Network survey device, network survey method, program, and network survey system

Abstract

While it had been common practice to verify the connectivity of information networks, the collection of address information for all terminals and network switches connected to the information network had not been carried out. [Solution] A simulated signal is sent to all target terminals connected to the network switch before a predetermined time has elapsed before the address learning table of the network switch connected to the information network erases the learned addresses, and the addresses included in the response signals from the terminals to the simulated signal are learned in the address learning table.

Description

Technical Field

[0001] The present disclosure relates to a network investigation device, a network investigation method, a program, and a network investigation system.

Background Art

[0002] To maintain the operational quality of a computer system composed of a plurality of devices, an exploration processing device is known that checks whether the configuration of each device such as servers and databases connected to an information network is consistent with design information (see, for example, Patent Document 1). During this check, a ping command of ICMP (Internet Control Message Protocol) is issued to each device to detect the presence or absence of a response. Along with this communication confirmation, the exploration processing device also creates an address list of IP (Internet Protocol) addresses and MAC (Media Access Control) addresses of each device constituting the information network.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, the exploration processing device shown in Patent Document 1 is a device that compares design information with the equipment that constitutes the constructed information network itself, and as shown in Figure 8 of Patent Document 1, it does not check the IP addresses and MAC addresses of each terminal connected to the information network after the information network has been put into operation. However, the number of terminals connected to the information network is greater than the number of equipment that constitutes the information network, and the connection status changes daily. Furthermore, the number of concentrators (network switches) that accommodate and connect multiple transmission paths placed between the terminals and the network also increases. Therefore, it is necessary to collect and analyze the address information of all these terminals and network switches connected to the information network in real time.

[0005] When the aforementioned discovery processing device uses the ping command to check the addresses of these terminals and network switches, it operates on the operating system (OS) installed in the discovery processing device. Therefore, if there is no response from the destination terminal, the response waiting time set by the OS is applied. For example, with conventional software that sends pings running on the OS, the waiting time for each ping sent is 1 second. If 1000 terminals are connected and half of them do not send a response back to the discovery processing device, the waiting time would be approximately 500 seconds. However, since the MAC address learning table of the network switch stores MAC addresses for 300 seconds, if there are many pings that do not receive a response, the MAC addresses of all terminals may be erased before they can be written, potentially making it impossible to collect addresses. Furthermore, especially in the initial stages of information network construction, terminals are added daily, so investigating the MAC addresses and IP addresses of all terminals would take much more time, potentially making address discovery impossible.

[0006] This disclosure is made to solve these problems and aims to provide a network survey device that can collect the addresses of all terminals connected to an information network before a predetermined time when the addresses learned in the address learning table are erased. [Means for solving the problem]

[0007] The network investigation device according to this disclosure comprises a simulated communication means for transmitting a simulated signal to the address learning table of a network switch connected to the network switch to learn the addresses of terminals connected to the network switch, and a setting means for setting a simulated communication parameter file in the simulated communication means for transmitting a simulated signal to all target terminals via the network switch before a predetermined time before the addresses learned in the address learning table are erased, thereby causing the address learning table to learn the addresses included in the response signals from terminals to the simulated signals. [Effects of the Invention]

[0008] According to the network survey device described herein, the addresses of all terminals connected to the information network can be collected before a predetermined time has elapsed before the addresses learned in the address learning table are deleted. [Brief explanation of the drawing]

[0009] [Figure 1] This is a functional block diagram showing an example of the configuration of a network survey device according to Embodiment 1. [Figure 2] This diagram illustrates an example of the hardware configuration of a network survey device according to Embodiment 1. [Figure 3] This flowchart illustrates a method for collecting the IP address and MAC address of a terminal using the network survey device according to Embodiment 1. [Modes for carrying out the invention]

[0010] Embodiments of this disclosure will be described below with reference to the drawings. However, the embodiments described below are limited to technologies suitable for carrying out this disclosure, but the technical scope of this disclosure is not limited to the embodiments and drawings below. The same parts and components are denoted by the same reference numerals, and their detailed descriptions are omitted.

[0011] Embodiment 1. Figure 1 is a functional block diagram showing an example of the configuration of the network survey device 300 according to Embodiment 1. Terminals 201a1 to 201a8, 201b1 to 201bn, and 201n1 to 201nn are connected via multiple network switches 102a to 102n connected to the IP network 101. Since network switches 102a to 102n have the same structure, the following explanation will be given using 102a.

[0012] The network switch 102a includes port 103a, switch LSI 104a, ports 105a to 105h, address learning table 106a, and management means 107a. For high-speed processing, the network switch 102a may be configured as a hardware switch such as an ASIC (Application Specific Integrated Circuit).

