JP5622233B2 - Packet communication processing apparatus, control method therefor, program, and recording medium - Google Patents

Description

  The present invention uses, for example, a packet such as an IP (Internet Protocol) network using a virtual device (hereinafter also referred to as a virtual device or a virtual machine) for virtually realizing functions of a communication device such as a host device and a router. The present invention relates to a packet communication processing apparatus that virtually constructs an exchange network and processes communication packets transmitted and received within the packet exchange network and a control method thereof. The present invention also relates to a program including each step in the control method for the packet communication processing apparatus and a computer-readable recording medium storing the program.

  Conventionally, a communication packet (hereinafter also referred to as a packet) that passes through a network interface is acquired (hereinafter also referred to as a capture or capture) for each network interface of each communication device that constitutes a packet-switched network, and then the transmission source. Devices and software programs have been developed for generating communication log data including acquired packet information such as an IP address and a destination IP address, and displaying the packet information on a display device. An operator such as a network administrator can use this device or program to check which communication device has a problem when a failure occurs in the packet-switched network, or to send and receive packets as designed. (See Patent Documents 1 to 3).

JP 2007-173931 A. Japanese Patent Application Laid-Open No. 2010-124430.

Takumi Ueda et al., "Implementation of Virtual Router and GUI for Network Education System Using Virtual Linux Environment," Proceedings of the 6th Forum on Information Science and Technology, September 2007, J-026.

  However, conventionally, since communication log data is generated for each network interface of each communication device, an operator understands the contents of the communication log data in order to check how packets are transmitted and received. It was necessary to be able to do this, and further, it was necessary to specify the packet communication path based on a plurality of communication log data.

  The object of the present invention is to solve the above-described problems, and to enable packet operators to easily check packet information transmitted and received between communication devices as compared with the prior art, a packet communication processing apparatus, a control method thereof, a program, and a recording To provide a medium.

A packet communication processing device according to a first aspect of the present invention is a packet communication processing device that processes communication packets transmitted and received within a packet switched network.
Control means for controlling the operation of the packet communication processing device;
An operating system program for controlling the operation of the packet communication processing device and a virtual device program for executing a virtual device function for virtually realizing a communication device that performs communication using a communication packet are stored. The control means executes the virtual device program on the operating system so that a plurality of virtual devices each having at least one network interface and assigned with different virtual device identifiers operate. A storage means for storing an execution program necessary for executing the function of each virtual device and data required for executing the function;
The control means includes
When the communication packet passes through each network interface of each virtual device, the virtual device identifier of the virtual device having the network interface, the network interface name of the network interface, and the communication packet is transmitted or received A communication log packet including a transmission / reception identifier indicating whether the communication packet has been transmitted, a transmission source address included in the communication packet, a destination address included in the communication packet, and data indicating a protocol included in the communication packet;
Generating a communication log file including the generated plurality of communication log packets in a time-series order in which each communication log packet has passed through each network interface, and storing the communication log file in the storage unit;
In the communication log file including the plurality of stored communication log packets, the plurality of communication log packets have the same protocol, and
(A) a communication log packet in which the source address of each communication log packet is the same and the destination address is the same;
(B) The communication log packet in which the destination address of each communication log packet matches the same source address and the communication log packet in which the source address matches the same destination address belongs to the same communication log packet group. The plurality of stored communication log packets are classified.

In the packet communication processing device,
The source address is a source IP address,
The destination address is a destination IP address,
The protocol is characterized in that it is an upper protocol that is higher than the Internet protocol.

In the packet communication processing device,
When the protocol is ICMP (Internet Control Message Protocol), the communication packet includes an ICMP packet identifier for identifying a set of a communication packet for an echo request and a communication packet for an echo response to the echo request, and Further comprising echo identification data including an ICMP packet sequence number;
When the same protocol in the communication log packet group is ICMP in the communication log packet group, the control means includes a communication log packet included in the communication log packet group and a communication log packet having the same echo identification data. It is characterized by belonging to a packet subgroup.

Furthermore, in the packet communication processing device,
The packet communication processing device further includes display means,
The control means includes
(A) a time-series order of communication log packets belonging to the same communication log packet group;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group,
A communication path of a communication packet indicated by each communication log packet belonging to the same communication log packet group is identified, and the communication path of the identified communication packet is displayed on the display means.

Furthermore, in the packet communication processing device,
The packet communication processing device further includes display means,
The control means includes
(A) a time-series order of communication log packets belonging to the same communication log packet group having the same protocol other than ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group having the same protocol other than ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group having the same protocol other than the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means. ,
(A) a time-series order of communication log packets belonging to the same communication log packet subgroup having the same protocol that is ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet subgroup having the same protocol that is ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet subgroup having the same protocol as the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means It is characterized by doing.

In the packet communication processing device,
The communication log packet further includes a source MAC (Media Access Control) address and a destination MAC address,
The control means further displays the transmission source MAC address and the destination MAC address on a communication path of the identified communication packet.

Furthermore, in the packet communication processing device,
The operating system program is Linux (registered trademark),
The virtual device program is user mode Linux.

In the packet communication processing device,
The function of each virtual device is a communication packet routing function or a transmission / reception function.

A control method for a packet communication processing apparatus according to a second invention is a control method for a packet communication processing apparatus for processing a communication packet transmitted and received in a packet switching network,
The packet communication processing device
Control means for controlling the operation of the packet communication processing device;
An operating system program for controlling the operation of the packet communication processing device and a virtual device program for executing a virtual device function for virtually realizing a communication device that performs communication using a communication packet are stored. The control means executes the virtual device program on the operating system so that a plurality of virtual devices each having at least one network interface and assigned with different virtual device identifiers operate. A storage means for storing an execution program necessary for executing the function of each virtual device and data required for executing the function;
The above control method is
When the communication packet passes through each network interface of each virtual device, the control means transmits the virtual device identifier of the virtual device having the network interface, the network interface name of the network interface, and the communication packet. A communication log including a transmission / reception identifier indicating whether the communication packet has been received or received, a transmission source address included in the communication packet, a destination address included in the communication packet, and data indicating a protocol included in the communication packet Generating a packet;
It said control means and storing a plurality of communication logs packets the generated, each communication log packet to generate a communication log file that contains in the order of time series which has passed through said respective network interfaces in the storage means ,
In the communication log file including the plurality of stored communication log packets, the control means has the same protocol among the plurality of communication log packets, and
(A) a communication log packet in which the source address of each communication log packet is the same and the destination address is the same;
(B) The communication log packet in which the destination address of each communication log packet matches the same source address and the communication log packet in which the source address matches the same destination address belongs to the same communication log packet group. And classifying the stored plurality of communication log packets.

In the control method of the packet communication processing device,
The source address is a source IP address,
The destination address is a destination IP address,
The protocol is characterized in that it is an upper protocol that is higher than the Internet protocol.

