JP5819211B2 - Packet capture device and program - Google Patents

Description

  The present invention relates to an apparatus for acquiring (capturing) a packet from a network to be monitored and a program executed in the apparatus.

  In this specification, a network device having a function of acquiring a packet from a network to be monitored and presenting it to the administrator in accordance with an operation input from the administrator engaged in the monitoring work is referred to as a “monitoring device”. A network device operated by an administrator for the purpose of controlling the operation of the monitoring device is referred to as an “administrator terminal”.

Existing monitoring devices are mainly classified into the following two types.
(1) The monitoring device and administrator terminal are provided as separate devices. The monitoring device connected to the network has a built-in storage device, and packets acquired from the network are temporarily stored in the storage device. The temporarily stored packet is read from the storage device in response to an instruction input given from the administrator terminal, and is output to the administrator terminal.
(2) The monitoring device and the administrator terminal are provided as one device. Dedicated software for monitoring packets flowing on the network is installed in the administrator terminal connected to the network. The administrator terminal acquires a packet from the network through a function provided by the dedicated software, and stores it in a storage device in the administrator terminal.

JP 2009-253907 A

  FIG. 1 shows a connection form corresponding to the classification (1). A LAN (Local Area Network) to be monitored includes a network hub 1 and three computers 2, 3, and 4 connected to the ports. In the case of FIG. 1, the network hub 1 has eight ports, three of which are used for connection to the computers 2, 3, 4 and one of them is used for connection to another LAN. Yes.

  In the case of classification (1), a monitoring device 5 that monitors the network is connected to the network hub 1 via a LAN cable. When the network hub 1 does not have a switching function, the monitoring device 5 can be connected to any unused port. This is because the network hub 1 not equipped with the switching function outputs a packet input to one port to all other ports. On the other hand, when the network hub 1 is equipped with a switching function, the connection destination of the monitoring device 5 is limited to the mirror port of the network hub 1. A hub having a switching function is also called a switching hub.

  As shown in FIG. 1, the monitoring device 5 includes a packet acquisition unit 51, a storage device 52, and a controller 53. An administrator terminal 6 is connected to the monitoring device 5 through a LAN cable or the like. The monitoring device 5 acquires a packet through the packet acquisition unit 51 and stores the acquired packet in the storage 52. This storage is generally continued until the packet acquisition is completed. The packet recorded in the storage device 52 is read according to the read instruction given from the administrator terminal 6 and provided to the administrator terminal 6. For example, the administrator terminal 6 displays the provided packet on the administrator screen of the display device.

However, the classification (1) device configuration has the following problems.
(1-1) The storage device 52 and its control mechanism need to be integrated into the monitoring device 5. For this reason, the manufacture of the monitoring device 5 becomes complicated and the cost increases. Further, the deterioration of the storage apparatus 52 becomes a factor that causes the monitoring apparatus 5 to fail.
(1-2) The upper limit of the continuously recordable data amount is limited by the capacity of the storage device 52.
(1-3) In order to control the operation of the monitoring device 5, the administrator terminal 6 needs to give a packet recording start instruction, a packet recording end instruction, and a packet reading instruction to the storage apparatus 52.
(1-4) Temporary storage of a packet in the storage device 52 of the monitoring device 5 is considered to be a copy of the packet to be monitored. When the confidentiality of communication data is required, a function / mechanism for prohibiting unauthorized reading of packets temporarily stored in the storage device 52, and a packet stored in the storage device 52 are securely deleted. Functions and mechanisms are required.

  On the other hand, in the case of classification (2), it is necessary to install dedicated software on the administrator terminal connected to the network and monitor the packets flowing through the network. In this case, the administrator terminal directly acquires the packet from the network and records it in the internal storage device. Further, the administrator terminal displays the acquired packet information on the screen of the display device, and provides the information to the administrator. The device configuration of classification (2) does not require a separate monitoring device 5 unlike the device configuration of classification (1). Moreover, the device configuration of category (2) can use a large-capacity storage device for storing the acquired packets. For this reason, it is considered that all the problems pointed out in the classification (1) device configuration can be solved.