[0013] Port 103a is connected to IP network 101 via a router (omitted in the diagram) and transmits and receives data with switch LSI 104a. Data received by switch LSI 104a is transmitted to terminals 201a1 to 201a8 via ports 105a to 105h, and data is also received from terminals 201a1 to 201a8.

[0014] The switch LSI 104a stores the MAC address and IP address of each terminal in the address learning table 106a during the process of sending and receiving data with terminals 201a1 to 201a8. The address learning table 106a outputs the stored MAC addresses and IP addresses to the network survey device 300, which will be described later, upon instruction from the management means 107a.

[0015] The network survey device 300 includes a NIC (Network Interface Card) 301 connected to the IP network 101, an information collection tool 302, and a file database 303 that stores network switch information files 33. The network survey device 300 may also be composed of a computer such as a microcontroller. An example of microcontroller hardware is shown in Figure 2. It consists of a processor 400 and a storage device 410. Although not shown, the storage device includes a volatile storage device such as random access memory and a non-volatile auxiliary storage device such as flash memory. Alternatively, a hard disk may be provided as an auxiliary storage device instead of flash memory. The processor 400 performs the operations described later by executing a program input from the storage device 410. In this case, the program is input from the auxiliary storage device to the processor 400 via the volatile storage device. The processor 400 may also output data such as calculation results to the volatile storage device of the storage device 410, or it may save the data to the auxiliary storage device via the volatile storage device.

[0016] The information gathering tool 302 includes a simulated communication means 30, a login means 31, and an information collection means 32. The simulated communication means 30 operates independently of the OS installed on the computer. That is, when the simulated communication means 30 is operating, it operates according to the simulated communication parameter file 20 set by the information gathering tool 302, which is the setting means. During operation, it may block timing signals from the OS, for example, and transmit a simulated signal A generated by the simulated communication means 30 to the network switch 102a at the information gathering tool 302's own transmission interval. The setting of the simulated communication parameters by the information gathering tool 302 may be done by input means such as a keyboard or mouse connected to the network survey device 300. Alternatively, it may be input to the information gathering tool 302 via the IP network 101.

[0017] The simulated communication means 30 has the function of sending simulated communications to each terminal 201a1~201a8, 201b1~201bn, and 201n1~201nn. For example, when terminals 201a1~201a8 respond to the simulated communications, the address learning table 106a of the network switch under investigation, such as network switch 102a, learns the IP addresses and MAC addresses of terminals 201a1~201a8. The simulated communications are performed according to the content defined in the simulated communication parameter file 20.

[0018] The simulated communication parameter file 20 defines the target terminals and communication parameters for sending simulated communications. Here, the target terminals are defined by their individual IP addresses or network addresses. If defined by a network address (e.g., 192.168.0.0 / 24), communications will be sent to all terminals with host addresses included in that network address. As simulated communication parameters, the applicable protocol such as ARP (Address Resolution Protocol), ICMP, UDP (User Datagram Protocol), the number of repetitions, the transmission interval, the block size, and TTL (Time to Live) are defined. As mentioned above, since it operates independently of the OS, the transmission interval of the simulated communication is not limited by waiting times due to OS timing signals, etc., and it is possible to send simulated communications to all terminals connected to the network switch 102a, receive responses, and allow the address learning table 106a to learn the new addresses before the memory in the network switch 102a's address learning table 106a is erased after 300 seconds.

[0019] The login means 31 is a function that logs in via the management means 107a of the network switch 102a in order to collect information about the network switch 102a to be investigated. A telnet connection or a web (http) connection may be used for login. A switch list file 21 and a login procedure file 22 are required to log in using a telnet connection or the like. The switch list file 21 is a file in which information for logging in is enumerated, and the information includes an IP address, a connection port number, a login ID, a login password, a switch model, and the like. The login procedure file 22 is a file describing procedures for logging in to the network switch 102a that is the investigation target. For example, procedures for inputting a login ID and a login password to log in, then shifting to an administrator mode for information collection operations, and the like are described. Note that a configuration in which the information collection operation is performed without shifting to the administrator mode may also be adopted. There is one file for one network switch model, and when new models are added, it can be handled simply by adding new files. The settings of the switch list file 21 and the login procedure file 22 may be performed by an input unit such as a keyboard or a mouse connected to the network investigation device 300, similarly to the settings of the simulated communication parameter file 20. Alternatively, the settings may be input to the information collection tool 302 via the IP network 101.

[0020] The information collection unit 32 has a function of logging in to the network switch 102a, after the information collection operation becomes possible, requesting the management unit 107a to output network switch information such as an IP address and a MAC address, and writing the output network switch information F (see FIG. 3) into the file database 303 as the network switch information file 33. The information collection unit 32 requires a command list file 23 in which commands for causing the network switch 102a to output necessary information are described. There is one file for one network switch model, and when new models are added, it can be handled simply by adding new files. The settings of the command list file 23 may be performed by an input unit such as a keyboard or a mouse connected to the network investigation device 300, similarly to the settings of the simulated communication parameter file 20. Alternatively, the settings may be input to the information collection tool 302 via the IP network 101.