In the control method of the packet communication processing device,
When the protocol is ICMP, the communication packet includes an ICMP packet identifier and an ICMP packet sequence number for identifying a set of a communication packet for an echo request and a communication packet for an echo response to the echo request. Further including echo identification data;
In the control method, when the same protocol is ICMP in the communication log packet group, the control means converts communication log packets included in the communication log packet group into communication log packets having the same echo identification data. Are further classified into belonging to the same communication log packet subgroup.

Furthermore, in the control method of the packet communication processing device,
The packet communication processing device further includes display means,
In the control method, the control means is
(A) a time-series order of communication log packets belonging to the same communication log packet group;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group,
The method further includes the step of identifying the communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group and displaying the communication path of the identified communication packet on the display means. .

Furthermore, in the control method of the packet communication processing device,
The packet communication processing device further includes display means,
The above control method is
The control means is
(A) a time-series order of communication log packets belonging to the same communication log packet group having the same protocol other than ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group having the same protocol other than ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group having the same protocol other than the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means. Steps,
The control means is
(A) a time-series order of communication log packets belonging to the same communication log packet subgroup having the same protocol that is ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet subgroup having the same protocol that is ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet subgroup having the same protocol as the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means Further comprising the step of:

In the control method of the packet communication processing device,
The communication log packet further includes a source MAC address and a destination MAC address,
The control method further includes a step in which the control means further displays the transmission source MAC address and the destination MAC address on a communication path of the identified communication packet.

Furthermore, in the control method of the packet communication processing device,
The operating system program is Linux (registered trademark),
15. The method of controlling a packet communication processing apparatus according to claim 9, wherein the virtual device program is user mode Linux.

Furthermore, in the control method of the packet communication processing device,
The function of each virtual device is a communication packet routing function or a transmission / reception function.

  A program according to a third aspect of the invention includes each step in the control method for the packet communication processing device.

  A computer-readable recording medium according to a fourth aspect of the present invention stores the above program.

  According to the packet communication processing apparatus, the control method thereof, the program, and the recording medium according to the present invention, when the communication packet passes through each network interface of each virtual device, the virtual device identifier of the virtual device having the network interface; A network interface name of the network interface, a transmission / reception identifier indicating whether the communication packet has been transmitted or received, a source address included in the communication packet, a destination address included in the communication packet, and A communication log file including a communication log packet including data representing a protocol included in the communication packet, and including the generated plurality of communication log packets in a time-series order in which each communication log packet passes through each network interface. To produce the stored in the storage means. Further, in the communication log file including a plurality of stored communication log packets, the communication log files have the same protocol among the plurality of communication log packets, and (a) the source address of each communication log packet is the same A communication log packet having the same destination address and (b) a communication log packet in which the destination address of each communication log packet matches the same source address and the source address matches the same destination address. The plurality of stored communication log packets are classified so as to belong to the communication log packet group. Accordingly, since each communication log packet belonging to the same communication log packet group represents one communication packet, the operator can perform the above-described 1 based on each communication log packet belonging to the same communication log packet group. The communication path of one communication packet can be easily identified and confirmed as compared with the prior art.

It is a block diagram which shows the structure of the network construction exercise apparatus 1 which concerns on embodiment of this invention. It is a flowchart which shows the 1st part of the network construction exercise process performed by CPU2 of FIG. It is a flowchart which shows the 2nd part of the network construction exercise process performed by CPU2 of FIG. It is a flowchart which shows the log display process performed in step S6 of FIG. It is a flowchart which shows the 1st part of the animation display cue list table production | generation process performed in step S12 of FIG. It is a flowchart which shows the 2nd part of the animation display cue list table production | generation process performed in step S12 of FIG. It is a flowchart which shows the animation display process performed in FIG.3 S13. It is a format figure which shows the format of the communication log packet 100 written in each line of the communication log file 55 of FIG. 1 sequentially. FIG. 2 is a format diagram showing a format of an IP packet 200 transmitted / received between virtual devices 4-m (m = 1, 2,..., M) in FIG. ICMP, which is a data body field 215 included in the IP packet 200 of FIG. 9 transmitted and received between the virtual devices 4-m (m = 1, 2,..., M) when the ping command program 51p of FIG. 1 is executed. It is a format figure which shows the format of the (Internet Control Message Protocol) packet 215A. It is a display example of the network construction support window displayed on the display 6 in step S1 of FIG. This is a display example when the “simple” tab is selected in the log display window corresponding to the network interface eth0 of the virtual host Host0 displayed on the display 6 in step S25 of FIG. This is a display example when the “details” tab is selected in the log display window corresponding to the network interface eth0 of the virtual host Host0 displayed on the display 6 in step S25 of FIG. This is a display example when the “hexadecimal data” tab is selected in the log display window corresponding to the network interface eth0 of the virtual host Host0 displayed on the display 6 in step S25 of FIG. It is an example of a display of the animation displayed on the network construction support window in step S63 of FIG. It is another example of a display of the animation displayed on the network diagram of a network construction assistance window in step S63 of FIG.

  Hereinafter, embodiments according to the present invention will be described with reference to the drawings. In addition, in each following embodiment, the same code | symbol is attached | subjected about the same component.

  FIG. 1 is a block diagram showing a configuration of a network construction exercise device 1 according to an embodiment of the present invention. In FIG. 1, a network construction exercise device 1 is a digital computer such as a personal computer, for example, and a virtual network is a packet switching network in which a learner communicates using an IP packet 200 (see FIG. 9) that is a communication packet. It is used as a terminal device for constructing and performing exercises. As will be described in detail later, the network construction exercise device 1 also functions as a packet communication processing device that processes an IP packet 200 (see FIG. 9) transmitted and received in a virtual packet switching network.

As will be described in detail later, the network construction exercise device 1 in FIG.
(A) a CPU (Central Processing Unit) 2 that controls the operation of the network construction exercise device 1;
(B) Virtual devices 4-1 to 4-M for virtually realizing a communication device that performs communication using the operating system program 51 for controlling the operation of the network construction exercise apparatus 1 and the IP packet 200. A hard disk drive 5 for storing a virtual device program 52 for executing the functions of
(C) When the CPU 2 executes the virtual device program 52 on the operating system, there are a plurality of virtual devices 4-1 to 4-M each having at least one network interface and assigned with different virtual device identifiers. In order to operate, a RAM (Random Access Memory) 4 for storing an execution program necessary for executing the functions of the virtual devices 4-1 to 4-M and data necessary for executing the functions is provided. .

Here, the CPU 2
(1) When the IP packet 200 passes through each network interface of each virtual device 4-1 to 4 -M, the virtual device identifier of the virtual device 4-1 to 4 -M having the network interface and the network interface Network interface name, transmission / reception identifier indicating whether the IP packet 200 has been transmitted or received, a source address included in the IP packet 200, a destination address included in the IP packet 200, and Generating a communication log packet 100 including data representing a protocol included in the IP packet 200;
(2) A communication log file 55 including a plurality of generated communication log packets 100 in a time-series order in which each communication log packet 100 passes through each network interface is generated and stored in the hard disk drive 5;
(3) The communication log file 55 including a plurality of stored communication log packets 100 has the same upper protocol among the plurality of communication log packets 100, and
(A) a communication log packet 100 having the same source IP address and the same destination IP address of each communication log packet 100;
(B) The same communication log as the communication log packet 100 in which the destination IP address of each communication log packet 100 matches the same source IP address described above and the source IP address matches the same destination IP address described above. A plurality of stored communication log packets 100 are classified so as to belong to a packet group.

