WO2010082289A1 - Packet collection device, reproducing device, packet collection program, and recording medium - Google Patents

Abstract

Disclosed is a packet collection device for storing the request packets to a server and the response packets from the server, and transmitting a stored request packet to the server to acquire a response packet (reproduced packet), and comparing the acquired response packet (reproduced packet) with the stored response packets (stored packets) to detect an abnormality. The packet collection device converts data portions (62) into hash values (62a) for the respective response packets (60) of a plurality of collected response packets and converts the respective response packets (60) into hash converted packets (60a) including the hash values (62a) and data length information (63a) by adding the data length information (63a) indicating the total data length of header portions (61) and the data portions (62) before the conversion into the hash values as additional data. The packet collection device stores the hash converted packets (60a) converted from the response packets (60).

Description

Packet collection device, reproduction device, packet collection program, and recording medium

The present invention accumulates a request packet to a server and a response packet from the server, acquires the response packet by transmitting the accumulated request packet to the server and reproduces the operation, and acquires the acquired response packet and the accumulated response packet The present invention relates to a packet collection device and an operation reproduction device that perform reproduction confirmation by comparing with.

Normally, a server function such as a Web server operates with a network input as a trigger. For this reason, the same phenomenon can be reproduced in the server function by acquiring the network packet information. For example, a reproduction test can be used when a failure of a server application occurs. However, a large amount of network packet information is assumed, and in order to accumulate for a long time, it is important to reduce the amount of data. It is conceivable to reduce the amount of data in order to reduce the writing process to the disk, and it is conceivable to collect only request packets necessary for reproduction. However, when only request packets are collected, it may not be possible to determine whether or not a failure has been reproduced. For example, in a case where only the client screen can be understood, it is necessary to issue a request from the client at the time of reproduction. However, since requests are actually received from various clients, it cannot be simulated. In order to solve the above problems, it is necessary to compare response packets, and it is also necessary to collect response packets. If response packets are also collected, the amount of request data is small, such as HTTP, but the resulting data may be large, such as in the case of image data, and a large amount of data unnecessary for reproduction gathers. The overhead for holding data increases.
In order to solve this problem, a method of converting the data portion of the packet with respect to the response data into a hash value as disclosed in Patent Document 1 can be cited.
JP 2003-264593 A

By simply converting the data part of the packet shown in Patent Document 1 into a hash value, it is not possible to analyze using a packet capture tool or the like when performing confirmation compared to information obtained at the time of failure reproduction confirmation End up. In addition, packet data may be divided into multiple pieces, and the size may be different due to differences in network environment, etc. even though the data is the same when collecting information and reproducing a failure. As a result, there is a problem that the hash value generated at the time of reproduction and the hash value generated at the time of collection differ from each other, making it impossible to confirm.

In the present invention, when collecting packet information, the request data is stored as it is, but in the case of response data, the data portion is converted into a hash value, the size information of the original data is added, and the header information is changed to a new size. By converting the information, it is possible to reduce the amount of data to be saved while being usable for confirmation of failure reproduction.

The packet collection device of the present invention comprises:
A plurality of packets that are transmitted from the terminal device to a specific server device that exchanges a packet including a header portion and a data portion with the terminal device via a network, and that requests predetermined processing from the server device. A packet information collection unit that collects a request packet and a plurality of response packets that are transmitted from the server device and respond to the request packet from the network;
For each response packet of the plurality of response packets collected by the packet information collection unit, the data portion is converted into a hash value using a predetermined hash function and the data length of the data portion before the hash value conversion A hash conversion unit that converts each response packet into a hash conversion packet including the hash value and the additional data by adding data length information indicating
A packet storage unit that stores the plurality of request packets collected by the packet information collection unit and a plurality of the hash conversion packets converted from the response packets by the hash conversion unit in a storage device that stores information; It is characterized by having.

The response packet transmitted from the server device is:
The header portion has data length information indicating the entire data length of the header portion and the data portion,
The packet collection device further includes:
The plurality of request packets stored in the storage device are transmitted to the server device via the network, and the plurality of response packets transmitted from the server device are transmitted to the network by responding to the transmitted request packet. A reproduction part that collects as a reproduction packet from
Extracting and reproducing the reproduction packet and the hash conversion packet that share the request packet from the plurality of reproduction packets collected by the reproduction unit and the plurality of hash conversion packets stored in the storage device The data size of the data portion of the reproduction packet is derived from the data length information of the reproduced packet, and the derived data size and the data size indicated by the additional data of the extracted hash conversion packet are the same If the data size is determined to be the same, the data portion of the reproduction packet is converted into a hash value using the hash function, and the hash value of the converted reproduction packet and the hash conversion packet A check unit for checking whether or not the hash value is equal. To.

The hash conversion unit
Determining whether the response packet collected by the packet information collection unit is based on a predetermined protocol, and converting only the response packet determined to be based on the predetermined protocol into the hash-converted packet, To do.

The hash conversion unit
The response packet determined not to be the predetermined protocol is discarded.

The response packet transmitted from the server device is:
The header portion has data length information indicating the entire data length of the header portion and the data portion,
The packet collection device further includes:
A data length conversion unit that rewrites the data length information of the header portion of the hash conversion packet to the entire data length of the hash conversion packet is provided.

The reproduction apparatus of the present invention is
A plurality of response packets transmitted from the server device by transmitting the plurality of request packets accumulated by the packet collection device to the server device via the network and responding to the transmitted request packets. A reproduction unit for collecting a plurality of response packets having data length information indicating the entire data length of the header part and the data part in the header part as a reproduction packet from the network;
Extracting the reproduction packet and the hash conversion packet that share the request packet from the plurality of reproduction packets collected by the reproduction unit and the plurality of hash conversion packets accumulated by the packet collection device, A data size of the data portion of the reproduction packet is derived from the data length information of the extracted reproduction packet, and the derived data size and a data size indicated by the additional data of the extracted hash conversion packet are: If the data size is determined to be the same, the data portion of the reproduction packet is converted into a hash value using the hash function, and the hash value of the converted reproduction packet and the hash conversion packet are converted A confirmation part that checks whether the hash value of And said that there were pictures.