However, the classification (2) device configuration has the following problems.
(2-1) It is necessary to install dedicated software for acquiring packets on the administrator terminal. In addition, a specific type of terminal device for operating dedicated software is required.
(2-2) It is necessary to connect the administrator terminal directly to the network to be monitored. On the other hand, it is necessary to take measures to prevent both the network to be monitored and the administrator terminal from affecting each other.
(2-3) To monitor multiple networks at the same time, it is necessary to equip the administrator terminal with multiple network interfaces. However, it is difficult to obtain such an administrator terminal. If an administrator terminal equipped with a plurality of network interfaces is specially ordered, there is a problem that the management cost increases.

Accordingly, the present inventors have saved from a wired network to be monitored as a device for acquiring a packet, the packet acquisition unit that acquires a packet from the network to be monitored, the information of the packet that the packet acquisition unit has acquired, within It proposes what has the HTTP server which converts and transfers to a HyperText Transfer Protocol (HTTP) form immediately without doing. That is, in the case of the packet capture device according to the present invention, the packet acquired from the network is acquired and sequentially output to the administrator device in the HTTP format without temporarily storing it in the device.

  According to the present invention, it is possible to eliminate the necessity of providing a storage device in the packet capture device. For this reason, the internal configuration of the packet capture device is simplified, and the design cost and manufacturing cost can be greatly reduced as compared with the conventional device. In addition, since the storage device is not built in the packet capture device which is a removal device, the upper limit of the monitoring time depending on the storage capacity can be virtually eliminated. Further, since the packet capture device can be controlled simply by instructing acquisition start and acquisition end, the instruction command can be simplified as compared with the conventional device. Further, since duplicate packets do not remain in the packet capture device, security security and maintenance work can be eliminated. When the packet capture device according to the present invention is used, the administrator terminal only needs to have a web browser and a network interface, and does not require a special hardware configuration or software configuration. In addition, even if it is desired to monitor a plurality of networks at the same time, it can be handled only by installing a plurality of network interfaces on the packet capture device side, and does not require a special administrator terminal as in the conventional device. For this reason, the cost as the whole monitoring system can be minimized. When the packet capture device according to the present invention is used, the administrator terminal can be separated from the network to be monitored. As a result, it is not necessary to consider the influence of each other on both the network and the administrator terminal.

The figure which shows the connection form in the case of using a conventional apparatus. The figure which shows the connection form in the case of using the packet capture apparatus which concerns on an Example. The figure which shows the example of a GUI screen of an administrator terminal. The figure explaining the other example of a connection of a packet capture apparatus.

  Embodiments of the present invention will be described below with reference to the drawings. In addition, the Example mentioned later is described from the viewpoint which demonstrates invention based on an application clearly. Therefore, the present invention is not limited to the configuration described later, and may include a configuration in which components (not shown) are added and a configuration in which some of the components are replaced with other components.

[Example 1]
[System configuration]
FIG. 2 shows a connection form using the packet capture device according to the embodiment. In FIG. 2, parts corresponding to those in FIG. 1 are denoted by the same reference numerals. The packet capture device 500 here is a kind of monitoring device, and is prepared separately from the administrator terminal 600. In the case of FIG. 2, the administrator terminal 600 is externally connected to the hard disk device 601. Of course, the hard disk device 601 may be incorporated in the administrator terminal 600.

[Configuration of packet capture device]
The packet capture device 500 is configured as a microcomputer having a network interface in terms of hardware. That is, the packet capture device 500 stores network interfaces 503 and 504, a processor (not shown), a RAM (Random Access Memory) (not shown) that provides a work area, HTTP server software, packet acquisition software, and an operation system. And a ROM (Read Only Memory) (not shown).

  As described above, one of the hardware features is that the packet capture device 500 according to the present embodiment does not include a storage device for temporarily storing packets. The network interface 503 is for connection with the network hub 1, and the network interface 504 is for connection with the administrator terminal 600.

  FIG. 2 shows a software configuration of the packet capture device 500 after application software (HTTP server software and packet acquisition software) is started on the operation system.

