JP2023097657A - Apparatus estimation device, apparatus estimation method, and program - Google Patents

Abstract

To improve the efficiency of identifying an apparatus connected to a network.SOLUTION: An apparatus estimation device includes: a guess dictionary storage unit in which ranges of MAC addresses (Media Access Control addresses) and apparatus names or model names are registered in association with each other; a comparison unit that compares the source MAC address of a packet sent from a new apparatus with the ranges of MAC addresses registered in the guess dictionary storage unit; an apparatus identification unit that identifies the apparatus name or model name of the new apparatus based on a comparison result of the comparison unit; and a registration unit that newly registers the range of MAC addresses and the apparatus name or model name in association with each other in the guess dictionary storage unit in accordance with a user input.SELECTED DRAWING: Figure 2

Description

The present invention relates to a device estimating device, a device estimating method, and a program.

For example, Patent Document 1 discloses a dictionary creation device that creates dictionary information used to identify a communication device connected to a network, and includes a receiving unit that receives packets from the communication device, and a receiving unit that receives packets from the communication device. an analysis unit that analyzes the packet and extracts characteristic information indicating the characteristics of the communication device; an input unit that receives input of model number information of the communication device; and the characteristic information extracted by the analysis unit and the input unit. and a recording unit for recording the model number information as dictionary information in the dictionary storage unit.

In addition, Patent Document 2 describes a research target network composed of electrical appliances and an information processing device, a survey network composed of survey electrical appliances and a survey information processing device whose devices are identified in advance, and A system comprising a server, wherein the information processing device transmits a packet to the electrical appliance in the network under investigation, and receives detection data composed of the packet and a response to the packet. data receiving means; dictionary data in which the detected data is associated in advance with the type of the electrical appliance; device identification means for identifying the electrical appliance based on the detected data; non-identification determination means for determining whether or not the identification of the electrical appliance has been completed; a packet transmitted to the electrical appliance for which the identification of the electrical appliance has not been completed when the identification of the electrical appliance has not been completed; investigation required determination means for determining detected data including response data to the packet as investigation required data and transmitting the investigation required data to the server, wherein the server receives the investigation required data, server device identification means for determining whether or not device identification has been completed by referring to stored dictionary data; investigation command means for transmitting investigation data to a device; investigation data reception means for receiving the investigation data by the investigation information processing device; detection data receiving means for receiving a response to a packet and receiving detection data composed of the packet and the response; comparison means for comparing the received detection data with the investigation data; and the comparison means unidentified device identification means for identifying a device of the electrical appliance for which the device identification could not be completed as a result of the comparison.

JP 2012-104055 Patent No. 4892634

The purpose is to streamline the identification of devices connected to the network.

A device estimating device according to the present invention includes a guessing dictionary storage unit in which ranges of MAC addresses (Media Access Control addresses) and device names or model names are registered in association with each other, and transmission of packets sent from a new device. A comparison unit that compares the original MAC address with the range of MAC addresses registered in the guess dictionary storage unit, and a device that specifies the device name or model name of the new device based on the comparison result of the comparison unit. A specifying unit and a registering unit for newly registering a range of MAC addresses and a device name or model name in association with each other in the guessing dictionary storage unit according to user input.

Preferably, the device identification unit identifies the device name or model name of the new device based only on the comparison result by the comparison unit.
Preferably, when a range of MAC addresses is newly registered in the estimation dictionary storage unit by the registration unit, another device name or model name is associated with the newly registered MAC address range. It further has a range changing unit that changes the range of MAC addresses.

Preferably, the comparison unit compares only high-order bits of MAC addresses.
Preferably, the registration unit performs new registration based on user input when the comparison unit determines that the MAC address does not match any of the ranges registered in the guess dictionary storage unit.

Preferably, when the same device name or the same model name is registered within the range of the same OUI (Organizationally Unique Identifier) by the registration unit, it is registered in the guess dictionary storage unit in association with this device name or model name. It further has a range extender for extending the range of MAC addresses that are provided.

