Packet capture device and method

Abstract

A packet capturing device (1) includes: a normal capturing function unit (2) that, in response to a capture start instruction received from the outside, accumulates packets, which are among packets flowing through a network (100) to be monitored and match a condition of a target flow registered in a flow table (20), and converts the accumulated packets into a capture file; and a short-term capturing function unit (3) that accumulates packets received from the network (100) within a period between the arrival of the capture start instruction and the registration of the condition of the target flow in the flow table (20) and converts the accumulated packets into a capture file.

Description

[Technical field]

[0001] The present invention relates to a packet capture device and method for capturing packets flowing through a monitored network. [Background technology]

[0002] With the advancement of virtualization technology in NFV (Network Functions Virtualization) / SDN (Software Defined Networking), various services using VMs (Virtual Machines) and the like are being provided. A packet capture device can selectively capture packets of a specific flow, for example, a collection of packets that have the same rule for combining a source MAC (Media Access Control) address, a destination MAC address, and an IP (Internet Protocol) address. Such a packet capture device is one of the essential devices for analyzing the quality and failures when providing the above-mentioned services.

[0003] 14 shows the configuration of the packet capture device disclosed in Patent Document 1. A packet capture device 200 receives mirroring packets from a network (NW) 100 to be monitored. A filter unit 201 selects packets to be captured. The selection in the filter unit 201 is a process of selecting packets that match a flow designated as a capture target.

[0004] For the purpose of selecting packets, the filter unit 201 includes a flow table 202 in which the conditions of a specified flow to be captured are registered. When a packet is input to the filter unit 201, the filter unit 201 checks the packet against the conditions of the flow to be captured recorded in the flow table 202, passes packets that match the conditions, and discards packets that do not match the conditions.

[0005] The buffer unit 203 accumulates packets that have passed through the filter unit 201. When the packet data accumulated in the buffer unit 203 reaches a predetermined data amount or a predetermined time has elapsed, the capture file generation unit 204 converts the packet data into a capture file in pcap (packet capture) format. The capture file is saved in the storage unit 205.

[0006] The capture control unit 206 adds or deletes the conditions of the target flow to or from the flow table 202 based on the externally specified flow to be captured.

[0007] In packet capture for the purpose of fault analysis of a specific flow, it is necessary to capture packets immediately after the fault is detected. However, in the conventional packet capture device 200, even if a capture start instruction is notified from outside in response to the occurrence of a fault, packet capture does not start until the reception process of the notification and the condition registration process of the target flow based on the notification are completed. Therefore, there is a time lag before packet capture starts, and packets cannot be captured immediately after the fault occurs, making fault analysis difficult. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent No. 4955722 Summary of the Invention [Problem to be solved by the invention]

[0009] The present invention has been made to solve the above-mentioned problems, and aims to provide a packet capture device and method that is capable of capturing all packets that flow in during the time lag of the conventional capture function when a capture start instruction is issued from outside. [Means for solving the problem]

[0010] The packet capture device of the present invention is characterized in that it comprises a first capture function unit configured to accumulate packets flowing through a monitored network that match the conditions of a target flow registered in a first flow table by an external capture start instruction and convert them into a capture file, and a second capture function unit configured to accumulate packets received from the network within the period required from the arrival of the capture start instruction to the registration of the conditions of the target flow in the first flow table and convert them into a capture file.

[0011] In one configuration example of the packet capture device of the present invention, the first capture function unit includes the first flow table configured to store conditions of the target flow, a first filter unit configured to pass only packets that match the conditions registered in the first flow table among packets received from the network, a first buffer unit configured to accumulate packets that have passed through the first filter unit, a first capture file generation unit configured to convert the packets accumulated in the first buffer unit into a capture file, and a first capture file generation unit configured to register the conditions of the target flow specified by the capture start instruction in the first flow table. and a capture control unit configured to store packets received from the network, the second capture function unit comprising a second buffer unit having a ring buffer structure configured to store packets received from the network, and a second capture file generation unit configured to convert the packets stored in the second buffer unit into a capture file, the capture control unit instructing the second buffer unit to stop storing packets when registration in the first flow table is completed, and the second capture file generation unit instructing the second buffer unit to resume storing packets when output of a capture file generated from the packets stored in the second buffer unit is completed.