  As shown in FIG. 2, the packet capture device 500 includes a packet acquisition unit 501 and an HTTP server 502.

  The packet acquisition unit 501 is a functional unit that controls whether or not a packet transmitted / received via the network hub 1 is taken into the HTTP server 502. Here, when the network hub 1 is not equipped with a switch function, the LAN cable can be connected to an arbitrary port. However, when the network hub 1 has a switch function, the LAN cable is connected to the mirror port of the network hub 1. As a result of this connection, the packet acquisition unit 501 receives the same packet input to any port of the network hub 1.

  When packet acquisition is started, the packet acquisition unit 501 sequentially outputs packets input from the network hub 1 to the HTTP server 502. Acquisition of a packet is started when an acquisition start instruction is given. When packet acquisition has not started or ended, the packet acquisition unit 501 does not give a packet input from the network hub 1 to the HTTP server 502. That is, the packet acquisition unit 501 functions as a gate that switches between acquisition and discard of a packet. Note that packet acquisition ends when an acquisition end instruction is given.

  The HTTP server 502 immediately converts the packet acquired by the packet acquisition unit 501 into a text format conforming to HTTP (HyperText Transfer Protocol), and transfers it to the administrator terminal 600. That is, the packet capture device 500 of this embodiment immediately converts the acquired packet into a format that can be viewed with a web browser, and transfers the packet to the administrator terminal 600. The packet capture device 500 and the administrator terminal 600 are connected via a LAN cable.

  The administrator terminal 600 is configured by a computer having a network interface in terms of hardware. The administrator terminal 600 can use at least a web browser in terms of software. A GUI (Graphical User Interface) screen displayed on the screen of the display device through a web browser is used for inputting an instruction to the packet capture device 500 and browsing the acquired packet.

  FIG. 3 shows a display example of the GUI screen 700 used in this embodiment. On the GUI screen 700, at least an acquisition / viewing start button 701, an acquisition / viewing end button 702, a browsing window 703, an acquisition / recording start button 704, and an acquisition / recording end button 705 are arranged. The instruction command issued in response to the button operation is output from the administrator terminal 600 to the packet capture device 500 via the LAN cable.

  When the packet acquisition / browsing button 701 is operated, the administrator terminal 600 inputs data in a text format compliant with HTTP to the web browser and displays it in the browsing window. In the browsing window, a text line representing information on the packet acquired by the packet capture device 500 is added to the last line in the order of arrival. The addition of the text line is continued until the packet acquisition is completed. When the packet recording is instructed simultaneously with the acquisition of the packet, the administrator terminal 600 records the text line on the hard disk device 601 in parallel with the display of the packet information.

  The operations of the acquisition / browsing start button 701 and the acquisition / browsing end button 702 and the operations of the acquisition / recording start button 704 and the acquisition / recording end button 705 are independent of each other. Therefore, the recording of the acquired packet information can be started or the recording of the packet information can be continued even after the browsing is stopped.

  The number of lines of text that can be recorded physically depends on the storage capacity of the hard disk device 601. In general, the storage capacity of the hard disk device 601 is sufficient for recording text lines. Therefore, in the case of the present embodiment, it is possible to store unlimited number of packet information acquired as monitoring targets. The updating of the display content of the browsing window and the storage of the text line in the hard disk device 601 are continued until the packet capture by the packet capture device 500 is completed.

  In the case of the present embodiment, as shown in FIG. 2, the administrator terminal 600 is connected to the packet capture device 500 and is not physically connected to the LAN to be monitored. That is, the LAN and the administrator terminal 600 do not exist in the same network and are independent of each other.

[Operation from installation of packet capture device to end of packet capture]
[Installation work]
(1) Connection of Packet Capture Device 500 to Monitored LAN A manager engaged in monitoring work connects the packet capture device 500 to a LAN to be managed. Specifically, the administrator connects the packet capture device 500 and a predetermined port of the network hub 1 with a LAN cable. The packet capture device 500 is used only for acquiring packets from the network hub 1. For this reason, it is not necessary to set an IP address in the network interface of the packet capture device 500 connected to the network hub 1. This means that the connection of the packet capture device 500 to the LAN does not affect the flow of any packet on the LAN to be monitored.