Preferably, when the registration unit registers MAC addresses in association with mutually different device names or model names within the same OUI range, the range changing unit registers the MAC addresses registered in the guess dictionary storage unit. reduce or move the range of MAC addresses of other device names or other model names.
Preferably, when it is determined by the comparison unit that the range of MAC addresses registered in the guess dictionary storage unit does not match, the device name or model is determined based on packet information other than the MAC address. It further has a second device identification part for identifying a name.

In addition, the device estimation method according to the present invention refers to an estimation dictionary database in which ranges of MAC addresses and device names or model names are registered in association with each other, and source MAC of a packet sent from a new device. a comparison step of comparing the address with a range of MAC addresses registered in the guessing dictionary database; and a device identification step of identifying the device name or model name of the new device based on the comparison result of the comparison step. and a registration step of newly registering the MAC address range and the device name or model name in association with each other in the inference dictionary database according to the user's input.

Further, the program according to the present invention refers to a guessing dictionary database in which ranges of MAC addresses and device names or model names are registered in association with each other, and determines the transmission source MAC address of a packet sent from a new device. a comparison step of comparing the ranges of MAC addresses registered in the guessing dictionary database; a device identification step of identifying the device name or model name of the new device based on the comparison result of the comparison step; , the computer executes a registration step of newly registering the MAC address range and the device name or model name in association with each other in the inference dictionary database.

It is possible to efficiently specify devices connected to the network.

1 is a diagram illustrating the overall configuration of a device identification system 1; FIG. 2 is a diagram for explaining an operation outline of the device identification system 1; FIG. 2 is a diagram illustrating a hardware configuration of a device identification device 2; FIG. 2 is a diagram illustrating a functional configuration of a device identification device 2; FIG. (A) illustrates a device list registered in a device DB 370, and (B) illustrates a guess dictionary registered in a guess dictionary DB 372. FIG. 4 is a flowchart for explaining device identification processing (S10) by the device identification device 2; FIG. 7 is a flowchart for explaining in more detail the dictionary registration process (S20) of FIG. 6. FIG. FIG. 10 is a diagram illustrating a scene in which device names of the same type are automatically guessed based on a guess dictionary; FIG. 10 is a diagram illustrating a scene in which a user corrects a device name guessed based on a guessing dictionary; It is a figure which illustrates the scene which replaced|exchanged with the same kind of apparatus by the apparatus failure. FIG. 10 is a diagram illustrating a situation in which a device name cannot be guessed based on a guessing dictionary;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating the overall configuration of a device identification system 1. As shown in FIG.
As illustrated in FIG. 1, a device identification system 1 includes a device identification device 2 and a plurality of devices 9 (laptop PC 9A, switch 9B, web camera 9K, etc.), which are connected to each other via a network 7. are doing.
The equipment identification device 2 is a computer terminal that identifies and manages the equipment 9 connected to the network 7 . The device identification device 2 of this example automatically estimates the device name of the device 9 connected to the same subnet (network 7), and according to the user's operation, the estimated device name, the MAC address of the device 9, etc. are associated with each other and registered in a device list (described later) of the device DB 370 . Note that the device identification device 2 is an example of a device estimation device according to the present invention.
The device 9 is a device managed by the device identification device 2, and is, for example, a notebook computer 9A (laptop PC 9A), a switch 9B, or a web camera 9K.
The network 7 is a network that allows communication using MAC addresses, and in this example, a case where they are on the same subnet will be described as a specific example.

In network management with the above configuration, a high device identification rate in packets received from the network 7 is an important factor for identifying the device 9 during device management and detection of a failure location, and increases product value. , is also a function that reduces man-hours for device management.
However, in a factory network, various devices are operated by each maker's unique use, and the technology for identifying Windows terminals has a lower device identification rate than an office network.
Therefore, in order to manage all the devices 9, it is necessary for the user to investigate the unknown devices that cannot be identified one by one and to input the data into a management tool or the like, which takes time.

Therefore, the device identification system 1 of the present embodiment improves the device identification rate based on the packets flowing through the network 7 and reduces the man-hours for device management even when various devices 9 are in operation, such as in a factory network. In particular, in this example, the device name or model name of the device 9 is estimated by focusing on the OUI (Organizationally Unique Identifier). The OUI is the first three bytes of the MAC address, and is a number assigned to each manufacturer. One OUI corresponds to a range of approximately 16 million MAC addresses. When manufacturing the device 9, the manufacturer purchases OUI from IEEE and sets it as the global MAC address of the device. The device name of the device 9 is automatically estimated by referring to the dictionary.