  With reference to FIG. 1, the structure of the network construction exercise apparatus 1 is demonstrated concretely. In FIG. 1, the network construction exercise device 1 includes a CPU 2, a ROM (Read Only Memory) 3, a RAM 4, a hard disk drive 5, a display 6, an operation input unit 7, and a timer circuit 9. The The CPU 2 is connected to the ROM 3, the RAM 4, the hard disk drive 5, the display 6, the operation input unit 7, and the timer circuit 9 via the bus and controls them, and executes various software functions. The display 6 is a display device such as a liquid crystal display device (LCD (Liquid Crystal Display)) or a CRT (Cathode Ray Tube) display, and displays the operation status of the network construction exercise device 1 and various GUIs (Graphic User Interfaces). ) Functions as a display device for the program. Further, the operation input unit 7 includes, for example, a learning device including a pointing device such as a mouse and character input means such as a keyboard, and is used for inputting character data, an instruction command, and the like. The timer circuit 9 generates an output signal indicating the time measured after being reset by the CPU 2 and outputs the output signal to the CPU 2.

  In FIG. 1, the ROM 3 stores various software programs that are necessary for the operation of the network construction exercise device 1 and executed by the CPU 2 in advance. The hard disk drive 5 is a storage device that contains a recording medium. The OS (Operating System) program 51 executed by the CPU 2, the virtual device program 52, and a network construction exercise program 53 including a start capture program 54, Other application programs are stored in advance. Further, the hard disk drive 5 stores a communication log file 55, a queue table 56, and an animation display queue list table 57 that are generated during execution of the network construction exercise process described in detail later with reference to FIGS. To do.

  Further, the RAM 4 is composed of SRAM (Static RAM), DRAM (Dynamic RAM), SDRAM (Synchronous DRAM), etc., and is used as a working area of the CPU 2 to execute each program 51-54 when it is executed. An execution program necessary for executing a function corresponding to the program to be executed, data necessary for executing the function, and temporary data generated at the time of execution are stored.

  Next, each program 51-53 stored in the hard disk drive 5 will be described. In FIG. 1, an OS program 51 is a basic software program that controls the overall operation of the network construction exercise device 1 to perform system management of the network construction exercise device 1 and provide a basic user operation environment. . When the power of the network construction exercise apparatus 1 is turned on, the CPU 2 controls the overall operation of the network construction practice apparatus 1 by executing the OS program 51. In the present embodiment, the OS program 51 is a Linux (registered trademark) program. The Linux (registered trademark) program is a Linux (registered trademark) such as a ping (Packet InterNet Groper (Ping)) command program 51p for transmitting and receiving packets conforming to ICMP (hereinafter referred to as ICMP packet 215A; see FIG. 10). ) Each command program is included.

  The virtual device program 52 is specifically a user mode Linux (UML), and executes a virtual device function for virtually realizing a communication device that performs communication using a packet. This is a virtual OS program. The user mode Linux executes another Linux (registered trademark) as a user mode process in the network construction exercise device 1 which is a real host device that executes a Linux (registered trademark) program as the OS program 51. It is a program. The CPU 2 executes the function of each virtual device 4-m so that each virtual device 4-m (m = 1, 2,..., M) operates by executing the virtual device program 52 on the operating system. The execution program necessary for the execution and the data necessary for executing the execution program are stored in the working area of the RAM 4 (hereinafter referred to as “starting the virtual device 4-m”). In FIG. 1, an execution program necessary for executing the function of the virtual device 4-m and a working area for storing data required for executing the function are indicated as “virtual device 4-m”. In the present embodiment, the function of each virtual device 4-m is a routing function of the IP packet 200 or a transmission / reception function of the IP packet 200. Hereinafter, a virtual device 4-m corresponding to a virtual router that executes a routing function is referred to as a virtual router, and a virtual device 4-m corresponding to a virtual host device that executes a packet transmission / reception function is referred to as a virtual host.

  In the example illustrated in FIG. 1, the virtual device 4-1 that is the virtual host Host0 having the network interface eth0, the virtual device 4-2 that is the virtual router Router0 having the network interfaces eth0 and eth1, and the network interfaces eth0 and eth1 are included. The virtual device 4-3 that is the virtual router Router1 and the virtual device 4-4 that is the virtual host Host1 having the network interface eth0 are respectively activated. The virtual host Host0 and the virtual router Router0 are connected via the network interface eth0 of the virtual host Host0 and the network interface eth1 of the virtual router Router0. The virtual router Router0 and the virtual router Router1 are connected to the network interface of the virtual router Router0. eth0 is connected to the network interface eth0 of the virtual router Router1. Furthermore, the virtual host Host1 and the virtual router Router1 are connected to each other via the network interface eth0 of the virtual host Host1 and the network interface eth1 of the virtual router Router1. The virtual host Host0, the virtual router Router0, the virtual router Router1, and the virtual host Host1 include the source MAC address and the destination MAC address in the IP packet 200 (see FIG. 9) compliant with IPv4 (Internet protocol version 4). The MAC header 300 including the message is added and transmitted and received.

  FIG. 9 is a format diagram showing a format of an IP packet 200 transmitted / received between the virtual devices 4-m (m = 1, 2,..., M) in FIG. In FIG. 9, an IP packet 200 includes an IP header 200h and a data body field 215 that stores a communication packet of an upper protocol higher than IP as data. Here, the higher level protocol is ICMP, UDP (User Datagram Protocol), TCP (Transmission Control Protocol) or ARP (Address Resolution Protocol). Furthermore, the IP header 200h includes the following fields 201-214.

(1) A version number field 201 for storing data representing the version of the IP packet 200.
(2) A header length field 202 for storing data representing the data length of the IP header 200h.
(3) A service type field 203 for storing data representing the characteristics of the service requested by the IP packet 200 to the router.
(4) A packet length field 204 for storing data representing the data length of the IP packet 200.
(5) A packet identifier field 205 that stores a packet identifier for identifying the IP packet 200.
(6) A flag field 206 that stores flag data indicating whether fragmentation of the IP packet 200 is permitted.
(7) When the IP packet 200 is fragmented, a fragment offset field 207 that stores data representing the position of the fragment in the original IP packet 200.
(8) A TTL field 208 that stores data representing the lifetime of the IP packet 200 (Time To Live (TTL)).
(9) A protocol number field 209 that stores a protocol number representing a protocol of data stored in the data body 215 of the IP packet 200 (that is, a higher protocol). The protocol number is 1 when the upper protocol is ICMP, the protocol number is 6 when the upper protocol is TCP, and the protocol number is 17 when the upper protocol is UDP.
(10) A header checksum field 210 that stores data indicating whether or not the content of the IP header 200h is correct.
(11) A source IP address field 211 that stores the source IP address of the IP packet 200.
(12) A destination IP address field 212 for storing the destination IP address of the IP packet 200.
(13) An option field 213 for storing data for instructing to perform a predetermined process when the IP packet 200 is transferred.
(14) A padding field 214 added to make the data length of the IP header 200h an integral multiple of 32 bits.

