring packets is used separately from the transfer path A of the CPU port will be described.

  As shown in FIG. 10, a CPU having a plurality of cores is used as the CPU 101. Accordingly, while the packet transmission / reception processing of the internal port is performed using a predetermined core of the CPU 101, the packet transmission / reception processing of the monitoring port can be performed in parallel by another core of the CPU 101.

  For example, one (n-1) core (for example, core 0) of the plurality of cores n of the CPU 101 functions as the communication control unit 1001 using the transfer path A required as a network device. The communication control unit 1001 includes a communication protocol analysis and control processing unit 1011 that performs analysis and control processing according to the communication protocol of the terminal device 400, and a switch device control processing unit 1012 that controls the switch device 102. It also includes a command reception processing unit 1013 and a frame transmission / reception processing unit 1014 for an internal port. Each of these components can be implemented as a function by the core 0 of the CPU 101 executing a program.

  The core n of the CPU 101 functions as a visualization processing unit 1002 that visualizes information of the terminal device 400 connected to the communication device 100. The visualization processing unit 1002 for visualizing the information of the terminal device includes a terminal device identification frame analysis processing unit 1021 for acquiring terminal identification information using the transfer path B, and a frame for performing packet transmission / reception processing of a monitoring port (internal port 106). And a transmission / reception processing unit 1022. Each of these components can be realized by executing a program by the core n of the CPU 101.

  The CPU 101 can designate a core for processing the functions of one communication control unit 1001 and the other visualization processing unit 1002 for each of the transfer path A (internal port 105) and the transfer path (internal port 106).

  Further, the CPU 101 is not limited to using a multi-core CPU, but may use a plurality of CPUs 101. In the case of such a multi-CPU configuration, one CPU 101 functions as the communication control unit 1001 using the transfer path A. The other CPU 101 functions as a function of acquiring terminal identification information using the transfer path B in order to visualize information of the terminal device 400 connected to the communication device 100, that is, functions as a visualization processing unit 1002.

  As described above, a certain CPU core in the CPU allocates and executes a packet transmission / reception process for a packet necessary for controlling the communication protocol of the terminal device 400 using the transfer path A. In addition, another CPU core in the CPU allocates and executes a packet analysis process of acquiring the terminal identification information of the terminal device 400 using the transfer path B.

  Accordingly, even when the communication device 100 performs the packet analysis process of acquiring the terminal identification information of the terminal device 400 using the transfer path B, the communication device 100 can process the packet necessary for controlling the communication protocol which is the main function of the network device. Pressure on the CPU resources to be used can be prevented. Then, it becomes possible to suppress the congestion of the packet processing required for controlling the communication protocol which is the main function of the communication device 100.

  According to the above-described embodiment, information of a plurality of terminal devices connected to the communication device can be visualized by the communication device alone. In the embodiment, the communication device monitors a packet of the terminal device, extracts terminal identification information unique to the terminal device from a specific field of the packet for each protocol type, and identifies the terminal identification of each terminal connected to the communication device. Stores and retains information.

  The terminal identification information is the OS, type, IP address, host name, NetBIOS name, vendor name, and the like of the terminal device. By associating the MAC address and the connection port number acquired from the terminal device with the terminal identification information, it becomes possible to specify what terminal device is connected to each connection port of the communication device.

  In this way, by visualizing the information of the terminal device, it is possible to easily know what terminal device is connected to the network. Then, unauthorized connection of the terminal device to the network and malware infection by the terminal device using the vulnerable OS can be prevented, and the security of the network including the terminal device can be maintained.

  Further, according to the embodiment, it is possible to arrange a dedicated device (appliance product) for detecting unauthorized connection on the network, and to collect the visualized information of the terminal device accumulated in the communication device. Thereby, for example, since the terminal device using the vulnerable OS can be specified including the connection port, the control for cutting off the connection port to which the terminal device using the vulnerable OS is connected can be performed. Become.

  The communication device according to the embodiment can be applied to an L2 switch and an L3 switch, and further to a router. The communication device includes the switch and the router, acquires terminal identification information of a terminal device connected to a connection port, and obtains the It is possible to easily specify whether a terminal device is connected.

  According to the embodiment, between the switch device and the CPU, for the packet transmitted by the terminal device, the packet necessary for controlling the communication protocol and the packet to be monitored are transferred to the CPU using different internal ports. I do. Packets necessary for controlling the communication protocol are transferred via a first transfer path (transfer path A), and packets for acquiring information of the terminal device are transferred via a second transfer path (transfer path B). I made it. As a result, it is possible to suppress congestion of a packet transfer path required for controlling a communication protocol, avoid packet loss, and reliably transfer a packet for communication protocol control of data transfer.