The response packet transmitted from the server device is:
In the case of a divided packet divided from the original packet, it has division information regarding the division in the header part,
The confirmation unit
When it is determined that the data size is not the same, it is determined whether the reproduction packet and the hash conversion packet are the divided packets,
(1) If it is determined that both the reproduction packet and the hash conversion packet are the divided packets, the reproduction packet and the hash conversion having the same division source for each of the reproduction packet and the hash conversion packet All of the packets are identified based on the segmentation information of each of the header portions, the data portions of all of the identified replay packets are combined, and the combined data portions are identified and the corresponding hash transforms Re-divide according to the data size indicated by the additional data of the packet, convert each re-divided data portion into a hash value by the hash function, and the hash value of the hash conversion packet corresponding to the converted hash value And whether they are equal,
(2) When it is determined that only the reproduction packet is the divided packet, all the reproduction packets having the same division source as the reproduction packet are specified based on the division information in the header portion of the reproduction packet, and specified. Combining the data portions of all the reproduced packets that have been combined, converting the combined data portions into hash values by the hash function, and determining whether the converted hash value and the hash value of the hash-converted packet are equal Confirmed,
(3) When it is determined that only the hash conversion packet is the divided packet, all the hash conversion packets having the same division source with respect to the hash conversion packet are all based on the division information of the header portion of the hash conversion packet. Identify and divide the data portion of the reproduction packet according to the data size specified and indicated by the additional data of the corresponding hash conversion packet, and use the hash function to hash each divided data portion. And whether or not the converted hash value is equal to the hash value of the corresponding hash converted packet.

The packet collection program of this invention
On the computer,
(1) The packet transmitted from the terminal device to a specific server device that exchanges a packet including a header portion and a data portion with the terminal device via a network, and requests the server device to perform predetermined processing. Collecting a plurality of request packets to be transmitted from the network and a plurality of response packets that are transmitted from the server device and respond to the request packet;
(2) For each response packet of the collected response packets, the data portion is converted into a hash value using a predetermined hash function and data indicating the data length of the data portion before the hash value conversion A process of converting each response packet into a hash conversion packet including the hash value and the additional data by adding length information as additional data;
(3) A process of storing the collected plurality of request packets and the plurality of hash converted packets converted from the response packets in a storage device that stores information;
Is executed.

According to the packet collection device of the present invention, it is possible to reduce the amount of data stored when storing packets used for confirmation of failure reproduction. Further, according to the packet collection device of the present invention, the accumulated packets can be analyzed using a packet capture tool or the like. Further, according to the packet collection device of the present invention, the data size of the accumulated response packet and the response packet at the time of reproduction can be matched with respect to the packet division.

Embodiment 1 FIG.
(System configuration)
FIG. 1 shows a configuration of an operation reproduction system 1000 according to the first embodiment. The operation reproduction system 1000 includes an operation reproduction target server device 10 (hereinafter referred to as a target server) that is an operation reproduction target, a packet collection device 20 that collects packets and performs operation reproduction, a hub 30, a communication line 40, a plurality of It is comprised from the terminal device 50 (henceforth a terminal).

(1) The target server 10 is a server device that provides a service when performing business, and is, for example, a Web server or a DB server.
(2) The packet collection device 20 communicates with the “request packet” transmitted to the target server 10 via the communication line 40 and the request packet from the target server 10 in order to reproduce the operation of the target server 10. “Response packet information”, which is a result of response through the line 40, is collected and stored. Each of the request packet and the response packet includes a header portion and a data portion. The request packet and the response packet are, for example, a TCP (Transmission Control Protocol) packet, a UDP (User Datagram Protocol) packet, and an ICMP (Internet Control Message Protocol) packet. The operation reproduction system 1000 executes processing based on the header information of the header portion of these packets. The packet collection device 20 performs operation reproduction on the target server 10 based on the accumulated packet information. In FIG. 1 of the first embodiment, the packet collection device 20 performs packet collection and operation reproduction. However, as will be described at the end of the first embodiment, the packet collection function and the reproduction function are performed by separate devices. It may be realized.
(3) The hub 30 is a hub of the communication line 40 to which the target server 10 and the packet collection device 20 are connected. The hub 30 is a switching hub that holds a mirror port for collecting the network packet information of the target server 10 by the packet collection device 20 or a repeater hub that can acquire all network packet information. Any device capable of collecting the network packet information of the target server 10 by the packet collection device 20 is not limited to a switching hub or a repeater hub having a mirror port.
(4) The communication line 40 is a network that connects the target server 10 and the terminal 50 that requests a service to the target server 10. The communication line 40 is, for example, an intranet, a LAN (Local Area Network), or the Internet.
(5) The terminal 50 requests the target server 10 to provide a service and receives the result.

(Overview of operation)
FIG. 2 is a diagram showing an outline of the operation of the operation reproduction system 1000. Each terminal 50 transmits a plurality of request packets for requesting predetermined processing to the target server 10 via the communication line 40. In FIG. 2, the request packet is indicated by a broken line. The packet collection device 20 collects request packets from the hub 30. When the target server 10 receives the request packet, the target server 10 transmits a response packet to the terminal 50 via the communication line 40. In the figure, the response packet is indicated by a solid line. The packet collection device 20 collects response packets from the hub 30.