  FIG. 10 shows the data body included in the IP packet 200 of FIG. 9 that is transmitted and received between the virtual devices 4-m (m = 1, 2,..., M) when the ping command program 51p of FIG. 1 is executed. 4 is a format diagram showing a format of an Internet Control Message Protocol (ICMP) packet 215A, which is a field 215. FIG. In FIG. 10, the ICMP packet 215 </ b> A includes the following fields 301 to 306.

(1) An ICMP type field 301 for storing data representing the type of ICMP packet 215A (hereinafter also referred to as ICMP type). In particular, when the type of the ICMP packet 215A is a communication packet for an echo request transmitted from the transmission source host apparatus when the ping command program 51p is executed, the ICMP type field 301 stores “8”. The ICMP type field 301 stores “0” when the communication packet is an echo response returned from the destination host apparatus when the command program 51p is executed.
(2) A code field 302 for storing “0”.
(3) A checksum field 303 for storing data indicating whether or not the contents of the ICMP packet 215A are correct.
(4) An ICMP packet identifier and an ICMP that are echo identification data for identifying a set of an ICMP packet 215A that is an echo request packet and an ICMP packet 215A that is an echo response packet to the ICMP packet 215A that is the echo request packet An ICMP packet identifier field 304 and an ICMP sequence number field 305 for storing sequence numbers, respectively. The ICMP packet 215A that is an echo request packet and the ICMP packet 215A that is an echo response packet to the ICMP packet 215A that is the echo request packet include the same ICMP packet identifier and the same ICMP sequence number.
(5) A data body field 306 for storing arbitrary data.

  In FIG. 1, the network construction exercise program 53 corresponds to each virtual device 4- that operates on the RAM 4 with respect to the network construction exercise program (e-Netlab) according to the related art described in Non-Patent Document 1. A start capture program 54 for acquiring information of the IP packet 200 that passes through each of the 1-4M network interfaces is added.

  Next, the network construction exercise process executed by the CPU 2 in FIG. 1 will be described with reference to FIGS. 2 and 3 are flowcharts showing the network construction exercise process executed by the CPU 2 of FIG. 1, and FIG. 4 is a flowchart showing the log display process executed in step S6 of FIG. 5 and 6 are flowcharts showing the animation display queue list table generation process executed in step S12 of FIG. 3, and FIG. 7 is a flowchart showing the animation display process executed in step S13 of FIG. It is.

  A learner clicks a predetermined operation (for example, a predetermined icon displayed on the display 6) for executing the network construction exercise program 53 using the operation input unit 7 of the network construction exercise device 1, or a display In response to this, the CPU 2 executes the network construction exercise program 53 and executes the network construction exercise processing. 2, the CPU 2 displays a network construction support window on the display 6. FIG. 11 is a display example of the network construction support window displayed on the display 6 in step S1 of FIG. In FIG. 11, the network construction support window includes a device addition list, a network diagram, a console window, and a device information list. The device addition list includes a router button (Router) representing a virtual router and a host button (Host) representing a virtual host.

  Next, in step S2 of FIG. 2, when the learner drags and drops the router button or host button of the device addition list to the network diagram, an icon corresponding to each virtual device 4-m is added on the network diagram. Further, when the learner selects between the icons of the two virtual devices 4-m on the network diagram with a mouse, the two icons on the network diagram are connected with a line. Further, in FIG. 11, a learner inputs commands for device settings such as an IP address, a netmask, and a default gateway in a command input field of a console window corresponding to each virtual device 4-m for which device settings are performed. be able to. The CPU 2 activates each virtual device 4-m according to information for device setting of each virtual device 4-m input by the learner using the operation input unit 7 and the network construction support window, and connects by the learner. The virtual devices 4-m corresponding to the icon for which the operation has been performed are connected so as to transmit / receive the IP packet 200 to / from each other. At this time, as shown in FIG. 11, the output message from each virtual device 4-m is displayed on the corresponding console window. As shown in FIG. 11, the device information list includes a virtual device name, a virtual device type, an interface name, an IP address, a netmask, and an interface state (for each network interface of each virtual device 4-m. The information of each network interface of each virtual device 4-m such as port setting and VLAN (Virtual Local Area Network) is displayed, which is activated (up) or stopped (down). In addition, when starting each virtual device 4-m, CPU2 allocates the virtual device identifier for identifying each virtual device 4-m with respect to each virtual device 4-m.

  When the process of step S2 in FIG. 2 is completed, the learner uses a console window corresponding to each virtual device 4-m to use Linux (registered trademark) such as the ping command program 51p for each virtual device 4-m. ) Command programs can be executed. As a result, the IP packet 200 is transmitted and received between the virtual devices 4-1 to 4-M.

  Next, in step S3 of FIG. 2, the learner selects the “capture” menu (see FIG. 15) in the menu bar of the network construction support window, and the menu item “start capture” in the “capture” menu. It is determined whether a menu is selected. If YES in step S3, the process proceeds to step S4. If NO, the process proceeds to step S9. In step S <b> 4, the CPU 2 generates an empty communication log file 55 and stores it in the hard disk drive 5.

  In step S5 following step S4, the CPU 2 executes the start capture program 54 for each virtual device 4-m, thereby generating the communication log packet 100 when the IP packet 200 passes through each network interface. Then, the communication log packet acquisition process for sequentially writing the generated communication log packet 100 to each line of the communication log file 55 is started.

  FIG. 8 is a format diagram showing a format of the communication log packet 100 sequentially written in each line of the communication log file 55 of FIG. In FIG. 8, the communication log packet 100 includes a communication log header 100h, a MAC header 300 added to the IP packet 200 that has passed through the network interface, and the IP packet 200 itself that has passed through the network interface. Furthermore, the communication log header 100h includes the following fields 101 to 104.

(1) A virtual device identifier field 101 that stores the virtual device identifier of the virtual device that generated the communication log packet 100.
(2) A network interface name field 102 that stores the network interface name of the network interface through which the IP packet 200 included in the communication log packet 100 passes among the network interfaces of the virtual device that generated the communication log packet 100.
(3) A transmission / reception identifier field 103 that stores a transmission / reception identifier indicating whether the IP packet 200 included in the communication log packet 100 is transmitted or received. The transmission / reception identifier is 1 when the IP packet 200 is transmitted, and the transmission / reception identifier is 0 when the IP packet 200 is received.
(4) A padding field 104 for setting the data length of the communication log header 100h to 32 bits.