(2) Connection between Packet Capture Device 500 and Administrator Terminal 600 An administrator who is engaged in monitoring work connects the administrator terminal 600 to the packet capture device 500 with a LAN cable. When the administrator terminal 600 is connected to the packet capture device 500, the administrator terminal 600 requests automatic IP address assignment based on DHCP (Dynamic Host Configuration Protocol). The packet capture device 500 that has received this request determines an IP address and responds to the administrator terminal 600 that is the request source. The IP address here is valid only between the packet capture device 500 and the administrator terminal 600, and is irrelevant to the LAN to be monitored.

[View Packet]
(1) Display of Operation GUI Screen An administrator who is engaged in monitoring work accesses the HTTP server 502 of the packet capture device 500 using the web browser of the administrator terminal 600 and displays the operation GUI. Specifically, the following procedure is executed.
(1-1) The packet capture device 500 distributes the operation menu to the web browser of the administrator terminal 600 in the HTML (HyperText Markup Language) format.
(1-2) The web browser of the administrator terminal 600 displays the GUI screen 700 (FIG. 3) corresponding to the operation menu on the screen of the display device.

(2) Packet Acquisition and Browsing When the administrator inputs a packet acquisition / browsing start operation on the GUI screen 700, the contents of the packet are sequentially displayed on the GUI screen 700. Specifically, the following procedure is executed.
(2-1) First, the administrator clicks on the acquisition / browsing start button 701 on the GUI screen 700. Then, an HTTP request instructing start of packet acquisition is transmitted from the web browser to the HTTP server 502.
(2-2) When the HTTP server 502 receives an HTTP request for instructing start of packet acquisition, the HTTP server 502 instructs the packet acquisition unit 501 to start acquisition of a packet.
(2-3) Each time the packet acquisition unit 501 receives a packet, the packet acquisition unit 501 transmits the acquired packet as an HTTP response to the web browser of the administrator terminal 600.
(2-4) Each time a web browser receives a packet, the web browser displays information on the received packet in the browsing window 703 of the GUI screen 700.
(2-5) The administrator clicks the acquisition / browsing end button 702 on the GUI screen 700. Then, an HTTP request instructing completion of packet acquisition is transmitted from the web browser to the HTTP server 502.
(2-6) When receiving the HTTP request for instructing the end of packet acquisition, the HTTP server 502 instructs the packet acquisition unit 501 to stop acquiring the packet, and at the same time ends the transmission of data to the web browser.

[Packet acquisition / recording]
Here, a case where the acquired packet is recorded in the hard disk device 601 without browsing will be described. However, the packet can be recorded in the hard disk device 601 while browsing the packet information.
(1) Display of Operation GUI Screen An administrator who is engaged in monitoring work accesses the HTTP server 502 of the packet capture device 500 using the web browser of the administrator terminal 600 and operates the operation GUI screen 700 (FIG. 3). ) Is displayed on the screen of the display device. Specifically, the following procedure is executed.
(1-1) The packet capture device 500 distributes the operation menu to the web browser of the administrator terminal 600 in the HTML (HyperText Markup Language) format.
(1-2) The web browser of the administrator terminal 600 displays the GUI screen 700 (FIG. 3) corresponding to the operation menu on the screen of the display device.