(Packet collection device 20)
FIG. 3 shows a response packet. The configuration of the packet collection device 20 will be described with reference to FIGS. 1 and 3.
FIG. 3A shows the collected response packet 60.
FIG. 3B shows a packet 60a obtained by converting the data portion 62 of the collected response packet 60 into a hash value using a predetermined hash function.
FIG. 3C shows a TCP packet 80 as a specific example of the response packet 60 and corresponds to FIG.
FIG. 3D shows a TCP packet 80a after conversion in which the TCP data is converted into a hash value and the data length of the TCP data is added, and corresponds to FIG.
Hereinafter, the packet 60a and the packet 80a are also referred to as a hash conversion packet 60a and a hash conversion packet 80a.
(1) The packet information collection unit 21 collects the request packets transmitted from the terminal 50 to the target server 10 from the hub 30, and receives the response packets transmitted from the target server 10 as a response to the request packet. collect.
(2) The response data hash value conversion unit 22 (hash conversion unit) converts the data portion of the response packet from the packets collected by the packet information collection unit 21 into a hash value, and converts the original packet into the hash value. Appends the data length. As shown in FIG. 3, the response data hash value conversion unit 22 converts the data portion 62 of the response packet 60 into a hash value 62a using a predetermined hash function, and converts the data length of the response packet 60 before conversion into this hash value. Data length information 63a indicating the length (length of the data portion 62) is added. FIGS. 3C and 3D show examples of TCP packets. The TCP packet is composed of an IP header 81, a TCP header 82, and TCP data 83, as shown in FIG. In the case of a TCP packet, the response data hash value conversion unit 22 converts the portion of the TCP data 83 into the hash value 83a, and the data length information 84a indicating the data length of the TCP data 83 before conversion into the hash value 83a. It is added as additional information.
(3) The data length conversion unit 23 converts the data length information 64 of the header portion 61a of the hash conversion packet 60a converted by the response data hash value conversion unit 22 into data length information 64a (header portion 61a + hash value 62a + after hash conversion). The data length information 63a) is changed. In the case of a TCP packet, the data length conversion unit 23 rewrites the packet length described in the IP header to “k bytes”, which is the data length of the entire packet after hash conversion shown in FIG.
(4) The packet storage unit 24 stores the request packet and the hash converted packet 60a after the hash conversion in the packet information storage unit 27.
(5) The operation reproduction unit 25 (reproduction unit) transmits the request packet stored in the packet information storage unit 27 to the target server 10 and executes the operation reproduction.
(6) The reproduction confirmation unit 26 (confirmation unit) compares the response packet 60 at the time of reproduction collected when the reproduction is performed by the operation reproduction unit 25 with the response packet (hash conversion packet) of the packet information storage unit 27. Check if it is reproduced correctly.
(7) Packet information is stored in the packet information storage unit 27 by the packet storage unit 24. The packet information storage unit 27 is realized as a storage device such as a disk.

(Packet collection / accumulation processing: operation 1)
FIG. 4 is a flowchart of an operation in which the packet collection device 20 collects request packets and response packets. First, the process of collecting and storing packet information by the packet collection device 20 will be described with reference to FIG. In FIG. 4, for example, “(packet information collection unit 21)” in ST101 indicates that the packet information collection unit 21 processes ST101. The other steps are the same.

The packet information collection unit 21 collects a request packet to the target server 10 and a response packet from the target server 10 by using a mirror port of the hub 30 or using a promiscuous mode (ST101). The response data hash value conversion unit 22 determines whether the collected packet is a request packet or a response packet. Whether the packet is a request packet or a response packet can be determined based on the network address information described in the header portion of the packet (ST102). If it is a request packet, the process proceeds to ST106, and if it is a response packet, the process proceeds to ST103. If the collected packet is a response packet, the response data hash value conversion unit 22 converts the data portion of the response packet into a hash value as described with reference to FIG. 3 (ST103). Then, the response data hash value conversion unit 22 adds data length information (additional data) indicating the original data length (data length of the data portion of the response packet before the hash value conversion) to the hash value (ST104). Further, the data length conversion unit 23 is a value of data length information indicating the data length of the entire response packet after hash conversion of the data length of the header portion with respect to the response packet hash-converted by the response data hash value conversion unit 22 (ST105). The packet storage unit 24 stores the collected request packets and converted response packets in the packet information storage unit 27 in the pcap format generally used by the packet capture tool or the like (ST106).

(Reproduction processing of target server 10: operation 2)
FIG. 5 is a flowchart showing an operation reproduction process for the target server 10 by the packet collection device 20. The reproduction operation to be executed based on the accumulated packet information will be described with reference to FIG.

The operation reproduction unit 25 extracts a request packet to the target server 10 from the packet information stored in the packet information storage unit 27, and sends the request packet to the target server 10 (ST201). The operation reproduction unit 25 collects and accumulates all request packets and response packets for the target server 10, including response packets (also referred to as reproduction packets) obtained from the target server 10 by sending the request packets (ST202). In the reproduction process of FIG. 5, the packet collection device 20 stores the collected response packet (reproduction packet) as it is without hashing. The packet collected at the time of reproduction is stored in the packet information storage unit 27.

(Confirmation process: Operation 3)
FIG. 6 is a flowchart showing the confirmation process of the reproduction operation by the packet collection device 20. In the description of FIG. 6, “at the time of operation” refers to the operation of FIG. 4, and “at the time of reproduction” refers to the operation of FIG. The reproduction confirmation unit 26 reproduces and executes the packet information stored in the packet information storage unit 27 and the operation packet reproduction unit 25 at the time of reproduction, and collects the packet information to respond to the same request packet. Packets are extracted (ST301). Whether or not the response packets are the same request packet can be determined by referring to the information of the header portion of each response packet. The reproduction confirmation unit 26 determines whether or not the response packet has the same size in “when operating” and “when reproduced”, and adds the data length information (additional) added to the “operating” response packet (hash conversion packet). (Data) and data length information stored in the header portion of the response packet (reproduction packet) at the time of reproduction are compared (ST302).
Note that the data length indicated by the additional data of the hash conversion packet is the data portion. Therefore, when the data length information of the header portion of the reproduction packet indicates the data length of the entire reproduction packet, the reproduction confirmation unit 26 derives the data size of the data portion of the reproduction packet from the data length information of the header portion of the reproduction packet. Then, it is determined whether the derived data size is the same as the data size indicated by the additional data of the hash conversion packet.

This will be described with reference to FIG. FIG. 3A corresponds to a reproduction packet that has not been subjected to hash conversion, and FIG. 3B illustrates a hash conversion packet. The header portion of the reproduction packet has data length information 64, and the hash conversion packet has data length information 63a (additional data) indicating the data length before the hash conversion. The reproduction confirmation unit 26 determines the reproduction packet and the hash conversion packet having the same request packet by comparing the data length information 64 of the reproduction packet and the data length information 63a of the hash conversion packet.