  Here, all the virtual devices 4-M are activated in one network construction exercise apparatus 1, and each IP packet 200 passes through each network interface of each virtual device 4-1 to 4-M. Since the communication log packet 100 is generated and written in the last line of the communication log file 55, the communication log file 55 includes each communication log packet 100 in the order of time series in which each IP packet 200 passes through each network interface. .

  As shown in FIG. 1, virtual devices 4-1 to 4-4 are activated, virtual device identifiers 1 to 4 are assigned to the virtual devices 4-1 to 4-4, respectively, and the IP address of the virtual host Host0 is 192.168 .. The generated communication log file 55 will be described using an example in which the IP address of the virtual host Host1 is set to 5.2 and the IP address of the virtual host Host1 is set to 192.168.5.1. In this case, the learner uses the console window corresponding to the virtual host Host0 of FIG. 1 to designate the virtual host Host1 as the destination host device and execute the ping command program 51p, and then from the virtual host Host0 to the virtual host 1. When the UDP IP packet 200 is transmitted, the virtual in each communication log packet 100 stored in the first to the 18th lines of the communication log file 55 generated in the communication log packet acquisition process in step S5 of FIG. Table 1 below shows the device identifier, network interface name, transmission / reception identifier, protocol number, transmission source IP address, destination IP address, ICMP type, ICMP packet identifier, and ICMP packet sequence number. It is.

  As shown in Table 1, the virtual host Host0 transmits an IP packet 200 including an ICMP packet 215A (see FIG. 10) in which “8” representing an echo request packet is stored in the ICMP type field 301 from the network interface eth0. . The IP packet 200 is received by the network interface eth1 of the virtual host Host1 via the network interfaces eth1 and eth0 of the virtual router Router0 and the network interfaces eth0 and eth1 of the virtual router Router1. In response to this, the virtual host Host1 replaces the source IP address stored in the source IP address field 211 of the received IP packet 200 with the destination IP address stored in the destination IP address field 212, and the ICMP type. “0” representing an echo response packet is stored in the field 301, and the data is returned from the network interface eth0 without changing the data stored in the ICMP packet identifier field 304 and the ICMP sequence number field 305, respectively. The communication path information of the IP packet 200 described above is stored in the time series in the first to twelfth lines of the communication log file 55 as shown in Table 1.

  Further, as shown in Table 1, when IP packet data 200 whose upper protocol is UDP is transmitted from the virtual host Host0 to the virtual host Host1 via the virtual router Router0 and the virtual router Router1, the communication of the IP packet 200 is performed. The route information is stored in the chronological order from the 13th line to the 18th line of the communication log file 55.

  Next, referring back to FIG. 2, following step S5, in step S6, the CPU 2 starts the log display process of FIG. In step S21 of FIG. 4, the CPU 2 displays a log display window on the display 6 for each network interface of each virtual device 4-m. Next, in step S22, the CPU 2 resets the timer circuit 9 to start timing, and in step S23, whether 0.2 seconds has elapsed based on the output signal indicating the time measured from the timer circuit 9. Judge whether or not. If YES in step S23, the process proceeds to step S24. If NO, the process of step S23 is repeated. In step S24, the CPU 2 resets the timer circuit 9 to start measuring time, and proceeds to step S25. In step S25, the CPU 2 reads each communication log packet 100 newly added to the communication log file 55, and corresponds to each network interface of each virtual device 4-m based on each read communication log packet 100. The display content of the log display window to be updated is updated, and the process returns to step S23.

  FIG. 12 is a display example when the “simple” tab is selected in the log display window corresponding to the network interface eth0 of the virtual host Host0 displayed on the display 6 in step S25 of FIG. FIG. 14 shows a display example when the “Detail” tab is selected, and FIG. 14 shows a display example when the “Hexadecimal data” tab is selected. As shown in FIGS. 12 to 14, at the left end of the log display window, the packet number of the IP packet 200 that has passed through the network interface eth0 of the virtual host Host0 and the protocol stored in the protocol number field 209 of the IP packet 200 are displayed. An IP packet correspondence table showing a correspondence relationship with the protocol name corresponding to the number is displayed. In addition, an operation panel including a check box for setting the type of transmission or reception of the IP packet 200 displayed in the IP packet correspondence table and the upper protocol among all the IP packets 200 at the upper part of the log display window. Is displayed.

  As shown in FIG. 12, when the “simple” tab is selected in the log display window, the communication log packet 100 included in the communication log file 55 is selected (hatched) in the IP packet correspondence table. Data of the type of transmission or reception included in the communication log packet 100 corresponding to the IP packet 200, upper protocol data, source IP address, destination IP address, source MAC address, and destination MAC address Is displayed. Further, as shown in FIG. 13, when the “details” tab is selected in the log display window, the communication log packet 100 included in the communication log file 55 is selected (hatched) in the IP packet correspondence table. .) Each data included in the communication log packet 100 corresponding to the IP packet 200 is displayed in more detail than when the “Simple” tab is displayed. Further, in FIG. 14, when the “hexadecimal data” tab is selected in the log display window, the communication log packet 100 included in the communication log file 55 is selected (hatched) in the IP packet correspondence table. ) Each data included in the communication log packet 100 corresponding to the IP packet 200 is displayed as hexadecimal data. In FIG. 14, when the “hexadecimal data” tab is selected, the data of each field selected by the learner is colored and displayed for each field or for each layer.

  Next, referring back to FIG. 2, following step S <b> 6, in step S <b> 7, the learner selects the “capture” menu (see FIG. 15) in the menu bar of the network construction support window, and the menu item “ It is determined whether or not the “end capture” menu has been selected. If YES, the process proceeds to step S8. If NO, the process of step S7 is repeated. In step S <b> 8, the CPU 2 ends the communication log packet acquisition process and the log display process, and deletes the communication log file 55 from the hard disk drive 5.

  In step S9 following step S8, the CPU 2 selects the “animation” menu (see FIG. 15) in the menu bar of the network construction support window, and the “animation display” of the menu item in the “animation” menu. It is determined whether or not the menu has been selected. If YES, the process proceeds to step S10. If NO, the process of step S9 is repeated. In step S10, the CPU 2 generates an empty communication log file 55, an empty queue table 56, and an empty animation display queue list table 57 and stores them in the hard disk drive 5, and in step S11, the communication log of step S5. Start packet acquisition processing. Further, the CPU 2 starts the animation display cue list table generation process of FIGS. 5 and 6 in step S12, and starts the animation display process of FIG. 7 in step S13.

  Next, the animation display cue list table generation process executed in step S12 of FIG. 3 will be described with reference to FIGS. In step S31 of FIG. 5, the CPU 2 resets the timer circuit 9 and starts timekeeping. In step S32, based on the output signal indicating the timed time from the timer circuit 9, has 0.2 seconds passed? Judge whether or not. If YES in step S32, the process proceeds to step S33. If NO, the process of step S32 is repeated. In step S33, the CPU 2 resets the timer circuit 9 and starts measuring time.