[0012] In addition, in one configuration example of the packet capture device of the present invention, the second capture function unit is characterized in that it selectively converts into a capture file only those packets among the accumulated packets that match the conditions of the target flow.

[0013] In one configuration example of the packet capture device of the present invention, the first capture function unit includes the first flow table configured to store the conditions of the target flow, a first filter unit configured to pass only packets that match the conditions registered in the first flow table among packets received from the network, a first buffer unit configured to accumulate packets that have passed through the first filter unit, a first capture file generation unit configured to convert the packets accumulated in the first buffer unit into a capture file, and a capture control unit configured to register the conditions of the target flow specified by the capture start instruction in the first flow table and a second flow table of the second capture function unit, and the second capture function unit includes the second flow table configured to store the conditions of the target flow, a second buffer unit with a ring buffer structure configured to accumulate packets received from the network, and a second capture file generation unit configured to selectively convert only packets that match the conditions registered in the second flow table among packets accumulated in the second buffer unit into a capture file.

[0014] Furthermore, in one configuration example of the packet capture device of the present invention, the first capture function unit compares the packet with the conditions registered in the first flow table each time a packet is received from the network and outputs the comparison result to the second capture function unit, and the second capture function unit accumulates only packets that are received from the network within the period required from the arrival of the capture start instruction to the registration of the conditions of the target flow in the first flow table and that do not match the conditions registered in the first flow table, and converts them into capture files.

[0015] In one configuration example of the packet capture device of the present invention, the first capture function unit includes the first flow table configured to store the conditions of the target flow, a first filter unit configured to pass only packets that match the conditions registered in the first flow table among packets received from the network, and output the matching result to the second capture function unit, a first buffer unit configured to accumulate packets that have passed through the first filter unit, a first capture file generation unit configured to convert the packets accumulated in the first buffer unit into a capture file, and a capture control unit configured to register the conditions of the target flow specified by the capture start instruction in the first flow table, and the second capture function unit includes a second filter unit configured to pass only packets that have obtained the matching result that they do not match the conditions registered in the first flow table among packets received from the network, a second buffer unit with a ring buffer structure configured to accumulate packets that have passed through the second filter unit, and a second capture file generation unit configured to convert the packets accumulated in the second buffer unit into a capture file.

[0016] Furthermore, one configuration example of a packet capture device of the present invention is characterized in that it further comprises a memory unit for storing capture files output by each of the first capture function unit and the second capture function unit, and an arbitration unit configured to control the writing of the capture file generated by the first capture function unit to be given priority when writing the capture file to the memory unit.

[0017] Furthermore, the packet capture method of the present invention is characterized by including a first step of accumulating in a first buffer, among packets flowing through a network to be monitored, packets that match the conditions of a target flow registered in a flow table by an external capture start instruction; a second step of converting the packets accumulated in the first buffer into a capture file; a third step of accumulating in a second buffer, packets received from the network within a period required from the arrival of the capture start instruction to the registration of the conditions of the target flow in the flow table; and a fourth step of converting the packets accumulated in the second buffer into a capture file. Effect of the Invention

[0018] According to the present invention, in addition to the first capture function unit, a second capture function unit is provided that accumulates packets received from the network within the period required from the arrival of a capture start instruction to the registration of the target flow conditions in the first flow table and converts them into a capture file. By providing the second capture function unit, in the present invention, packets are accumulated in the second capture function unit before the capture start instruction is issued, so that when a capture start instruction is issued from outside, for example, triggered by the detection of a network failure, it becomes possible to capture all packets that flow in during the time lag of the first capture function unit without missing any of them. [Brief description of the drawings]