[0021] Although the file database 303 has been described as being disposed inside the network investigation device 300 in the present embodiment, if it is configured to exist as a cloud server on the IP network 101, it becomes possible to mutually utilize and analyze data from a plurality of network investigation devices.

[0022] Next, with reference to the overall flowchart of FIG. 3, the procedure for collecting the IP address or MAC address of each terminal by operating the network investigation device 300 will be described.

[0023] First, the simulation communication unit 30 transmits a simulation signal A, in which simulation communication parameters are defined, to the terminal via the IP network 101 and the network switch 102a (step S01). The operation will be described in a state where the following parameters are set in the simulation signal A as an example of the simulation communication parameters. (a) Target terminals: All terminals connected to the network address including the network switch 102a (b) Applied protocol: ICMP (c) Number of repetitions: Unlimited (d) Transmission interval: 1 second (e) Block size: 64 kB (f) TTL: 255 The reason for setting the number of repetitions to unlimited is to perform the process until the address collection is completed. The transmission interval is set so as not to impose a load on the network, and is set to 1 second in the present embodiment. However, since the simulation communication performs simultaneous communication for all communication targets, to cite an extreme example, address collection is possible even if the transmission interval is set to 150 seconds. The block size may be, for example, the minimum size of Ethernet (registered trademark).

[0024] The simulation signal A is received by the network switch 102a within the network address, and the switch LSI 104a registers the source MAC address and the port 103a in the address learning table 106a. When the destination MAC address is not registered in the address learning table 106a, the simulation signal A is transferred to the terminals 201a1 to 201a8 connected to all the ports 105a (step S02).

[0025] Upon receiving simulated signal A, terminals 201a1 to 201a8 (step S03) send response signal B back to network switch 102a (step S04). After switch LSI 104a receives the returned response signal B, it stores the MAC address of the terminal that sent response signal B and the received port number in the address learning table 106a (step S05). The above operations are performed for all target terminals connected to the network address. If multiple networks exist, the operations are performed sequentially for target terminals connected to those network addresses as well.

[0026] The response signals B received by each terminal at the network switch 102a are sent back from port 103a to the information gathering tool 302, which has the source MAC address registered, and a response record is registered (step S06). A response record is the process of writing to a database whether or not there was a response to the simulated communication.

[0027] When the number of responses received for repeated transmissions reaches a predetermined number, it is determined that the MAC addresses of terminals 201a1 to 201a8 have been registered in the address learning table 106a (step S07), and the login means sends a login signal C to the network switch 102a (step S08), requesting login authentication from the management means 107a (step S09). When the information collection tool 302 receives a response signal D indicating that login authentication has been granted and information collection operations are possible (step S10), the information collection means 32 sends an information provision command signal E to the management means 107a of the network switch 102a (step S11). The management means 107a sends the network switch information F of the IP addresses and MAC addresses registered in the address learning table 106a to the information collection tool 302 (step S12). The information collection tool 302 records the received network switch information F in the switch information file (step S13) and stores it in the file database 303.

[0028] The network switch 102a has been described above. If other network switches 102b to 102n exist in the network, a simulated signal is sent to all target terminals connected to network switches 102b to 102n in the same manner as described above. During the process of receiving response signals, the IP addresses and MAC addresses registered in the address learning tables 106b to 106n of network switches 102b to 102n are collected by the information collection tool 302 and stored in the file database 303. If multiple networks exist, the IP addresses and MAC addresses are collected for each network using the same procedure.

[0029] As described above, the network device according to this embodiment can collect the addresses of all terminals connected to the information network before a predetermined time when the addresses learned in the address learning table are deleted. This makes it possible to check the status of terminals connected to the information network in real time, and in particular, it is possible to analyze the latest status of terminals and network switches that increase in number during the initial stages of information network construction.

[0030] While this disclosure describes exemplary embodiments, the various features, aspects, and functions described in the embodiments are not limited to the application of any particular embodiment, but can be applied individually or in various combinations to the embodiments. Accordingly, countless variations not illustrated are conceivable within the scope of the technology disclosed in this specification. These include, for example, modifications, additions, or omissions of at least one component.

[0031] The various aspects of this disclosure are summarized below as an appendix.