  Further, in step S34, the CPU 2 reads each communication log packet 100 newly added to the communication log file 55, and reads each communication log packet 100 read from the source IP address, the destination IP address, the protocol number, and so on. Based on the above, it is classified into K communication log packet groups. Then, the K communication log packet groups are stored in the queue table 56 as queues. Each queue includes each communication log packet 100 belonging to the communication log packet group corresponding to each queue, and time-series data of each communication log packet 100.

Specifically, the CPU 2 includes the same protocol number among the communication log packets 100 newly added to the communication log file 55, and
(A) a communication log packet 100 having the same source IP address and the same destination IP address of each communication log packet 100;
(B) The same communication log as the communication log packet 100 in which the destination IP address of each communication log packet 100 matches the same source IP address described above and the source IP address matches the same destination IP address described above. The plurality of stored communication log packets are classified so as to belong to a packet group.

  Therefore, in the example of Table 1, the communication log packet 100 in the communication log file 55 includes a communication log packet group including the communication log packets 100 in the first to twelfth lines of the communication log file 55, and a communication log file. 55 is classified into communication log packet groups including communication log packets 100 in the 13th to 18th lines.

  Next, in FIG. 5, following step S34, in step S35, the initial value 1 is substituted into the queue number k, and in step S36, it is determined whether or not the protocol number corresponding to the kth queue represents ICMP. The If YES in step S36, the process proceeds to step S40. If NO, the process proceeds to step S37.

  In step S37, it is determined whether or not the animation display queue corresponding to the kth queue is included in the animation display queue list table 57. That is, it is determined whether or not the animation display queue list table 57 includes an animation display queue corresponding to the IP packet 200 indicated by the communication log packet 100 included in the kth queue. If YES in step S37, the process proceeds to step S38. If NO, the process proceeds to step S39. In step S38, the CPU 2 adds the k-th queue to the animation display queue corresponding to the k-th queue among the queues in the animation display queue list table 57, and proceeds to step S47. On the other hand, in step S39, the CPU 2 stores the k-th queue as the animation display queue in the animation display queue list table 57, and proceeds to step S47.

  If YES in step S36, in step S40, each communication log packet 100 included in the kth queue is further added to J communication log packet subgroups based on the ICMP packet identifier and the ICMP packet sequence number. Classify. Then, the J communication log packet subgroups are respectively stored in the queue table 56 as a queue. Specifically, the communication log packet 100 included in the k-th queue belongs to the same communication log packet subgroup. The communication log packet 100 having the same ICMP packet identifier and the same ICMP packet sequence number belongs to the same communication log packet subgroup. Classify as follows. For this reason, in the example of Table 1, the queue including the communication log packets 100 in the first to twelfth lines in the communication log file 55 is included in one communication log packet subgroup (that is, J = 1). being classified.

  In step S41 following step S40, the initial value 1 is substituted for the queue number j. In step S42, whether or not the animation display queue corresponding to the j-th queue is included in the animation display queue list table 57. Is judged. That is, it is determined whether or not the animation display queue list table 57 includes the animation display queue corresponding to the IP packet 200 indicated by the communication log packet 100 included in the j-th queue. If YES in step S42, the process proceeds to step S43. If NO, the process proceeds to step S44.

  In step S43, the j-th queue is added to the corresponding animation display queue in the animation display queue list table 57, and the process proceeds to step S45. On the other hand, in step S44, the j-th queue is stored as an animation display queue in the animation display queue list table 57, and the process proceeds to step S45. In step S45, it is determined whether or not the queue number j is equal to the number J of communication log packet subgroups classified in step S40. If YES, 1 is added to the queue number j in step S46, and the process proceeds to step S42. On the other hand, if NO, it is determined in step S47 whether or not the queue number k is equal to the number K of communication log packet groups classified in step S34. If YES in step S47, the process returns to step S32. If NO, 1 is added to the queue number k in step S48, and the process returns to step S36.

  Next, the animation display process executed in step S13 of FIG. 3 will be described with reference to FIG. In step S61 in FIG. 7, the CPU 2 reads out the first animation display queue included in the animation display queue list table 57. Then, in step S62, based on the time-series order of each communication log packet 100 included in the read animation display queue and the virtual device identifier, network interface name, and transmission / reception identifier included in each communication log packet 100, The communication path of the IP packet 200 indicated by the communication log packet 100 included in the read animation display queue is identified. Specifically, the communication path of the IP packet 200 is identified so that the IP packet 200 passes through each network interface in the time series order of each communication log packet 100. Further, the communication path of the identified IP packet 200 is displayed as an animation on the network diagram of the network construction support window. Specifically, on the network diagram, an icon representing the IP packet 200 with the upper protocol name is displayed so as to move from the transmission source virtual device to the destination virtual device at a predetermined speed. Note that icons representing the IP packets 200 are displayed in different colors for each animation display queue.

  Next, in step S64, it is determined whether or not the read animation display queue is the last animation display queue. If YES, the process returns to step S61. If NO, the process proceeds to step S65. In step S65, the next animation display queue included in the animation display queue list table 57 is read, and the process returns to step S62.

  FIG. 15 is a display example of the animation displayed on the network construction support window in step S63 of FIG. In FIG. 15, after an IP packet 200 whose upper protocol is ICMP is transmitted from the network interface eth0 of the virtual host Host0 to the network interface eth1 of the virtual router Router0, the network of the virtual router Router0 to the network of the virtual router Router1 Transmission is performed up to the interface eth0, and further, the state of transmission from the network interface eth1 of the virtual router Router1 to the network interface eth0 of the virtual host Host1 is displayed as an animation.

  FIG. 16 is another display example of the animation displayed on the network diagram of the network construction support window in step S63 of FIG. In FIG. 16, for each network interface of each virtual device, the source IP address, destination IP address, source MAC address, and destination MAC address of the passed IP packet 200 are displayed in the dialog. Since the dialog is displayed in this way, how the learner changes the destination IP address and the destination MAC address each time it passes through each virtual device 4-m (m = 1, 2,..., M). Can be confirmed visually.

  Referring back to FIG. 3, following step S <b> 13, in step S <b> 14, the learner selects the “animation” menu (see FIG. 15) in the menu bar of the network construction support window, and the menu item “animation hidden”. It is determined whether or not the menu has been selected. If YES, the process proceeds to step S15. If NO, the process of step S14 is repeated. In step S <b> 15, the CPU 2 ends the communication log packet acquisition process, the animation display queue list table generation process, and the animation display process, and stores the communication log file 55, the queue table 56, and the animation display queue list table 57. Delete from the hard disk drive 5. Next, in step S16, it is determined whether or not the learner has given a predetermined termination instruction such as a process for closing the network construction support window. If YES, the network construction exercise process is terminated. If NO, step S16 is performed. Return to S3.