(2) Packet Acquisition and Recording When the administrator inputs a packet acquisition / recording start operation on the GUI screen 700, the acquired packet information is downloaded to the web browser and stored in the hard disk device 601 as a download file. The Each time a new packet is acquired, a text line representing the information is added to the last line of the document constituting the download file. Specifically, the following procedure is executed.
(2-1) The administrator clicks the acquisition / record button 704 on the GUI screen 700. Then, an HTTP request instructing start of packet acquisition is transmitted from the web browser to the HTTP server 502.
(2-2) When the HTTP server 502 receives an HTTP request for instructing start of packet acquisition, the HTTP server 502 instructs the packet acquisition unit 501 to start acquisition of a packet.
(2-3) Each time a program that acquires a packet receives the packet, the program transmits the acquired packet to the web browser of the administrator terminal 600 as an HTTP response.
(2-4) The web browser receives the packet as a part of the download file, and sequentially records the packet in a file on the hard disk device 601 each time it is received.
(2-5) The administrator clicks on the acquisition / recording end button 705 on the GUI screen 700. Then, an HTTP request instructing completion of packet acquisition is transmitted from the web browser to the HTTP server 502.
(2-6) When receiving the HTTP request for instructing the end of packet acquisition, the HTTP server 502 instructs the packet acquisition unit 501 to stop acquiring the packet, and at the same time ends the transmission of data to the web browser.

[Effect of Example]
The packet capture device 500 described in the present embodiment has the following technical effects as compared to existing devices.
(1) The packet capture device 500 does not need to incorporate a large-capacity storage device or its control mechanism in the device. For this reason, the design process and manufacturing process of the packet capture device 500 can be simplified. Therefore, the packet capture device 500 according to the present embodiment can be manufactured at a lower cost than a conventional device that needs to incorporate a storage device. Further, in the case of the conventional apparatus, there is a possibility of a failure due to a design failure / manufacturing failure / aging deterioration of the storage device and its control unit. However, the packet capture device 500 according to the present embodiment is concerned about this. There is no. For this reason, the packet capture device 500 according to the present embodiment is excellent in robustness.

(2) Since the packet capture device 500 does not temporarily store a packet acquired therein, there is virtually no limit on the amount of data that can be continuously browsed or recorded. For this reason, continuous recording and browsing with a large amount of time can be performed.
(3) Since the packet capture device 500 does not have a storage device, unlike the conventional device, there is no need to externally input and write data to and from the internal storage device. For this reason, there are basically only two types of instruction input to the packet capture device 500, that is, packet acquisition start and acquisition end. That is, the instruction content for the packet capture device 500 can be simplified. In the above description of the embodiment, the operation buttons are divided between browsing and recording of the acquired capture. However, the browsing process and the recording process corresponding to these buttons are executed on the administrator terminal side. Accordingly, there are only two types of processing to be supported by the packet capture device 500, that is, start and end of packet acquisition.

(4) Due to the mechanism of the packet capture device 500 according to the present embodiment, packets acquired from the LAN are not duplicated within the device. That is, the packet capture device 500 does not hold duplicate data of packets acquired from the LAN. For this reason, it is not necessary to secure and maintain the packet capture device 500 from the viewpoint of maintaining confidentiality, and the management burden is reduced accordingly.
(5) In this embodiment, the packet capture device 500 and the administrator terminal 600 are prepared as separate devices that are independent of each other. For this reason, unlike the conventional apparatus, it is not necessary to install dedicated software on the administrator terminal or adopt a special hardware configuration. Actually, the conditions required for the administrator terminal 600 according to this embodiment are to have a network interface and to be able to use a web browser. Therefore, the administrator terminal 600 can use a general personal computer.

(6) In the case of this embodiment, if it is desired to monitor a plurality of LANs at the same time, the packet capture device 500 need only be equipped with a plurality of network interfaces, and there is no need to prepare a special administrator terminal. Note that one end side of the plurality of network interfaces may be connected to one packet acquisition unit 501 or to a packet acquisition unit 501 prepared individually.
(7) In this embodiment, the LAN to be monitored and the administrator terminal 600 are not on the same network. For this reason, it is not necessary to consider the influence which the administrator terminal 600 and LAN have on both.

[Example 2]
The packet capture device 500 according to the first embodiment is assumed to be connected to the network hub 1 and is assumed to monitor communication between terminal devices connected to the network hub 1. However, as shown in FIG. 4A, a usage pattern in which communication between a network hub 1 and a specific computer 4 connected via a LAN cable is monitored is also conceivable.

  In this case, as shown in FIG. 4B, the tap device 800 is connected between the network hub 1 and the computer 4, and the packet capture device having the internal structure shown in FIG. If 500 is connected, packet acquisition and browsing / recording can be realized as in the first embodiment.