[0019] [Figure 1]FIG. 1 is a block diagram showing a configuration of a packet capture device according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a flowchart illustrating the operation of the short-term capture function unit according to the first embodiment of the present invention. [Diagram 3] FIG. 3 is a flowchart illustrating the operation of the capture control unit of the normal capture function unit according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a flowchart for explaining the operations of the filter unit, the buffer unit, and the capture file generation unit of the normal capture function unit according to the first embodiment of the present invention. [Diagram 5] FIG. 5 is a flowchart illustrating the operation of the arbitration unit according to the first embodiment of the present invention. [Figure 6] FIG. 6 is a diagram illustrating an example of the operation of the packet capture device according to the first embodiment of the present invention. [Figure 7] FIG. 7 is a block diagram showing a configuration of a packet capture device according to the second embodiment of the present invention. [Figure 8] FIG. 8 is a flowchart illustrating the operation of the short-term capture function unit according to the second embodiment of the present invention. [Figure 9] FIG. 9 is a flowchart illustrating the operation of the capture control unit of the normal capture function unit according to the second embodiment of the present invention. [Figure 10] FIG. 10 is a block diagram showing a configuration of a packet capture device according to the third embodiment of the present invention. [Figure 11] FIG. 11 is a flowchart for explaining the operations of the filter unit, the buffer unit, and the capture file generating unit of the normal capture function unit according to the third embodiment of the present invention. [Figure 12] FIG. 12 is a flowchart illustrating the operation of the inverting filter unit of the short-term capture function unit according to the third embodiment of the present invention. [Figure 13] FIG. 13 is a block diagram showing an example of the configuration of a computer that realizes the packet capture device according to the first to third embodiments of the present invention. [Figure 14] FIG. 14 is a block diagram showing the configuration of a conventional packet capture device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] [First Example] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS First, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a block diagram showing the configuration of a packet capture device according to a first embodiment of the present invention. The packet capture device 1 of this embodiment differs from conventional devices in that, in addition to a normal capture function unit 2 (first capture function unit) for capturing packets that match the conditions of a specific flow based on an external capture start instruction, the device newly includes a short-term capture function unit 3 (second capture function unit) for capturing packets that are input during the time lag period until the normal capture function unit 2 starts capturing.

[0021] Furthermore, the packet capture device 1 includes a memory unit 4 for storing the capture files output by each of the normal capture function unit 2 and the short-term capture function unit 3, and an arbitration unit 5 that controls the writing of the capture file generated by the normal capture function unit 2 to be given priority when writing the capture file to the memory unit 4.

[0022] The normal capture function unit 2 includes a flow table 20 that stores the conditions of the flow to be captured, a filter unit 21 (first filter unit) that passes only packets that match the conditions registered in the flow table 20 among packets received from the network 100 to be monitored, a buffer unit 22 (first buffer unit) that accumulates the packets that have passed through the filter unit 21, a capture file generation unit 23 (first capture file generation unit) that converts the packets accumulated in the buffer unit 22 into a capture file, and a capture control unit 24 that registers the conditions of the flow to be captured specified by an external capture start instruction in the flow table 20.

[0023] The short-term capture function unit 3 includes a ring buffer unit 30 (second buffer unit) that accumulates packets received from the network 100, and a short-term capture file generation unit 31 (second capture file generation unit) that converts the packets accumulated in the ring buffer unit 30 into a capture file.

[0024] Figure 2 is a flowchart explaining the operation of the short-term capture function unit 3, Figure 3 is a flowchart explaining the operation of the capture control unit 24 of the normal capture function unit 2, and Figure 4 is a flowchart explaining the operation of the filter unit 21, buffer unit 22, and capture file generation unit 23 of the normal capture function unit 2.

[0025] The short-term capture function unit 3 cannot know in advance the flows to be captured that are notified from the outside. Therefore, the short-term capture function unit 3 captures packets of all flows until it receives an instruction to stop storing from the capture control unit 24 of the normal capture function unit 2.