As described above, according to the present embodiment, when the IP packet 200 passes through each network interface of each virtual device 4-1 to 4 -M activated on the RAM 4, the CPU 2 performs FIG. As described above, the communication log packet 100 including the communication log header 100h, the MAC header 300 added to the IP packet 200 passing through the network interface, and the IP packet 200 itself passing through the network interface is generated. Then, a communication log file 55 that includes the generated communication log packet 100 in the time-series order that has passed through each IP packet 200 is generated. Further, the CPU 2 has the same upper protocol among the plurality of communication log packets 100 included in the communication log file 55 in the communication log file 55, and
(A) a communication log packet 100 having the same source IP address and the same destination IP address of each communication log packet 100;
(B) The same communication log as the communication log packet 100 in which the destination IP address of each communication log packet 100 matches the same source IP address described above and the source IP address matches the same destination IP address described above. The plurality of stored communication log packets 100 are classified so as to belong to the packet group.

  Accordingly, since each communication log packet 100 belonging to the same communication log packet group represents one IP packet 200, the operator can perform the above-described operation based on each communication log packet 100 belonging to the same communication log packet group. The communication path of the single IP packet 200 can be easily identified and confirmed as compared with the prior art.

  Further, the CPU 2 determines the time series order of the communication log packets 100 belonging to the same communication log packet group or the communication log packet sub group and the communication log packets 100 belonging to the same communication log packet group or the communication log packet sub group. The actual communication path of the IP packet 200 is automatically identified and displayed as an animation based on the virtual device identifier, network interface name, and transmission / reception identifier included in each. Therefore, the learner can visually confirm whether or not the communication path of each IP packet 200 is as set without analyzing the data included in the IP header 200h of the IP packet 200. In addition, the learner can observe how the RIP (Routing Information Protocol) update information is exchanged in the virtual router.

  According to the present embodiment, when the upper protocol is ICMP in the communication log packet group, the communication log packet 100 included in the communication log packet group is the same as the communication log packet 100 having the same echo identification data. To belong to the communication log packet subgroup. Therefore, for example, after the learner executes the ping command program 51p by designating the virtual host Host1 as the destination host device using the console window corresponding to the virtual host Host0 in FIG. When the ping command program 51p is executed by specifying the virtual host Host0 as the destination host device using the corresponding console window, the IP packet 200 is transmitted from the virtual host Host0 to the virtual host Host1, and from the virtual host Host1 to the virtual host Host0. After the reply is displayed as an animation using an icon (for example, a red icon) with the upper protocol name “ICMP” added, the IP packet 200 is sent from the virtual host Host1 to the virtual host Host0. It is, can animate using a different icon how sent back to a virtual host Host1 virtual host Host0 which is appended higher protocol name "ICMP" (e.g., a blue icon.).

  Further, in step S2 of FIG. 2, the learner uses the network construction exercise window to construct each virtual device 4-m (m = 1) so as to construct a virtual packet switched network similar to the actual packet switched network. , 2,..., M), the communication path of the IP packet 200 in the actual packet switching network can be confirmed. For this reason, it is possible to easily identify which communication device has a problem when a failure occurs in an actual packet-switched network as compared with the prior art.

  In the above embodiment, the communication log file 55, the queue table 56, and the animation display queue list table 57 are stored in the hard disk drive 5. However, the present invention is not limited to this, and may be stored in the RAM 4. Further, instead of the RAM 4 and the hard disk drive 5, one storage means may be used.

  Further, as shown in FIG. 8, the communication log packet 100 includes the IP packet 200 itself, but the present invention is not limited to this, and the communication log packet 100 includes the transmission source IP address among the data included in the IP packet 200. And at least the destination IP address and the protocol number. In the above embodiment, the IP packet 200 conforms to IPv4. However, the present invention is not limited to this and may conform to IPv6. In this case, the communication log packet 100 includes the source IP address, the destination IP address, and the data stored in the next header field corresponding to the protocol number field 209 in FIG. 9 among the data included in the IP packet 200. At least it should be included.

  Further, in the above-described embodiment, the OS program 51 of the network construction exercise device 1 is a Linux (registered trademark) program, and the virtual device program 52 is a user mode Linux program. Since each program of Linux (registered trademark) and user mode Linux is free of charge and the source is made public, it is suitable for realizing the inexpensive network construction exercise apparatus 1. In addition, since the user mode Linux is executed as a user mode process, other virtual device programs such as Zen (Xen) or VMware (VMWare (registered trademark)) in terms of fault tolerance and ease of management and modification. It is suitable for stably operating the network construction exercise device 1 as compared with the above. However, the present invention is not limited to this, and the OS program 51 may be an arbitrary OS program, and the virtual device program 52 is an arbitrary virtual device program that can execute the function of the virtual device 41 on the RAM 4. May be.

  Furthermore, in the present embodiment, programs 51 to 54 and data for executing the programs are stored in the hard disk drive 5 in advance. However, the present invention is not limited to this, and includes a controller such as a computer that stores programs 51 to 54 recorded on a computer-readable recording medium such as a CD-ROM or DVD and data for the execution thereof. It may be read by the optical disk drive and stored in the hard disk drive 5 via the external interface of the network construction exercise apparatus 1 or the Internet.

  As described above, according to the packet communication processing apparatus, the control method thereof, the program, and the recording medium according to the present invention, when a communication packet passes through each network interface of each virtual device, the virtual device having the network interface Virtual device identifier, network interface name of the network interface, transmission / reception identifier indicating whether the communication packet has been transmitted or received, a source address included in the communication packet, and included in the communication packet A communication log packet including a destination address to be transmitted and data representing a protocol included in the communication packet, and a plurality of the generated communication log packets in the order of time series in which each communication log packet passes through each network interface. It generates a communication log file that contains it stored in the storage means. Further, in the communication log file including a plurality of stored communication log packets, the communication log files have the same protocol among the plurality of communication log packets, and (a) the source address of each communication log packet is the same A communication log packet having the same destination address and (b) a communication log packet in which the destination address of each communication log packet matches the same source address and the source address matches the same destination address. The plurality of stored communication log packets are classified so as to belong to the communication log packet group. Accordingly, since each communication log packet belonging to the same communication log packet group represents one communication packet, the operator can perform the above-described 1 based on each communication log packet belonging to the same communication log packet group. The communication path of one communication packet can be easily identified and confirmed as compared with the prior art.

1 ... Network construction exercise device,
2 ... CPU,
3 ... ROM,
4 ... RAM,
4-1 to 4-M ... virtual devices,
5. Hard disk drive,
6 ... Display,
7 ... operation input part,
9: Timer circuit,
51. OS program,
51p ... Ping command program,
52 ... Virtual device program,
53 ... Network construction exercise program,
54 ... Start capture program,
55 ... Communication log file,
56 ... Queue table,
57 ... Animation display cue list table,
100: Communication log packet,
200: IP packet.