As a result of determination, if the data length is the same, the process proceeds to ST303, and if the data length is different, the process proceeds to ST306. If the data lengths are the same, the reproduction confirmation unit 26 converts the data portion of the response packet (reproduction packet) at the time of reproduction into a hash value using a hash function used for the hash conversion packet (ST303). The reproduction confirmation unit 26 compares the hash value of the response packet (reproduction packet) with the hash value of the hash conversion packet (ST304). If they are the same value, the process proceeds to ST305, and if they are different, the process proceeds to ST308. If the values are the same, the reproduction confirmation unit 26 determines that the same phenomenon has occurred (ST305).

(When data length is different)
When the data lengths are different, the reproduction confirmation unit 26 determines whether or not at least one of the reproduction packet and the hash conversion packet is a divided packet (divided packet). A check is made on the basis of division information that can identify the division according to the protocol, such as a flag, a sequence number, or an acknowledgment number (ST306). If the reproduction confirmation unit 26 determines that either the reproduction packet or the hash conversion packet is a divided packet, the process proceeds to ST307, and if it is a single packet, the process proceeds to ST308 (end).

(When one is a divided packet or both are divided packets)
When one of the replay packet and the hash conversion packet for the same request packet is a divided packet, the replay confirmation unit 26 determines all of the replay packets for the request packet and all of the hash conversion packets for the request packet. Extract. Specifically, there are the following three patterns of division.
That is,
(1) Divide both the replay packet and the hash conversion packet.
(2) Divide only the replay packet,
(3) Only the hash conversion packet is divided,
There are three ways.

(In the case of (1))
The reproduction confirmation unit 26 performs integration and re-division. That is, the reproduction confirmation unit 26 combines the data portions of all the reproduction packets and re-divides them according to the division size of the hash conversion packet using the data length information of the data portions stored as additional data (ST307). . For example, in the hash conversion packet, the data portion whose data length before division is “60” is divided into data lengths of “20” and “40” (from the additional data of each divided packet, “20” The data length of the reproduction packet is divided into “10”, “20”, and “30”. In such a case, the reproduction confirmation unit 26 integrates “10”, “20”, and “30” of each reproduction packet into “60”, and re-divides this data portion into “20” and “40”. . That is, when the reproduction confirmation unit 26 determines that both the reproduction packet and the hash conversion packet are divided packets, the reproduction packet and the hash conversion packet having the same division source for each of the reproduction packet and the hash conversion packet Are combined, and the data portions of all the specified replay packets are combined, and the combined data portions are subdivided according to the size of the data portion of the corresponding hash conversion packet that has been specified and repartitioned Each data portion is converted into a hash value by a hash function, and it is confirmed whether the converted hash value is equal to the hash value of the corresponding hash conversion packet.

(In the case of (2))
The reproduction confirmation unit 26 performs only integration without re-dividing. For example, the data length stored as the additional data of the hash conversion packet is “60”, and the data length of each reproduction packet is “10”, “20”, “30”. In this case, the reproduction confirmation unit 26 only integrates the data portion of each reproduction packet into “60”, and does not perform re-division. That is, when the reproduction confirmation unit 26 determines that only the reproduction packet is a divided packet, the reproduction confirmation unit 26 identifies all the reproduction packets having the same division source with respect to the reproduction packet, and combines the data portions of all the specified reproduction packets. The combined data portion is converted into a hash value by a hash function, and it is confirmed whether the converted hash value is equal to the hash value of the hash conversion packet.

(In the case of (3))
Since there is no need for integration, the reproduction confirmation unit 26 executes only subdivision. For example, the data length stored as the additional data of each hash conversion packet is “20” and “40”, and the data length of the reproduction packet is “60”. In this case, the reproduction confirmation unit 26 only re-divides the data portion of the reproduction packet into “20” and “40”. In ST303, the reproduction confirmation unit 26 converts each re-divided data part into a hash value in the case of “(1)” and “(3)”, and in the case of “(2)”, the reproduction data part In step ST304, the hash values corresponding to the reproduction packet and the hash conversion packet are compared with each other to confirm whether or not the values are the same. That is, when the reproduction confirmation unit 26 determines that only the hash conversion packet is a divided packet, the reproduction confirmation unit 26 specifies all the hash conversion packets having the same division source for the hash conversion packet, specifies the data portion of the reproduction packet, In addition, the data is divided in accordance with the size of the data part of the corresponding hash conversion packet, each divided data part is converted into a hash value by a hash function, and the converted hash value and the hash value of the corresponding hash conversion packet are obtained. Check for equality.

If the data lengths are different and are not divided (NO in ST306), or if the hash values are different (NO in ST304), reproduction confirmation unit 26 determines that the same phenomenon has not been reproduced (ST308). .

FIG. 7 is a diagram for supplementarily explaining the operation of FIG. FIG. 7 shows the following situation. That is, in the case of TCP as a specific example, the transmission side determines and transmits a sequence number when establishing a connection. The receiving side returns a number obtained by adding 1 to the sequence number as an acknowledgment number. Therefore, when data is transmitted, information on sequence numbers and confirmation response numbers is used as initial information. The data transmitting side transmits data using the sequence number and the acknowledgment number set as the initial information. In the case of continuous transmission, the transmission side sets a number obtained by adding the transmitted data size to the sequence number, sets the same number as the confirmation response number, and transmits the next data. In the middle, when the receiving side returns ACK, the receiving side sets the number stored in the acknowledgment number of the transmission data to the sequence number, and the acknowledgment number is assigned the number with the received data size. set. In the case of continuous data, the transmission side always has a common acknowledgment number and the receiving side has a common sequence number. Using this mechanism, it can be determined that the packet is a divided packet. By using the division information such as the sequence number and the confirmation response number as described above, the processing of ST306 and ST307 shown in FIG. 6 can be performed.