As a method of identifying a device using a packet received on the network 7, a method such as a fingerprint of a DHCP packet may be considered, but the device operating on the factory network operates according to the specifications unique to the manufacturer. These methods have a low identification rate because of the large number of devices used. Also, in order to improve the device identification rate, there is a method of obtaining devices operating in a factory and identifying them by reverse engineering or the like, but this has the problem that it takes a lot of cost and time.

An overview of the operation of the device identification system 1 in this embodiment will be described with reference to FIG.
As illustrated in FIG. 2, the device identification device 2 receives packets from devices 9 within the same subnet (network 7).
The device identification device 2 refers to the device list of the device DB 370 and determines whether or not the device is already registered based on the MAC address of the received packet. If it is registered, the device name guessing process is started.
If the device is not registered in the device list of the device DB 370, the device identification device 2 identifies the transmission source MAC address of this device 9, the range of the OUI and the MAC address registered in the guess dictionary DB 372 (described later), and the are compared to guess the device name of the unregistered device 9 . In the guess dictionary DB 372, ranges of OUI and MAC addresses and device names are associated with each other. "name" is displayed as a guess result, and if none of them match, "device name unknown" is displayed as a guess result.
The user operates the device identification device 2, confirms the device name when the guess result is the "device name", corrects and changes it as necessary, and inputs the "management number". On the other hand, when the guess result is "device name unknown", the user operates the device identification device 2 to input the "device name" and "management number".
The device identification device 2 updates the device list of the device DB 370 according to the user input, and additionally registers the "device name" and the MAC address range in the guess dictionary based on the "device name" input by the user. .
In this way, the device identification device 2 of this example uses the guessing dictionary DB 372 to guess the device name, so that the device names of the devices 9 of the same type are automatically guessed. Compared to , the management man-hours are reduced. Also, even if the device 9 is replaced due to a failure or the like, if the same type of device is replaced, it can be automatically estimated, so the number of man-hours for management can be reduced.

FIG. 3 is a diagram illustrating the hardware configuration of the device identification device 2. As illustrated in FIG.
As illustrated in FIG. 3, the device identification device 2 has a CPU 200, a memory 202, an HDD 204, a network interface 206 (network IF 206), a display device 208, and an input device 210. These components are connected via a bus 212. connected to each other.
CPU 200 is, for example, a central processing unit.
The memory 202 is, for example, a volatile memory and functions as a main memory.
The HDD 204 is, for example, a hard disk drive device, and stores computer programs (eg, device identification program 3 in FIG. 4) and other data files as a non-volatile recording device.
The network IF 206 is an interface for wired or wireless communication, and realizes connection to the network 7, for example.
The display device 208 is, for example, a liquid crystal display, and functions as the result display section in FIG.
The input device 210 is, for example, a keyboard and mouse, and functions as the input section in FIG.

FIG. 4 is a diagram illustrating the functional configuration of the device identification device 2. As illustrated in FIG.
As exemplified in FIG. 4, the device identification program 3 is installed in the device identification device 2 of this example, operates, and also includes a device database 370 (device DB 370) and a guess dictionary database 372 (guess dictionary DB 372). be. The device identification program 3 is stored in a recording medium such as a CD-ROM, for example, and installed in the device identification device 2 via this recording medium.
The device identification program 3 has a packet reception processing section 300 , a comparison section 310 , a first device identification section 320 , a second device identification section 330 , a registration section 340 , a range change section 350 and a range extension section 360 .
Part or all of the device identification program 3 may be realized by hardware such as ASIC, or may be realized by partially borrowing functions of an OS (Operating System).

In the device identification program 3 , the packet reception processing section 300 receives packets from the device 9 connected to the network 7 . The packet reception processing unit 300 of this example receives packets from the device 9 within the same subnet as the device identification device 2 .