Claims (18)

A packet communication processing device for processing communication packets transmitted and received in a packet switched network,
Control means for controlling the operation of the packet communication processing device;
An operating system program for controlling the operation of the packet communication processing device and a virtual device program for executing a virtual device function for virtually realizing a communication device that performs communication using a communication packet are stored. The control means executes the virtual device program on the operating system so that a plurality of virtual devices each having at least one network interface and assigned with different virtual device identifiers operate. A storage means for storing an execution program necessary for executing the function of each virtual device and data required for executing the function;
The control means includes
When the communication packet passes through each network interface of each virtual device, the virtual device identifier of the virtual device having the network interface, the network interface name of the network interface, and the communication packet is transmitted or received A communication log packet including a transmission / reception identifier indicating whether the communication packet has been transmitted, a transmission source address included in the communication packet, a destination address included in the communication packet, and data indicating a protocol included in the communication packet;
Generating a communication log file including the generated plurality of communication log packets in a time-series order in which each communication log packet has passed through each network interface, and storing the communication log file in the storage unit;
In the communication log file including the plurality of stored communication log packets, the plurality of communication log packets have the same protocol, and
(A) a communication log packet in which the source address of each communication log packet is the same and the destination address is the same;
(B) The communication log packet in which the destination address of each communication log packet matches the same source address and the communication log packet in which the source address matches the same destination address belongs to the same communication log packet group. A packet communication processing apparatus for classifying the plurality of stored communication log packets. The source address is a source IP (Internet Protocol) address,
The destination address is a destination IP address,
2. The packet communication processing apparatus according to claim 1, wherein the protocol is an upper protocol that is higher than the Internet protocol. When the protocol is ICMP (Internet Control Message Protocol), the communication packet includes an ICMP packet identifier for identifying a set of a communication packet for an echo request and a communication packet for an echo response to the echo request, and Further comprising echo identification data including an ICMP packet sequence number;
When the same protocol in the communication log packet group is ICMP in the communication log packet group, the control means includes a communication log packet included in the communication log packet group and a communication log packet having the same echo identification data. 3. The packet communication processing device according to claim 2, wherein the packet communication processing device is classified so as to belong to a packet subgroup. The packet communication processing device further includes display means,
The control means includes
(A) a time-series order of communication log packets belonging to the same communication log packet group;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group,
2. The communication path of a communication packet indicated by each communication log packet belonging to the same communication log packet group is identified, and the communication path of the identified communication packet is displayed on the display means. 3. The packet communication processing device according to 2. The packet communication processing device further includes display means,
The control means includes
(A) a time-series order of communication log packets belonging to the same communication log packet group having the same protocol other than ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group having the same protocol other than ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group having the same protocol other than the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means. ,
(A) a time-series order of communication log packets belonging to the same communication log packet subgroup having the same protocol that is ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet subgroup having the same protocol that is ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet subgroup having the same protocol as the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means The packet communication processing device according to claim 3, wherein: The communication log packet further includes a source MAC (Media Access Control) address and a destination MAC address,
6. The packet communication processing device according to claim 4, wherein the control means further displays the transmission source MAC address and the destination MAC address on a communication path of the identified communication packet. The operating system program is Linux (registered trademark),
7. The packet communication processing apparatus according to claim 1, wherein the virtual device program is user mode Linux.   8. The packet communication processing apparatus according to claim 1, wherein the function of each virtual device is a routing function or a transmission / reception function of the communication packet. A method for controlling a packet communication processing device for processing communication packets transmitted and received in a packet switched network,
The packet communication processing device
Control means for controlling the operation of the packet communication processing device;
An operating system program for controlling the operation of the packet communication processing device and a virtual device program for executing a virtual device function for virtually realizing a communication device that performs communication using a communication packet are stored. The control means executes the virtual device program on the operating system so that a plurality of virtual devices each having at least one network interface and assigned with different virtual device identifiers operate. A storage means for storing an execution program necessary for executing the function of each virtual device and data required for executing the function;
The above control method is
When the communication packet passes through each network interface of each virtual device, the control means transmits the virtual device identifier of the virtual device having the network interface, the network interface name of the network interface, and the communication packet. A communication log including a transmission / reception identifier indicating whether the communication packet has been received or received, a transmission source address included in the communication packet, a destination address included in the communication packet, and data indicating a protocol included in the communication packet Generating a packet;
It said control means and storing a plurality of communication logs packets the generated, each communication log packet to generate a communication log file that contains in the order of time series which has passed through said respective network interfaces in the storage means ,
In the communication log file including the plurality of stored communication log packets, the control means has the same protocol among the plurality of communication log packets, and
(A) a communication log packet in which the source address of each communication log packet is the same and the destination address is the same;
(B) The communication log packet in which the destination address of each communication log packet matches the same source address and the communication log packet in which the source address matches the same destination address belongs to the same communication log packet group. And a step of classifying the stored plurality of communication log packets. A method for controlling a packet communication processing apparatus, comprising: The source address is a source IP address,
The destination address is a destination IP address,
10. The method for controlling a packet communication processing apparatus according to claim 9, wherein the protocol is an upper protocol that is higher than the Internet protocol. When the protocol is ICMP, the communication packet includes an ICMP packet identifier and an ICMP packet sequence number for identifying a set of a communication packet for an echo request and a communication packet for an echo response to the echo request. Further including echo identification data;
In the control method, when the same protocol is ICMP in the communication log packet group, the control means converts communication log packets included in the communication log packet group into communication log packets having the same echo identification data. The packet communication processing device control method according to claim 10, further comprising a step of classifying the packets so as to belong to the same communication log packet subgroup. The packet communication processing device further includes display means,
In the control method, the control means is
(A) a time-series order of communication log packets belonging to the same communication log packet group;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group,
The method further includes the step of identifying the communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group and displaying the communication path of the identified communication packet on the display means. The method for controlling a packet communication processing apparatus according to claim 9 or 10. The packet communication processing device further includes display means,
The above control method is
The control means is
(A) a time-series order of communication log packets belonging to the same communication log packet group having the same protocol other than ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet group having the same protocol other than ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet group having the same protocol other than the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means. Steps,
The control means is
(A) a time-series order of communication log packets belonging to the same communication log packet subgroup having the same protocol that is ICMP;
(B) Based on the virtual device identifier, the network interface name, and the transmission / reception identifier included in each communication log packet belonging to the same communication log packet subgroup having the same protocol that is ICMP,
The communication path of the communication packet indicated by each communication log packet belonging to the same communication log packet subgroup having the same protocol as the ICMP is identified, and the communication path of the identified communication packet is displayed on the display means The method for controlling a packet communication processing apparatus according to claim 11, further comprising: The communication log packet further includes a source MAC address and a destination MAC address,
14. The control method further includes a step in which the control means further displays the source MAC address and the destination MAC address on a communication path of the identified communication packet. Control method for packet communication processing apparatus. The operating system program is Linux (registered trademark),
15. The method of controlling a packet communication processing apparatus according to claim 9, wherein the virtual device program is user mode Linux.   16. The packet communication processing device control method according to claim 9, wherein the function of each virtual device is a routing function or a transmission / reception function of the communication packet.   A program comprising the steps of the control method for a packet communication processing device according to any one of claims 9 to 16.   A computer-readable recording medium storing the program according to claim 17.