As described above, in the first embodiment, since the data portion of the response packet is converted to a hash value and stored, the amount of recorded data can be reduced, and information can be collected for a longer time than before. It becomes.
The packet collection device 20 adds the original size of the packet as additional data to the packet after hash conversion. For this reason, although the data contents are the same, even if the hash value is different due to a change in the packet segmentation result at the time of reproduction, it is possible to check the total size or use the data part at the time of reproduction. The data can be confirmed by regenerating the hash value divided into data of the same size as that at the time of collection.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIGS. The second embodiment describes a case where the packet collection device 20 of the first embodiment is realized in a virtual machine environment. FIG. 8 is a configuration diagram of the second embodiment. In the virtual computer environment, in the physical computer 100, a target server 110 corresponding to the target server 10 and a packet collection device 120 corresponding to the packet collection device 20 are arranged on the virtual computer. The virtual switch 31 in FIG. 8 corresponds to the hub 30 in FIG. Components similar to those in FIG. 1 are denoted by the same reference numerals, and detailed description thereof is omitted.

The packet information collection unit 21 can collect the request packet to the target server 110 and the response packet from the target server 110 in the promiscuous mode in the virtual switch 31. The operation is the same as in the first embodiment.

FIG. 9 shows a configuration in which the operation reproduction function (operation reproduction unit 25) and the reproduction confirmation function (reproduction confirmation unit 26) of the packet collection device 120 are separated from the packet collection device 120 as a reproduction device 220. In the configuration of FIG. 9, the packet collection device 120 collects and stores hash conversion packets that are request packets and response packets. The reproduction device 220 acquires the request packet and the hash conversion packet stored in the packet collection device 120, and executes the operation reproduction and the reproduction confirmation described in the first embodiment. The reproduction device 220 may acquire the request packet and the hash conversion packet online via the communication line 40, or may acquire it offline. The collection and storage operations, and the reproduction and confirmation operations are the same as those in the first embodiment.

As described above, according to the second embodiment, by collecting packet information in a virtual machine environment, a hub with a mirror port or the like becomes unnecessary. In addition, since the amount of data required for storage is reduced, the amount of processing can be reduced with respect to the I / O processing function shared by other virtual machines deployed on the same physical computer. It is possible to collect information while minimizing the impact on the virtual machine.

Embodiment 3 FIG.
The third embodiment will be described with reference to FIGS. The third embodiment corresponds to “packet collection / accumulation process: operation 1” described in FIG. 4 of the first embodiment. In the third embodiment, a case will be described in which the packet collection device 20 responds to a difference in response packet protocol. The system configuration of the third embodiment is the same as that of the first or second embodiment. In the following description, description will be made assuming the configuration of FIG.

FIG. 10 is a processing flow of the packet collection device 20 according to the third embodiment. Step numbers identical to those in FIG. 4 are the same as the step operations in FIG. The operation of collecting and storing packets by the packet collection device 20 according to the third embodiment will be described with reference to FIG.

The packet information collection unit 21 collects a request packet to the target server 10 and a response packet from the target server 10 by using a mirror port of the hub 30 or using a promiscuous mode (ST101). The response data hash value conversion unit 22 determines whether the collected packet is a request packet or a response packet. Whether the packet is a request packet or a response packet can be determined based on the network address information described in the header portion of the packet (ST102). If it is a request packet, the process proceeds to ST106, and if it is a response packet, the process proceeds to ST401.

The response data hash value conversion unit 22 checks whether the packet is a packet of any protocol of ICMP, TCP, or UDP (an example of a predetermined protocol) with reference to the header information (ST401). If the packet is an ICMP, TCP, or UDP protocol, the process proceeds to ST103. If it is any other packet, the process proceeds to ST101. When the process proceeds to ST101, the packet is not accumulated.

When the collected packet is a response packet, the response data hash value conversion unit 22 converts the data portion of the response packet into a hash value as described in FIG. 3 (ST103). Then, the response data hash value conversion unit 22 adds data length information (additional data) indicating the original data length (data length of the data portion of the response packet before the hash value conversion) to the hash value (ST104).

Further, the data length conversion unit 23 changes the data length of the IP header portion of the packet to the data length of new data (the entire response packet in which the data portion is converted into a hash value and data length information is added) ( ST402). The data length conversion unit 23 checks whether the packet is a UDP protocol packet with reference to the header portion (ST403). If it is a UDP packet, the process proceeds to ST404, and if it is an ICMP or TCP packet, the process proceeds to ST106.

FIG. 11 is a diagram showing a packet structure of the UDP packet 70.
FIG. 11A shows a UDP packet 70 which is a response packet.
FIG. 11B shows a hash conversion packet 70 a corresponding to the UDP packet 70.
The UDP packet 70 includes an IP header 71, a UDP header 72, and UDP data 73. In the case of a UDP packet, the data length conversion unit 23 changes the data length 75 included in the UDP header 72 to a new data length 75a (the total data length of the hash and additional data) (ST404). The hash value 73a and the additional data 74a (data length of the UDP data 73) are information added and converted by the response data hash value conversion unit 22 in ST103 and ST104.

The packet storage unit 24 stores the collected request packet and the converted response packet in the packet information storage unit 27 in the pcap format generally used by the packet capture tool or the like (ST106).

As described above, in the third embodiment, it is determined whether or not response packets need to be collected, whether or not conversion to a hash value is performed, and whether or not the header information is changed. For this reason, unnecessary packets are deleted in advance in the confirmation process (“reproduction operation confirmation process: operation 3” in the first embodiment). For this reason, it is possible to further reduce the amount of data during storage. Further, by changing the change process for the header information of the packet for each protocol, the collected packet information (response packet) can be confirmed by a packet capture tool or the like.

Embodiment 4 FIG.
A fourth embodiment will be described with reference to FIGS. The fourth embodiment will explain the operation of packet accumulation processing at the time of collection (operation 1 of the first embodiment). FIG. 12 is a configuration diagram of the packet collection device 20 according to the fourth embodiment. In addition to the packet collection device 20, the packet collection device 20 further includes a packet temporary storage unit 400, a packet storage queue 431, and a packet storage queue 432.

In FIG.
(1) The packet temporary storage unit 400 stores the collected packet information in the packet storage buffer 433.
(2) The packet storage queue 431 is a queue for storing collected packets in the packet storage buffer 433 provided on the memory.
(3) The packet accumulation queue 432 is a queue that accumulates buffers to be accumulated among the packet storage buffers 433 arranged on the memory.
(4) The packet storage buffer 433 is a buffer indicating an area for temporarily storing the collected packet information on the memory.