The comparison unit 310 compares the transmission source MAC address of the packet sent from the new device 9 with the range of MAC addresses registered in the guess dictionary DB 372 . Here, the new device 9 means a device that has not been identified by the device identification device 2 , and in this example, is a device that is not registered in the device list of the device DB 370 .
The comparison unit 310 of this example compares the transmission source MAC address of the packet received by the packet reception processing unit 300 and the MAC address registered in the device list of the device DB 370, and if they do not match, This transmission source MAC address (that is, the MAC address of the new device 9) is compared with the range of MAC addresses registered in the guess dictionary DB 372. FIG.

The first device identification unit 320 identifies the device name of the new device based only on the comparison results from the comparison unit 310 . More specifically, when the transmission source MAC address matches any MAC address range based on the comparison result of the comparison unit 310, the first device identification unit 320 associates the MAC address range with the MAC address range. The device name of the new device is set as the device name of the new device. If the transmission source MAC address matches any MAC address range based on the comparison result of the comparison unit 310, the first device identification unit 320 of this example determines whether the device associated with this MAC address range If the name does not match any MAC address range, the device name unknown is output.

If the comparison unit 310 determines that the range of MAC addresses registered in the inference dictionary DB 372 does not match, the second device identification unit 330 determines the device name based on the packet information other than the MAC address. Or specify the model name. For example, the second device identification unit 330 identifies the device name using the fingerprint of the DHCP packet or uPnP (Universal Plug and Play).

The registration unit 340 newly registers the MAC address range and the device name in association with each other in the inference dictionary DB 372 according to the user's input. For example, when the comparison unit 310 determines that the range of MAC addresses registered in the guess dictionary DB 372 does not match, the registration unit 340 performs new registration based on user input. The registering unit 340 of this example, in addition to the case where the comparing unit 310 determines that the range of MAC addresses registered in the guessing dictionary DB 372 does not match any However, even if the device name is modified by the user, new registration is performed based on the user's input.

When a range of MAC addresses is newly registered in estimation dictionary DB 372 by registration unit 340, range changing unit 350 changes the range of MAC addresses associated with other device names according to the range of newly registered MAC addresses. Change the range. More specifically, when the registration unit 340 registers MAC addresses in association with different device names within the same OUI range, the range change unit 350 changes the MAC address ranges so that the MAC address ranges do not overlap each other. , the range of MAC addresses of other device names registered in the guess dictionary DB 372 is reduced or moved.

When the registration unit 340 registers the same device name or the same model name within the same OUI range, the range extension unit 360 adds the MAC address registered in the guess dictionary DB 372 in association with this device name or model name. extend the range of More specifically, when the same device name is registered within the same OUI range by the registration unit 340, the range extension unit 360 performs guessing so as to connect the range of MAC addresses associated with these device names. Expand the range of MAC addresses registered in the dictionary DB 372 .

FIG. 5A illustrates a device list registered in the device DB 370, and FIG. 5B illustrates a guess dictionary registered in the guess dictionary DB 372. FIG. The guess dictionary DB 372 is an example of a guess dictionary storage unit according to the present invention.
As illustrated in FIG. 5A, the device DB 370 of this example associates the MAC address of the device 9, the device name of this device 9, and the management number assigned to this device 9 with each other to Store as a list. Devices 9 registered in the device list are devices managed by the device identification system 1 .
As illustrated in FIG. 5B, the guess dictionary DB 372 of this example associates OUIs, MAC address ranges, and device names with each other and stores them as guess dictionaries.

FIG. 6 is a flowchart for explaining the device identification process (S10) by the device identification device 2. As shown in FIG.
As illustrated in FIG. 6, at step 100 (S100), the packet reception processing unit 300 (FIG. 4) of the device identification device 2 receives packets flowing to the same subnet (network 7) via the network IF 206 (FIG. 3). receive.
At step 105 ( S<b>105 ), the comparing section 310 compares the source MAC address of the packet received by the packet reception processing section 300 with the MAC address registered in the device list of the device DB 370 . The device identification program 3 shifts to the process of S155 if any match is found as a result of the comparison, and shifts to the process of S110 if none match.