[0026] Specifically, the short-term capture function unit 3 has a ring buffer unit 30. The ring buffer unit 30 accumulates mirroring packets that are copies of packets flowing through the network 100 (Step S100 in FIG. 2).

[0027] The mirroring packets are generated by the mirroring function of the devices on the network 100. When the ring buffer unit 30 becomes full, the oldest stored packet is overwritten with the newest packet. Packets are continuously stored in the ring buffer unit 30 in this manner.

[0028] In this embodiment, packets input during the time lag period until the normal capture function unit 2 starts capturing are captured by the short-term capture function unit 3. Therefore, the ring buffer unit 30 needs to have a capacity capable of storing packets for a period longer than the time lag of the normal capture function unit 2.

[0029] On the other hand, when the capture control unit 24 of the normal capture function unit 2 receives a capture start instruction for a specific flow from the outside (YES in step S200 in FIG. 3), it registers the conditions of the flow to be captured in the flow table 20 (step S201 in FIG. 3). The conditions of the flow to be captured include information such as the source MAC address, destination MAC address, and IP address. These conditions of the target flow are added to the capture start instruction received from the outside.

[0030] After registration in the flow table 20 is completed, the capture control unit 24 outputs a stop instruction signal to the ring buffer unit 30 of the short-term capture function unit 3 (step S202 in FIG. 3), and outputs a file generation instruction signal to the short-term capture file generation unit 31 of the short-term capture function unit 3 and the capture file generation unit 23 of the normal capture function unit 2 (step S203 in FIG. 3).

[0031] The ring buffer unit 30 of the short-term capture function unit 3 stops accumulating packets (step S102 in FIG. 2) due to the input of the stop instruction signal from the capture control unit 24 (YES in step S101 in FIG. 2).

[0032] When a file generation instruction signal is input from the capture control unit 24 (YES in step S103 in FIG. 2), the short-term capture file generation unit 31 of the short-term capture function unit 3 extracts packets accumulated in the ring buffer unit 30 and converts them into a capture file in pcap format (step S104 in FIG. 2).

[0033] The short-term capture file generation unit 31 transfers the generated capture file to the arbitration unit 5 (step S105 in FIG. 2). After completing the transfer of the capture file, the short-term capture file generation unit 31 outputs a packet accumulation restart instruction signal to the ring buffer unit 30 (step S106 in FIG. 2).

[0034] In response to the restart instruction signal being input from the short-term capture file generating unit 31, the ring buffer unit 30 restarts storing packets (step S107 in FIG. 2).

[0035] On the other hand, the filter unit 21 of the normal capture function unit 2, every time it receives a mirroring packet from the network 100, compares the packet with the conditions of the flow to be captured registered in the flow table 20, passes packets that match the conditions, and discards packets that do not match the conditions (step S300 in FIG. 4).

[0036] The buffer unit 22 of the normal capture function unit 2 accumulates packets that have passed through the filter unit 21 (step S301 in FIG. 4). A representative example of the buffer unit 22 is a FIFO (First In, First Out) buffer.

[0037] When a file generation instruction signal is input from the capture control unit 24 (YES in step S302 in FIG. 4), the capture file generation unit 23 of the normal capture function unit 2 extracts packets accumulated in the buffer unit 22 and converts them into a capture file in pcap format (step S304 in FIG. 4) when the file generation conditions are satisfied (step S303 in FIG. 4).

[0038] The file generation condition is either that the number of packets stored in the buffer unit 22 reaches a predetermined amount, or that a predetermined time has elapsed. Which of these is the file generation condition is set in advance. In this manner, each time the number of packets stored in the buffer unit 22 reaches a predetermined amount, or each time a predetermined time has elapsed, a capture file is generated by the capture file generating unit 23 .