FIG. 13 is a flowchart of the operation of the packet temporary storage unit 400 that temporarily stores packets in the memory during packet collection. FIG. 14 is a flowchart showing the operation of the packet storage unit 24 that stores the packet information temporarily stored in the memory in the packet information storage unit 27.

The operation of storing packets collected in the packet storage buffer 433 temporarily secured in the memory at the time of packet collection (operation 1 shown in FIG. 4 of the first embodiment) will be described with reference to FIG.

When the packets to be accumulated are collected, the packet temporary accumulation unit 400 takes out the leading packet storage buffer 33 of the packet storage queue 431 (ST501). Packet temporary storage section 400 compares the size of the packet with the free capacity of packet storage buffer 433 (ST502). If the available capacity is larger than the accumulated packet size, the process proceeds to ST503, and if it is smaller, the process proceeds to ST504.

If the available capacity of the packet storage buffer 433 is larger than the packet size to be accumulated, the packet temporary storage unit 400 stores the packet in the packet storage buffer 433 (ST503). When the free capacity of the packet storage buffer 33 is smaller than the packet size to be accumulated, the taken out packet storage buffer 433 is enqueued in the packet accumulation queue 432 (ST504). The temporary packet storage section 400 takes out the packet storage buffer 433 that is newly at the head from the packet storage queue 431 (ST505).

Next, the operation of the packet storage unit 24 storing the packet information stored in the packet storage buffer 433 in the packet information storage unit 27 will be described with reference to FIG.

The packet storage unit 24 checks whether or not the packet storage buffer 433 exists in the packet storage queue 432 (ST601). When it exists, it progresses to ST602, and when it does not exist, it progresses to ST601.
When the packet storage buffer 433 exists in the packet accumulation queue 432, the packet accumulation unit 24 takes out the leading packet storage buffer 433 of the packet accumulation queue 432 (ST602). The packet storage unit 24 extracts the packet information stored in the extracted packet storage buffer 433, and performs compression (ST603). The packet accumulating unit 24 stores the compressed packet information in the packet information storage unit 27 (ST604).

The packet accumulating unit 24 erases the contents of the packet storage buffer 433 that are no longer necessary due to the storage (ST605). In order to make the erased packet storage buffer 433 available for accumulation at the time of collection, the packet accumulation unit 24 enqueues it in the packet storage queue 431 (ST606).

As described above, in the fourth embodiment, packet information is temporarily stored in a memory, and packet information collection and packet information accumulation can be performed in parallel. This makes it possible to collect and store packets without being affected by the time-consuming storage process with respect to the speed of collecting packet information on the network.

Embodiment 5 FIG.
The fifth embodiment will be described with reference to FIGS. 15 and 16.

The fifth embodiment mainly shows a specific embodiment in which the packet collection device 20 or the reproduction device 220 is realized by a computer. Since the packet collection device 20 and the reproduction device 220 can be realized by a computer, the packet collection device 20 will be described.

FIG. 15 is a diagram illustrating an example of the external appearance of the packet collection device 20. In FIG. 15, the packet collection device 20 includes a system unit 830, a display device 813 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 814 (Key / Board: K / B), and a mouse 815. , FDD 817 (Flexible Disk Drive), compact disk device 818 (CDD: Compact Disk Drive), printer device 819, and the like, which are connected by cables and signal lines.

FIG. 16 is a diagram illustrating an example of hardware resources of the packet collection device 20 realized by a computer. In FIG. 16, the packet collection device 20 includes a CPU 810 (Central Processing Unit) that executes a program. The CPU 810 includes a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, a display device 813, a keyboard 814, a mouse 815, a communication board 816, an FDD 817, a CDD 818, a printer device 819, and a magnetic disk device 820 via a bus 825. And control these hardware devices. Instead of the magnetic disk device 820, a storage device such as an optical disk device or a flash memory may be used.

The RAM 812 is an example of a volatile memory. Storage media such as the ROM 811, the FDD 817, the CDD 818, and the magnetic disk device 820 are examples of nonvolatile memories. These are examples of a storage device or a storage unit, a storage unit, and a buffer. The communication board 816, the keyboard 814, the FDD 817, and the like are examples of an input unit and an input device. The communication board 816, the display device 813, the printer device 819, and the like are examples of an output unit and an output device.

The communication board 816 is connected to a network (such as a LAN). The communication board 816 may be connected not only to the LAN but also to a WAN (wide area network) such as the Internet or ISDN.

The magnetic disk device 820 stores an operating system 821 (OS), a window system 822, a program group 823, and a file group 824. The programs in the program group 823 are executed by the CPU 810, the operating system 821, and the window system 822.

The program group 823 stores a program for executing the function described as “unit” in the description of the above embodiment. The program is read and executed by the CPU 810.

The file group 824 includes data described as “request packet” and “response packet” in the description of the above embodiment, “determination result”, “calculation result”, and “extraction result”. The information described as “results of generation” and “processing results of”, data, signal values, variable values, parameters, and the like are stored as items of “˜file” and “˜database”. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 810 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during CPU operations for extraction, search, reference, comparison, calculation, calculation, processing, output, printing, and display. Is remembered.

In the description of the embodiment described above, data and signal values are stored in the memory of the RAM 812, the flexible disk of the FDD 817, the compact disk of the CDD 818, the magnetic disk of the magnetic disk device 820, other optical disks, mini disks, and DVDs (Digital). -It records on recording media, such as Versatile and Disk. Data and signals are transmitted on-line via the bus 825, signal lines, cables, and other transmission media.

In the above description of the embodiment, what has been described as “to part” may be “to means”, “to circuit”, and “to device”, and “to step”, “to” It may be “procedure” or “processing”. That is, what has been described as “˜unit” may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented only by software, only hardware such as elements, devices, substrates, wirings, etc., or a combination of software and hardware, and further a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 810 and executed by the CPU 810. In other words, the program causes the computer to function as the “˜unit” described above. Alternatively, it causes a computer to execute the procedures and methods of “to part” described above.