At step 110 ( S<b>110 ), the comparison unit 310 compares the source MAC address of the packet received by the packet reception processing unit 300 with the range of MAC addresses registered in the guess dictionary DB 372 .
If the transmission source MAC address matches any range of MAC addresses based on the comparison result of the comparison unit 310, the first device identification unit 320 identifies the device name associated with this range of MAC addresses as a device name. Output to the DB 370 , and if it does not match any range of MAC addresses, the device name unknown is output to the device DB 370 .

At step 115 (S115), the device DB 370 adds the information (“device name” or “unknown device name”) input from the first device identification unit 320 to the device list in association with the source MAC address. Note that the management number is in a state of "not set" as shown in FIG.
At step 120 (S120), the display device 208 displays the added device list.

In step 125 (S125), the device identification program 3 shifts to the process of S130 when the first device identification unit 320 outputs "device name", and the first device identification unit 320 outputs "device name unknown". is output, the process proceeds to S135.
At step 130 (S130), the device identification program 3 allows the user to confirm the device list displayed by the display device 208, and input the management number or correct the device name via the input device 210 (FIG. 3). Accepts operations from the user.

In step 135 (S135), the second device identification unit 330 identifies the device name based on the packet received by the packet reception processing unit 300 by fingerprint of the DHCP packet, and the identification result (“device name” or “device name unknown”) to the device DB 370, and the device DB 370 associates the information (“device name” or “device name unknown”) input from the second device identification unit 330 with the source MAC address and stores the information in the device list. After adding, the display device 208 displays the added device list.

In step 140 (S140), the device identification program 3 shifts to the process of S130 when the second device identification unit 330 outputs "device name", and the second device identification unit 330 outputs "device name unknown". is output, the process proceeds to S145.
At step 145 (S145), the device identification program 3 receives the input of the management number and device name from the user via the input device 210 (FIG. 3).

At step 20 (S20), the registration unit 340 updates the guess dictionary in the guess dictionary DB 372 according to the user's input.
At step 150 (S150), the device identification program 3 finalizes the device list of the device DB370.
At step 155 (S155), the display device 208 displays the device list of the device DB 370 as the identification result.

FIG. 7 is a flowchart for explaining in more detail the dictionary registration process (S20) of FIG.
As shown in FIG. 7, at step 200 (S200), the registration unit 340 adds the device name input by the user and the source MAC address of the packet received by the packet reception processing unit 300 to the guess dictionary DB 372. At the time of registration, the OUI portion of the source MAC address is compared with the OUIs registered in the guessing dictionary DB 372, and if any of the OUIs match, the process proceeds to S210, and the OUI matches with any of the OUIs. If they do not match, the process proceeds to S205.

In step 205 (S205), the registration unit 340 registers the OUI of the source MAC address and the 16-bit width (OUI:xx:00:00-OUI:xx:FF:FF) containing the source MAC address. The address range and the device name input by the user are associated with each other and newly registered in the guess dictionary DB 372 .

At step 210 (S210), the registration unit 340 registers a set of the device name input by the user and the source MAC address of the packet received by the packet reception processing unit 300, and the device registered in the guess dictionary DB 372. The names and MAC address sets are compared, and if they match any set, the dictionary registration process (S20) ends, and if they do not match any set, the process proceeds to S215.

At step 215 (S215), the registration unit 340 creates a MAC list by arranging MAC addresses in the device list (device DB 370) having the same OUI as the MAC address to be registered in ascending order.
At step 220 ( S<b>220 ), the registration unit 340 sets the top of the MAC list to the top of the MAC address range of the device name to be registered in the guessing dictionary DB 372 .

At step 225 (S225), the registration unit 340 searches the MAC list in ascending order, and if the next device name exists in the MAC list, the process proceeds to S235, and the next device name does not exist in the MAC list. If so, the process proceeds to S230.
At step 230 (S230), the registration unit 230 sets the end of the MAC address range of the device name. The end of the MAC address range is (OUI:xx:FF:FF). The "xx" part has the same value as the corresponding part of the MAC address of the device name to be registered.