  Further, the CPU can process the packet processing required for controlling the communication protocol and the packet processing to be monitored in parallel by processing the respective packets transferred from the first transfer path and the second transfer path in parallel. .

  For example, by using a multi-core CPU as a CPU, it is possible to perform packet processing required for controlling a communication protocol in one core and perform packet processing to be monitored in another core. Further, it is possible to use a plurality of different CPUs, perform packet processing required for controlling a communication protocol by one CPU, and perform packet processing to be monitored by another CPU. As a result, the packet processing required for controlling the communication protocol and the packet processing to be monitored can be processed independently, one does not affect the other, the processing congestion is suppressed, and any of these different packet processings is reliably performed. You can do it.

  Further, the CPU can monitor the information acquisition packet of the second transfer path and extract identification information unique to the terminal device included in the information acquisition packet. For example, identification information unique to the terminal device included in a predetermined field of the information acquisition packet is acquired by fingerprinting. This makes it possible to easily obtain the identification information unique to the terminal device from the received packet.

  Further, the CPU holds the MAC address of the terminal device and the information of the connection port in the MAC address table. Then, using the MAC address of each terminal device as a key, the CPU associates the terminal identification information extracted from the information acquisition packet with the MAC address, and identifies the connection port associated with each MAC address and the terminal identification information with the terminal identification information. It can be stored in an information table. As a result, the information of the MAC address and the connection port for each terminal device obtained by MAC learning and the terminal identification information obtained at the time of packet monitoring can be associated with each terminal device and held in the terminal identification information table. Then, the terminal device connected to the communication device can be specified simply by referring to the terminal identification information table.

  Further, the CPU can determine the communication protocol of the terminal device from the received packet and perform packet processing for each communication protocol. Thus, the identification information for each terminal device can be easily extracted by the packet processing for each communication protocol.

  Further, the CPU can output the MAC address, the connection port, and the terminal identification information for each terminal device from the terminal identification information table based on the request for the terminal identification information. Thus, when externally requesting the terminal identification information from the communication device, the terminal device connected to the communication device can be immediately replied only by referring to the terminal identification information table.

  Further, the CPU can assign the identifier of the VLAN segment of the terminal device to be monitored to the second transfer path, and can acquire the packet of the entire terminal device to be monitored via the second transfer path. Thus, the broadcast and multicast packets transmitted by the terminal device to be monitored connected to the connection port can be transferred to the CPU, and the CPU can acquire the terminal identification information of the terminal device to be monitored.

  According to the embodiment, the terminal identification information for visualizing the terminal device connected to the communication device can be easily obtained only by installing the communication device on the network without introducing the dedicated appliance. become able to. Further, according to the embodiment, it is not necessary to connect a dedicated appliance to the communication device unlike the related art, so that the connection port of the communication device is not occupied and the connection port of the communication device is connected to the terminal device. Can be secured. Further, the terminal identification information described above makes it easy to determine under which connection port of the communication device the terminal device is connected.

  Note that the communication control method described in the present embodiment can be realized by a computer (CPU or the like) of a target device (communication device) executing a control program prepared in advance. The present control program is recorded on a computer-readable recording medium such as a magnetic disk, an optical disk, and a USB (Universal Serial Bus) flash memory, and is executed by being read from the recording medium by the computer. Further, the control program may be distributed via a network such as the Internet.

  Regarding the above-described embodiment, the following supplementary notes are further disclosed.

(Supplementary Note 1) A communication device that relays a data packet of a connected terminal device,
A switch device that relays a packet transmitted from the terminal device;
A CPU for controlling the switch device;
As a transfer path of a packet from the switch device to the CPU,
A first transfer path for transferring packets required for communication protocol control,
A second transfer path for transferring a packet for information acquisition of the terminal device,
With
The CPU controls a communication protocol for a packet necessary for the communication protocol control using the first transfer path, and uses the second transfer path to convert the information acquisition packet to a packet unique to the terminal device. A communication device for performing control to acquire the information of the communication device.

(Supplementary note 2) The communication device according to supplementary note 1, wherein the CPU performs parallel processing on each of the packets transferred from the first transfer path and the second transfer path.

(Supplementary note 3) The communication device according to supplementary note 2, wherein the CPU is a multi-core CPU or a plurality of different CPUs.