In the above first to fourth embodiments, the apparatus has been described as the packet collection apparatus 20 or the reproduction apparatus 220. However, as in the fifth embodiment, the operation of the packet collection apparatus 20 and the reproduction apparatus 220 is executed by a computer. It can also be understood as a packet collection program and an operation reproduction program. Alternatively, it can be grasped as a computer-readable recording medium on which a packet collection program and an operation reproduction program are recorded. Furthermore, it is possible to grasp the operation of the packet collection device 20 or the reproduction device 220 as a packet collection method performed by the packet collection device 20 and a reproduction method performed by the reproduction device 220.

In the first embodiment described above, the packet collection device having the following means has been described.
(1) Packet information collection means for collecting network packet information of the operation reproduction target server from the hub;
(2) Response data hash value conversion means for converting the data part of the response packet output from the operation reproduction target server out of the collected network packet information into a hash value and adding data length information before the conversion to the data part; ,
(3) data length conversion means for converting the data length information of the header portion of the packet into a value based on the data length of the hash value generated by the response data hash value conversion means;
(4) The request packet to the operation reproduction target server is stored as it is, and the response packet from the operation reproduction target server is converted into a hash value by the response data hash value conversion means, and data length information is given, Packet storage means for storing packet information obtained by converting the data length of the header portion of the packet by the data length conversion means;
(5) operation reproduction means for terminating the accumulation, transmitting the accumulated request packet to the operation reproduction target server, and executing the operation reproduction;
(6) Reproduction confirmation means for comparing the response packet at the time of reproduction obtained by the operation reproduction means with the response packet information accumulated by the packet accumulation means at the time of operation, and confirming whether or not the reproduction packet is correctly reproduced,
A packet collection device that stores network packet information necessary for reproducing the operation as it is, and converts the network packet information necessary for confirming the reproduction into a hash value and stores it.

In the second embodiment described above, the configuration in which the packet collection device is deployed as a virtual computer on the same physical computer when the target server is operating as a virtual computer has been described.
In this configuration, the packet collection device includes packet information collection means for collecting network packet information of the target server from the virtual switch. With this configuration, it is possible to operate the target server and the packet collection device in the virtual machine environment.

The packet collection device according to the third embodiment includes data length conversion means for changing the data length information of the IP header portion of the packet when the response packet is a TCP packet. For this reason, confirmation by the packet capture function is possible by changing the data length information of the IP header portion.

The packet collection device of the third embodiment described above is
When the response packet is a UDP packet, there is provided data length conversion means for changing the data length information of the IP header portion of the packet and the data length information of the UDP header portion.
For this reason, confirmation by the packet capture function is possible by changing the data length information.

The packet collection device of the third embodiment described above is
If the response packet is an ICMP packet, response data hash value conversion means is provided that does not perform hash value conversion. For this reason, the packet at the time of reproduction can be used in life and death confirmation and time stamp information.

The packet collection device according to the third embodiment includes response data hash value conversion means for discarding the collected response packet when the response packet is a protocol other than TCP, UDP, or ICMP. For this reason, packet information that is not necessary for operation confirmation is not accumulated, so that the amount of information written to the disk can be reduced.

The packet collection device of the fourth embodiment described above is
A plurality of packet storage buffers for temporarily storing collected packets;
A packet storage buffer queue that holds a list of available packet storage buffers for temporary storage in memory;
A packet storage buffer queue that holds a list of packet storage buffers that are to be written to the disk because the area of the temporarily stored packet storage buffer is full is provided.
The packet temporary storage means is a packet storage buffer in which each packet information collected by the packet information collection means and converted by the response data hash value conversion means and the data length conversion means is stored at the head of the packet storage buffer queue. If there is free space, store it as it is, and if it is determined that there is no free space, delete the packet storage buffer that has no free space from the packet storage buffer queue, add it to the packet storage buffer queue, Store in the packet storage buffer at the head of the packet storage buffer queue. The packet storage means reads the contents of the packet storage buffer queue from the packet storage buffer queue, writes it to the disk and writes all the information, clears the contents of the packet storage buffer, deletes it from the packet storage buffer queue, Add to the packet storage buffer queue.
As described above, the packet collection device 20 according to the fourth embodiment can absorb the difference between the packet collection rate and the packet accumulation rate.

The packet collection device 20 according to the fourth embodiment includes packet storage means for compressing and writing to the disk when packet information stored in the packet storage buffer is written to the disk. As a result, the amount of information written to the disk can be reduced.

1 is a configuration diagram of an operation reproduction system 1000 according to Embodiment 1. FIG. FIG. 2 is a diagram showing an outline of the operation of the operation reproduction system 1000 according to the first embodiment. FIG. 3 shows a data format of a response packet according to the first embodiment. 6 is a flowchart of a packet collection operation of the packet collection device 20 according to the first embodiment. 5 is a flowchart showing operation reproduction processing by the packet collection device 20 according to the first embodiment. 6 is a flowchart showing a confirmation process of a reproduction operation by the packet collection device 20 according to the first embodiment. The figure explaining supplementary FIG. FIG. 3 is a configuration diagram of a virtual computer according to a second embodiment. The figure which shows the structure which isolate | separated the reproduction apparatus 220 of Embodiment 2. FIG. 9 is a processing flow of the packet collection device 20 according to the third embodiment. FIG. 10 is a diagram illustrating a packet structure of a UDP packet 70 according to the third embodiment. FIG. 6 is a configuration diagram of a packet collection device 20 according to a fourth embodiment. 10 is a flowchart of the operation of the temporary packet storage unit 400 according to the fourth embodiment. 10 is a flowchart of the operation of the packet storage unit 24 according to the fourth embodiment. FIG. 7 is a diagram illustrating an appearance of a packet collection device 20 according to a fifth embodiment. The figure which shows the hardware resource of the packet collection apparatus 20 of Embodiment 5. FIG.