[0039] The capture file generation unit 23 transfers the generated capture file to the arbitration unit 5 (step S305 in FIG. 4). After the file generation instruction signal is input from the capture control unit 24, the determination in step S302 is always YES until a file stop instruction signal, which will be described later, is input.

[0040] Next, when the capture control unit 24 of the normal capture function unit 2 receives an instruction to stop capturing a specific flow from the outside (YES in step S204 in FIG. 3), it deletes the condition of the capture target flow for which the capture stop has been specified from the flow table 20 (step S205 in FIG. 3).

[0041] After the flow table 20 has been deleted, the capture control unit 24 outputs a file stop instruction signal to the capture file generating unit 23 of the normal capture function unit 2 (Step S206 in FIG. 3).

[0042] When the capture file generation unit 23 of the normal capture function unit 2 receives a file stop instruction signal from the capture control unit 24 (YES in step S306 in FIG. 4), it stops generating the capture file (step S307 in FIG. 4).

[0043] Next, the operation of the arbitration unit 5 will be described with reference to Fig. 5. The arbitration unit 5 stores the capture file transferred from the normal capture function unit 2 and the capture file transferred from the short-term capture function unit 3 in the storage unit 4. Here, if there is a capture file transferred from the normal capture function unit 2 (YES in step S400 in Fig. 5), the arbitration unit 5 prioritizes storing the capture file transferred from the normal capture function unit 2 in the storage unit 4 (step S401 in Fig. 5).

[0044] In addition, if there is no capture file transfer from the normal capture function unit 2 but there is a capture file transferred from the short-term capture function unit 3 (YES in step S402 of Figure 5), the arbitration unit 5 stores the capture file transferred from the short-term capture function unit 3 in the memory unit 4 (step S403 of Figure 5).

[0045] 6 is a diagram showing an example of the operation of the packet capture device 1 of this embodiment. Here, an example will be described in which packets of flow #A that matches the conditions of the target flow registered in the flow table 20 are captured by the packet capture device 1.

[0046] As described above, the ring buffer unit 30 of the short-term capture function unit 3 accumulates packets of all flows. The time width TW in FIG.

[0047] When a capture start instruction for a specific flow is input from outside at time t1, the ring buffer unit 30 stops storing packets at time t2 after a time lag has elapsed. The time lag is the time required from the arrival of the capture start instruction until the conditions of the flow to be captured are registered in the flow table 20.

[0048] As described above, when the conditions of the flow to be captured are registered in the flow table 20, a stop instruction signal is output from the capture control unit 24 to the ring buffer unit 30, and a file generation instruction signal is output to the short-term capture file generation unit 31 and the capture file generation unit 23.

[0049] Therefore, at time t2, the ring buffer unit 30 stops storing packets, and thereafter the normal capture function unit 2 stores packets of the target flow and generates a capture file. The normal capture function unit 2 continuously generates the capture file until an external command to stop capturing is received.

[0050] On the other hand, the capture file that the short-term capture function unit 3 transfers to the storage unit 4 is already in a state in which generation has been completed while the normal capture function unit 2 is storing packets of the target flow.

[0051] Therefore, the arbitration unit 5 gives priority to the transfer of capture files continuously generated by the normal capture function unit 2, and stores the capture files transferred from the short-term capture function unit 3 in the memory unit 4 during times when the normal capture function unit 2 is not transferring capture files.

[0052] As described above, in this embodiment, packets are accumulated in the short-term capture function unit 3 before a capture start instruction is issued. Therefore, when a capture start instruction is issued from outside, for example in response to detection of a network failure, it is possible to capture all packets that normally flow in during the time lag of the capture function unit 2 without missing any of them.

[0053] When the capture file transfer to the arbitration unit 5 is completed, the short-term capture file generation unit 31 outputs a restart instruction signal to the ring buffer unit 30, and the ring buffer unit 30 restarts storing packets. Therefore, since the storage of packets has been restarted before the next capture start instruction arrives, when the next capture start instruction arrives from outside, it becomes possible to capture packets immediately after the instruction arrives.