[0032] [Note 1] A simulated communication means that transmits a simulated signal to the address learning table of a network switch connected to the network switch to learn the addresses of terminals connected to the network switch. A setting means for setting a simulated communication parameter file for transmitting a simulated signal to all target terminals via the network switch before a predetermined time when the addresses learned in the address learning table are erased, A network survey device comprising the following, which causes the address included in the response signal from the terminal to the simulated signal to be learned in the address learning table. [Note 2] The network survey device according to Appendix 1, characterized in that the setting means blocks instructions from the operating system of the computer on which the simulated communication means is installed, thereby allowing the simulated communication means to operate independently. [Note 3] The network survey device according to Appendix 1 or 2, characterized in that the predetermined time is 300 seconds. [Note 4] A network survey device according to any one of the appendices 1 to 3, further comprising a login means and an information collection means, wherein the login means enables the transmission and reception of data with the network switch, the information collection means collects the address of the terminal learned in the address learning table from the logged-in network switch, and records the collected address in a switch information file. [Note 5] The network survey device according to any one of the appendices 1 to 4, characterized in that login to the network switch is initiated after the simulated communication means has received the response signal a predetermined number of times. [Note 6] A network survey method comprising sending a simulated signal to all target terminals connected to a network switch before a predetermined time has elapsed before the address learning table of the network switch connected to the network erases the learned addresses, thereby causing the address learning table to learn the addresses included in the response signals from the terminals to the simulated signal. [Note 7] A program that causes a computer to send a simulated signal to all target terminals connected to a network switch before a predetermined time has elapsed before the address learning table of the network switch connected to the network erases the addresses it has learned. [Note 8] An information gathering tool comprising: a simulated communication means for transmitting a simulated signal to the address learning table of a network switch connected to a network switch to learn the addresses of terminals connected to the network switch; a setting means for setting a simulated communication parameter file in the simulated communication means for transmitting a simulated signal to all target terminals via the network switch before a predetermined time before the addresses learned in the address learning table are erased; a login means for enabling the transmission and reception of data with the network switch; and an information gathering means for collecting the addresses of the terminals learned in the address learning table from the logged-in network switch. A network survey system comprising an information database that stores the addresses collected by the information collection means as switch information files. [Explanation of Symbols]

[0033] 20: Simulated communication parameter file, 21: Switch list file, 22: Login procedure file, 23: Command list file, 30: Simulated communication means, 31: Login means, 32: Information collection means, 33: Network switch information file, 101: IP network, 102a, 102b, 102n: Network switch, 103a: Port, 104a: Switch LSI, 105a: Port, 106a: Address learning table, 107a: Management means, 201a1, 201a2, 201a8, 201b1, 201b2, 201bn, 201n1, 201n2, 201nn: Terminal, 300: Network survey device, 301: NIC, 302: Information collection tool, 303: File database, 400: Processor, 410: Storage device.

Claims

1. A simulated communication means that transmits a simulated signal to the address learning table of a network switch connected to the network switch to learn the addresses of terminals connected to the network switch. A setting means for setting a simulated communication parameter file for transmitting a simulated signal to all target terminals via the network switch before a predetermined time when the addresses learned in the address learning table are erased, A network survey device comprising the following, which causes the address included in the response signal from the terminal to the simulated signal to be learned in the address learning table.

2. The network survey device according to claim 1, characterized in that the setting means blocks instructions from the operating system of the computer equipped with the simulated communication means and causes the simulated communication means to operate independently.

3. The network survey device according to claim 1 or 2, characterized in that the predetermined time is 300 seconds.

4. The network survey device according to claim 1 or 2, further comprising a login means and an information collection means, wherein the login means enables the transmission and reception of data with the network switch, the information collection means collects the address of the terminal learned in the address learning table from the logged-in network switch, and records the collected address in a switch information file.

5. The network survey device according to claim 1 or 2, characterized in that login to the network switch is initiated after the simulated communication means has received the response signal a predetermined number of times.

6. A network survey method comprising sending a simulated signal to all target terminals connected to a network switch before a predetermined time has elapsed before the address learning table of the network switch connected to the network erases the learned addresses, thereby causing the address learning table to learn the addresses included in the response signals from the terminals to the simulated signal.

7. A program that causes a computer to send a simulated signal to all target terminals connected to a network switch before a predetermined time has elapsed before the address learning table of the network switch connected to the network erases the addresses it has learned.

8. An information gathering tool comprising: a simulated communication means for transmitting a simulated signal to the address learning table of a network switch connected to a network switch to learn the addresses of terminals connected to the network switch; a setting means for setting a simulated communication parameter file in the simulated communication means for transmitting a simulated signal to all target terminals via the network switch before a predetermined time before the addresses learned in the address learning table are erased; a login means for enabling the transmission and reception of data with the network switch; and an information gathering means for collecting the addresses of the terminals learned in the address learning table from the logged-in network switch. A network survey system comprising an information database that stores the addresses collected by the information collection means as switch information files.

Images