(Supplementary Note 4) The CPU monitors the information acquisition packet on the second transfer path, and extracts terminal identification information unique to the terminal device included in the information acquisition packet. The communication device according to any one of supplementary notes 1 to 3, wherein

(Supplementary note 5) The communication device according to supplementary note 4, wherein the CPU acquires, by fingerprinting, terminal identification information unique to the terminal device included in a predetermined field of the information acquisition packet.

(Supplementary Note 6) The CPU holds the MAC address and connection port information of the terminal device in a MAC address table, and uses the MAC address of each terminal device as a key to extract the terminal identification extracted from the information acquisition packet. Associating information with said MAC address;
6. The communication device according to claim 4, wherein the connection port associated with each of the MAC addresses and the terminal identification information are held in a terminal identification information table.

(Supplementary Note 7) The CPU outputs the MAC address, the connection port, and the terminal identification information of each terminal device from the terminal identification information table based on the request for the terminal identification information. 7. The communication device according to claim 5, wherein

(Supplementary note 8) The communication device according to any one of Supplementary notes 1 to 7, wherein the CPU determines a communication protocol of the terminal device from a received packet and performs packet processing for each communication protocol. .

(Supplementary Note 9) The CPU assigns an identifier of a VLAN segment of the terminal device to be monitored to the second transfer path, or assigns an external port to be monitored to the second transfer path by a mirroring function of a switch device. The communication device according to any one of supplementary notes 1 to 8, wherein a packet of the entire terminal device to be monitored is acquired via the second transfer path.

(Supplementary Note 10) A communication control program for a communication device, comprising: a switch device that relays a packet transmitted from a terminal device; and a CPU that has a transfer path for the packet from the switch device and controls the switch device. hand,
In the CPU,
Using the first transfer path to transfer the packets required for the communication protocol control to control the communication protocol for the packets required for the communication protocol control,
Using a second transfer path for transferring the information acquisition packet of the terminal device, performing control to acquire information unique to the terminal device from the information acquisition packet,
A communication control program characterized by the above-mentioned.

100 communication device 101 CPU
101a console port 102 switch device 103 memory 104 non-volatile memory 105 internal port (first transfer path A)
106 internal port (second transfer path B)
Reference Signs List 201 packet analysis unit 202 output generation unit 203 command reception unit 204 switch device control unit 205 communication device control unit 206 console device control unit 211 analysis unit for each packet type 221 protocol analysis unit 400 (400a, 400b) terminal device 500 output result DB Terminal identification information table F1 Packets required for control of communication protocol F2 Packets to be monitored P Connection port T MAC address table

Claims (8)

A communication device for relaying a data packet of a connected terminal device,
A switch device for relaying a packet transmitted from the terminal device;
A CPU for controlling the switch device;
As a transfer path of a packet from the switch device to the CPU,
A first transfer path for transferring packets required for communication protocol control,
A second transfer path for transferring a packet for acquiring information of the terminal device,
With
The CPU controls a communication protocol for a packet necessary for the communication protocol control using the first transfer path, and uses the second transfer path to convert the information acquisition packet to a specific packet for the terminal device. A communication device for performing control to acquire the information of the communication device.   The communication device according to claim 1, wherein the CPU performs parallel processing on each of the packets transferred from the first transfer path and the second transfer path.   The communication device according to claim 2, wherein the CPU is a multi-core CPU or a plurality of different CPUs.   2. The apparatus according to claim 1, wherein the CPU monitors the information acquisition packet on the second transfer path and extracts terminal identification information unique to the terminal device included in the information acquisition packet. The communication device according to any one of claims 1 to 3.   The communication device according to claim 4, wherein the CPU acquires terminal identification information unique to the terminal device included in a predetermined field of the information acquisition packet by fingerprinting. The CPU holds the MAC address and connection port information of the terminal device in a MAC address table, and uses the MAC address of each terminal device as a key, and extracts the terminal identification information extracted from the information acquisition packet into the MAC address table. Associated with the address,
The communication device according to claim 4, wherein the connection port associated with each of the MAC addresses and the terminal identification information are held in a terminal identification information table.   6. The device according to claim 5, wherein the CPU outputs the MAC address, the connection port, and the terminal identification information of each terminal device from the terminal identification information table based on the request for the terminal identification information. Or the communication device according to 6.   The communication device according to any one of claims 1 to 7, wherein the CPU determines a communication protocol of the terminal device from a received packet and performs packet processing for each communication protocol.

Images