At step 235 (S235), the registration unit 340 compares the 4th byte of the MAC address of the device name to be registered with the 4th byte of the MAC address of the next device name, and if they match, the process proceeds to S245. , if they do not match, the process proceeds to S240.
At step 240 ( S<b>240 ), the registration unit 340 sets the end of the MAC address range of the device name to be registered to (OUI:xx:FF:FF) and registers it in the guess dictionary DB 372 . The registration unit 340 sets the beginning of the MAC address range of the next device name to (OUI:xx:00:00), and returns to the process of S225.

At step 245 (S245), the registration unit 340 compares the 5th byte of the MAC address of the device name to be registered with the 5th byte of the MAC address of the next device name, and if they match, the process proceeds to S255. , if they do not match, the process proceeds to S250.
At step 250 ( S<b>250 ), the registration unit 340 sets the end of the MAC address range of the device name to be registered to (OUI:xx:yy:FF) and registers it in the guess dictionary DB 372 . The "yy" part is a value obtained by subtracting 1 from the 5th byte value of the MAC address of the next device name. The range changing unit 350 sets the top of the MAC address range of the next device name to (OUI:xx:xx:00), and returns to the process of S225. That is, the range changing unit 350 narrows the MAC address range of the next device name.

At step 255 ( S<b>255 ), the registration unit 340 sets the end of the MAC address range of the device name to be registered to (OUI:xx:xx:zz) and registers it in the guess dictionary DB 372 . The "zz" part is a value obtained by subtracting 1 from the 6th byte value of the MAC address of the next device name. The range changing unit 350 sets the top of the MAC address range of the next device name to (OUI:xx:xx:xx), and returns to the process of S225. That is, the range changing unit 350 narrows the MAC address range of the next device name.

As described above, the range changing unit 350 of this example narrows the width of the MAC address range when the MAC address ranges of different device names are likely to overlap on the premise that the range of MAC addresses is the latter half of 16 bits. , are adjusted so that they do not overlap. Note that when the MAC address ranges of different device names are likely to overlap, the range changing unit 350 may move the address ranges so that they do not overlap.

Next, processing examples in various situations will be described.
FIG. 8 is a diagram exemplifying a scene in which similar device names are automatically guessed based on the guess dictionary.
When "PC-0002" in FIG. 8 is detected as a new device 9 by the device identification device 2, the source MAC address of the detected device "PC-0002" is (00:AA:00:01: 02:44), it matches the MAC address range in the first line of the guess dictionary, and the device identification device 2 guesses that the device name is "A maker NotebookPC S series" and presents the device list to the user. do. When the user confirms the presented device name and assigns the management number "PC-0002", the device identification device 2 adds the input management number to finalize the device list.

FIG. 9 is a diagram illustrating a scene in which the device name guessed based on the guess dictionary is corrected by the user.
When "PR-0001" in FIG. 9 is detected as a new device 9 by the device identification device 2, the source MAC address of the detected device "PR-0001" is (00:BB:00:04: 09:03), it matches the MAC address range in the second line of the guess dictionary, and the device identification device 2 guesses that the device name is "B maker Switch AA series" and presents the device list to the user. do. Since the presented device name is incorrect, the user corrects the device name to "B maker Printer OA series".
The device identification device 2 updates the device list and guess dictionary accordingly.

FIG. 10 is a diagram exemplifying a scene in which a device of the same type is replaced due to a device failure.
When "PC-0002" in FIG. 10 is replaced with "PC-0010", this "PC-0010" is detected as a new device 9 by the device identification device 2, and the detected device "PC-0010" Since the source MAC address is (00:AA:AA:01:02:55), it matches the MAC address range in the third row of the guess dictionary, and the device identification device 2 recognizes the device name "A maker NotebookPC S series” and presents the device list to the user. When the user confirms the presented device name and assigns the management number "PC-0010", the device identification device 2 adds the input management number to finalize the device list.
In this way, it is possible to reduce the man-hours of the user who manages even when a device is replaced due to a failure.