Explanation of symbols

10 target server, 20 packet collection device, 21 packet information collection unit, 22 response data hash value conversion unit, 23 data length conversion unit, 24 packet accumulation unit, 25 operation reproduction unit, 26 reproduction confirmation unit, 27 packet information storage unit, 30 hub, 31 virtual switch, 40 communication line, 50 terminal, 60 response packet, 61, 61a header part, 62 data part, 62a hash value, 63a data length information, 64, 64a data length information, 65 flag, 70 UDP packet , 100 physical computer, 110 target server, 120 packet collection device, 220 reproduction device, 400 packet temporary storage unit, 431 packet storage queue, 432 packet storage queue, 1000 operation reproduction system.

Claims (9)

1. A plurality of packets that are transmitted from the terminal device to a specific server device that exchanges a packet including a header portion and a data portion with the terminal device via a network, and that requests predetermined processing from the server device. A packet information collection unit that collects a request packet and a plurality of response packets that are transmitted from the server device and respond to the request packet from the network;
   For each response packet of the plurality of response packets collected by the packet information collection unit, the data portion is converted into a hash value using a predetermined hash function and the data length of the data portion before the hash value conversion A hash conversion unit that converts each response packet into a hash conversion packet including the hash value and the additional data by adding data length information indicating
   A packet storage unit that stores the plurality of request packets collected by the packet information collection unit and a plurality of the hash conversion packets converted from the response packets by the hash conversion unit in a storage device that stores information; A packet collection device comprising:
2. The response packet transmitted from the server device is:
   The header portion has data length information indicating the entire data length of the header portion and the data portion,
   The packet collection device further includes:
   The plurality of request packets stored in the storage device are transmitted to the server device via the network, and the plurality of response packets transmitted from the server device are transmitted to the network by responding to the transmitted request packet. A reproduction part that collects as a reproduction packet from
   Extracting and reproducing the reproduction packet and the hash conversion packet that share the request packet from the plurality of reproduction packets collected by the reproduction unit and the plurality of hash conversion packets stored in the storage device The data size of the data portion of the reproduction packet is derived from the data length information of the reproduced packet, and the derived data size and the data size indicated by the additional data of the extracted hash conversion packet are the same If the data size is determined to be the same, the data portion of the reproduction packet is converted into a hash value using the hash function, and the hash value of the converted reproduction packet and the hash conversion packet A check unit for checking whether or not the hash value is equal. Packet collection apparatus of claim 1 wherein.
3. The hash conversion unit
   Determining whether the response packet collected by the packet information collection unit is based on a predetermined protocol, and converting only the response packet determined to be based on the predetermined protocol into the hash-converted packet, The packet collection device according to claim 1.
4. The hash conversion unit
   4. The packet collection device according to claim 3, wherein the response packet determined not to be the predetermined protocol is discarded.
5. The response packet transmitted from the server device is:
   The header portion has data length information indicating the entire data length of the header portion and the data portion,
   The packet collection device further includes:
   The packet collection device according to claim 1, further comprising a data length conversion unit that rewrites the data length information of the header portion of the hash conversion packet to the entire data length of the hash conversion packet.
6. The plurality of request packets stored by the packet collection device according to claim 1 are transmitted to the server device via the network, and the plurality of request packets transmitted from the server device by responding to the transmitted request packets. A replay unit that collects a plurality of response packets as replay packets from the network, the response packet having a data length information indicating the total data length of the header portion and the data portion in the header portion;
   Extracting the reproduction packet and the hash conversion packet that share the request packet from the plurality of reproduction packets collected by the reproduction unit and the plurality of hash conversion packets accumulated by the packet collection device, A data size of the data portion of the reproduction packet is derived from the data length information of the extracted reproduction packet, and the derived data size and a data size indicated by the additional data of the extracted hash conversion packet are: If the data size is determined to be the same, the data portion of the reproduction packet is converted into a hash value using the hash function, and the hash value of the converted reproduction packet and the hash conversion packet are converted A confirmation part that checks whether the hash value of Reproduction apparatus according to claim that there were example.
7. The response packet transmitted from the server device is:
   In the case of a divided packet divided from the original packet, it has division information related to division in the header part, and the confirmation unit includes:
   When it is determined that the data size is not the same, it is determined whether the reproduction packet and the hash conversion packet are the divided packets,
   (1) If it is determined that both the reproduction packet and the hash conversion packet are the divided packets, the reproduction packet and the hash conversion having the same division source for each of the reproduction packet and the hash conversion packet All of the packets are identified based on the segmentation information of each of the header portions, the data portions of all of the identified replay packets are combined, and the combined data portions are identified and the corresponding hash transforms Re-divide according to the data size indicated by the additional data of the packet, convert each re-divided data portion into a hash value by the hash function, and the hash value of the hash conversion packet corresponding to the converted hash value And whether they are equal,
   (2) When it is determined that only the reproduction packet is the divided packet, all the reproduction packets having the same division source as the reproduction packet are specified based on the division information in the header portion of the reproduction packet, and specified. Combining the data portions of all the reproduced packets that have been combined, converting the combined data portions into hash values by the hash function, and determining whether the converted hash value and the hash value of the hash-converted packet are equal Confirmed,
   (3) When it is determined that only the hash conversion packet is the divided packet, all the hash conversion packets having the same division source with respect to the hash conversion packet are all based on the division information of the header portion of the hash conversion packet. Identify and divide the data portion of the reproduction packet according to the data size specified and indicated by the additional data of the corresponding hash conversion packet, and use the hash function to hash each divided data portion. The reproduction apparatus according to claim 6, further comprising: confirming whether the converted hash value is equal to the hash value of the corresponding hash conversion packet.
8. On the computer,
   (1) The packet transmitted from the terminal device to a specific server device that exchanges a packet including a header portion and a data portion with the terminal device via a network, and requests the server device to perform predetermined processing. Collecting a plurality of request packets to be transmitted from the network and a plurality of response packets that are transmitted from the server device and respond to the request packet;
   (2) For each response packet of the collected response packets, the data portion is converted into a hash value using a predetermined hash function and data indicating the data length of the data portion before the hash value conversion A process of converting each response packet into a hash conversion packet including the hash value and the additional data by adding length information as additional data;
   (3) A process of storing the collected plurality of request packets and the plurality of hash converted packets converted from the response packets in a storage device that stores information;
   A packet collection program that executes
9. A computer-readable recording medium on which the packet collection program according to claim 8 is recorded.

Images