  However, as illustrated in FIG. 4C, the tap device 800 may be built in the packet capture device 900. FIG. 4C shows a packet repeater 903 that provides the same communication operation as the tap device 800. The packet capture device 900 includes three network interfaces 910, 911, and 912 for packet inspection, a packet relay 903, a packet acquisition unit 501, and an HTTP server 502. The network interface 910 is for connection with the computer 4, and the network interface 911 is for connection with the network hub 1. The network interface 912 is for connection with the administrator terminal 600.

  The packet relay 903 is connected between the two network interfaces, and bidirectionally relays packets transmitted and received between the network hub 1 and the computer 4. The packet relay 903 is provided with a monitoring port 904. From the monitoring port 904, a duplicate packet of a packet transmitted and received between the network hub 1 and the computer 4 is output. The packet acquisition unit 501 is connected to the monitoring port 904. Even in the case of such an apparatus configuration, packet acquisition / viewing / recording can be realized by the same technique as in the first embodiment.

[Other embodiments]
In the above description of the embodiment, a computer is exemplified as a terminal device connected to the LAN, but the terminal device may be an ONU (Optical Network Unit), a router, an IP telephone, an adapter, or the like. In addition, if it is a device having a network interface, so-called white goods are also included.

  Further, in the description of the above-described embodiment, the case where a packet to be transmitted and received between physically existing terminal devices is a monitoring target has been described. However, at least one terminal device involved in transmission / reception of a packet to be monitored may be a virtual machine. That is, the packet capture device 500 according to the present embodiment can be used for monitoring packets transmitted and received between virtual machines and for monitoring packets transmitted and received between virtual machines and host terminals.

DESCRIPTION OF SYMBOLS 1 ... Network hub 2, 3, 4 ... Computer 5 ... Monitoring apparatus 6 ... Manager terminal 51 ... Packet acquisition part 52 ... Storage apparatus 53 ... Controller 500 ... Packet capture apparatus 501 ... Packet acquisition part 502 ... HTTP server 503, 504 ... Network interface 600 ... Administrator terminal 601 ... Hard disk device 700 ... GUI screen 701 ... Acquisition / browsing start button 702 ... Acquisition / browsing end button 703 ... Browsing window 704 ... Acquisition / recording start button 705 ... Acquisition / recording end button 800 ... Tap device 801 ... Monitoring port 900 ... Packet capture device 903 ... Packet relay 904 ... Monitoring port 910, 911, 912 ... Network interface

Claims (7)

A packet acquisition unit that acquires packets from the network to be monitored;
A packet capture device comprising: an HTTP server that immediately converts the packet information acquired by the packet acquisition unit into an HTTP (HyperText Transfer Protocol) format and transfers the information without storing the packet information therein. The packet capture device according to claim 1,
The HTTP server delivers an operation menu of the packet capture device to an administrator terminal in an HTML (HyperText Markup Language) format. The packet capture device according to claim 1,
A first network interface connected to an input end of the packet acquisition unit;
A second network interface connected to the output end of the HTTP server;
A packet capture device. The packet capture device according to claim 1,
A packet relay that relays packet transmission / reception between the third network interface and the fourth network interface and outputs a duplicate packet of the relayed packet to the monitoring port;
The packet capture device, wherein the monitoring port is connected to an input terminal of the packet acquisition unit, and a fifth network interface is connected to an output terminal of the HTTP server. The packet capture device according to claim 1,
The packet acquisition unit acquires a packet from the network to be monitored only while connected by HTTP from an administrator terminal.
A packet capture device. The packet capture device according to claim 1,
The packet acquisition unit acquires a packet from the network to be monitored only while communicating with the administrator terminal.
A packet capture device. In a computer mounted on a packet capture device having at least one port connected to a network to be monitored and a monitoring port for transferring acquired packet information in text format,
Processing to acquire packets from the network to be monitored;
A program that immediately executes the process of converting the packet information obtained by the above processing into the HTTP format and transferring it without storing it inside .

Images