FIG. 11 is a diagram illustrating a situation in which the device name cannot be guessed based on the guess dictionary.
When "PC-0001" in FIG. 11 is detected as a new device 9 by the device identification device 2, the source MAC address of the detected device "PC-0001" is (00:AA:00:01: 02:03), it does not match any of the MAC address ranges in the guess dictionary, and the first device identification unit 320 (FIG. 4) cannot identify the device, and the second device identification unit 330 uses the DHCP packet fingerprint or the like. , a new device 9 is specified. The device identification device 2 uses the second device identification unit 330 to guess that the device name is “A maker NotebookPC S series”, and presents the device list to the user. When the user confirms the presented device name and assigns the management number "PC-0001", the device identification device 2 updates the device list and guess dictionary accordingly.
Thus, in this example, the second device identification unit 330 with a relatively heavy processing load operates only when the first device identification unit 320 cannot guess.

As described above, according to the device identification system 1 of the present embodiment, since the device name of the device 9 is guessed by the guess dictionary, the man-hours of the user managing can be reduced.
Also, in this example, the device name is estimated only by comparing MAC addresses, so the processing load for device name estimation can be reduced.
In addition, in this example, since the guess dictionary is updated at any time according to the user's input operation, high guess accuracy can be expected even with the device 9 having the unique specifications of the manufacturer. In particular, since the OUI is focused on, the device name can be guessed in consideration of the characteristics of each manufacturer.

DESCRIPTION OF SYMBOLS 1... Equipment identification system 2... Equipment identification device 3... Equipment identification program 372... Guess dictionary database

Claims (10)

a guess dictionary storage unit in which ranges of MAC addresses and device names or model names are registered in association with each other;
a comparison unit that compares the transmission source MAC address of a packet sent from a new device with the range of MAC addresses registered in the guess dictionary storage unit;
a device identification unit that identifies the device name or model name of the new device based on the comparison result of the comparison unit;
A device estimating apparatus comprising: a registration unit that associates a MAC address range and a device name or model name with each other and newly registers them in the guessing dictionary storage unit in accordance with a user's input. The device estimating device according to claim 1, wherein the device identification unit identifies the device name or model name of the new device based only on the comparison result by the comparison unit. When a MAC address range is newly registered in the estimation dictionary storage unit by the registration unit, the MAC address range associated with another device name or model name according to the newly registered MAC address range The device estimating device according to claim 2, further comprising a range changing unit that changes the . The device estimation device according to claim 3, wherein the comparison unit compares only upper bits of MAC addresses. 5. The registering unit according to claim 4, wherein when the comparing unit determines that the range of MAC addresses does not match any range registered in the guessing dictionary storage unit, the registering unit performs new registration based on user input. Equipment estimator. When the same device name or the same model name is registered within the range of the same OUI by the registration unit, the range of MAC addresses registered in the guess dictionary storage unit is extended in association with this device name or model name. 6. The equipment estimating apparatus according to claim 5, further comprising: When the registration unit registers MAC addresses in association with mutually different device names or model names within the same OUI range, the range changing unit changes the MAC addresses to other devices registered in the guess dictionary storage unit. 7. The device estimating device according to claim 6, wherein the MAC address range of the name or other model name is reduced or moved. When the comparison unit determines that the range of MAC addresses does not match any range registered in the guess dictionary storage unit, the device name or model name is specified based on information in the packet other than the MAC address. The device estimation device according to claim 7, further comprising a second device identification unit. A guessing dictionary database in which ranges of MAC addresses and device names or model names are registered in association with each other is referred to, and source MAC addresses of packets sent from a new device are registered in the guessing dictionary database. a comparing step of comparing with a range of MAC addresses;
a device identification step of identifying the device name or model name of the new device based on the comparison result of the comparison step;
A device estimation method, comprising: a registration step of newly registering a range of MAC addresses and a device name or model name in association with each other in the guess dictionary database according to a user's input. A guessing dictionary database in which ranges of MAC addresses and device names or model names are registered in association with each other is referred to, and source MAC addresses of packets sent from a new device are registered in the guessing dictionary database. a comparing step of comparing with a range of MAC addresses;
a device identification step of identifying the device name or model name of the new device based on the comparison result of the comparison step;
A program for causing a computer to execute a registration step of newly registering a range of MAC addresses and a device name or model name in association with each other in the inference dictionary database according to a user's input.

Images