[0054] [Second Example] Next, a second embodiment of the present invention will be described. Fig. 7 is a block diagram showing the configuration of a packet capture device according to the second embodiment of the present invention. A packet capture device 1a of this embodiment includes a normal capture function unit 2a (first capture function unit), a short-term capture function unit 3a (second capture function unit), an arbitration unit 5, and a storage unit 4.

[0055] The normal capture function unit 2a includes a flow table 20, a filter unit 21, a buffer unit 22, a capture file generation unit 23, and a capture control unit 24a that registers the conditions of the flow to be captured specified by an external capture start instruction in the flow table 20 and the flow table 32 of the short-term capture function unit 3a.

[0056] The short-term capture function unit 3a includes a ring buffer unit 30, a short-term capture file generation unit 31a that selectively converts into a capture file only those packets that match the conditions of the flow to be captured among the packets stored in the ring buffer unit 30, and a flow table 32.

[0057] This embodiment differs from the first embodiment in that the short-term capture file generator 31a selects only data of a flow to be captured from packets stored in the ring buffer unit 30 and creates a capture file.

[0058] FIG. 8 is a flowchart for explaining the operation of the short-term capture function unit 3a, and FIG. 9 is a flowchart for explaining the operation of the capture control unit 24a of the normal capture function unit 2a. The operation of the ring buffer unit 30 of the short-term capture function unit 3a (steps S100 to S102, S107 in FIG. 8) is the same as that in the first embodiment.

[0059] When the capture control unit 24a of the normal capture function unit 2a receives a capture start instruction for a specific flow from the outside (YES in step S200 in FIG. 9), it registers the conditions of the flow to be captured in the flow table 20 and the flow table 32 of the short-term capture function unit 3a (step S201a in FIG. 9). In this way, the same contents as those in the flow table 20 are registered in the flow table 32. As described in the first embodiment, the conditions of the flow to be captured are added to the capture start instruction received from the outside.

[0060] After registration in the flow tables 20 and 32 is completed, the capture control unit 24a outputs a stop instruction signal to the ring buffer unit 30 of the short-term capture function unit 3a (step S202 in FIG. 9), and outputs a file generation instruction signal to the short-term capture file generation unit 31a of the short-term capture function unit 3a and the capture file generation unit 23 of the normal capture function unit 2a (step S203 in FIG. 9).

[0061] When a file generation instruction signal is input from the capture control unit 24a (YES in step S103 of FIG. 8), the short-term capture file generation unit 31a of the short-term capture function unit 3a extracts packets accumulated in the ring buffer unit 30 and converts them into a capture file (step S104a of FIG. 8).

[0062] At this time, the short-term capture file generation unit 31a compares the packets retrieved from the ring buffer unit 30 with the conditions of the capture target flow registered in the flow table 32, and selectively converts only the packets that match the conditions into a capture file.

[0063] The short-term capture file generating unit 31a transfers the generated capture file to the arbitration unit 5 (step S105 in FIG. 8), and after the transfer is completed, outputs a packet accumulation restart instruction signal to the ring buffer unit 30 (step S106 in FIG. 8).

[0064] When the capture control unit 24a of the normal capture function unit 2a receives an instruction to stop capturing a specific flow from the outside (YES in step S204 in FIG. 9), it deletes the conditions of the captured flow for which the capture stop has been specified from the flow table 20 and the flow table 32 (step S205a in FIG. 9).

[0065] After the flow tables 20 and 32 have been deleted, the capture control unit 24a outputs a file stop instruction signal to the capture file generating unit 23 of the normal capture function unit 2a (Step S206 in FIG. 9).

[0066] The operations of the filter unit 21, buffer unit 22, and capture file generator 23 of the normal capture function unit 2a (FIG. 4), and the operations of the storage unit 4 and arbitration unit 5 (FIG. 5) are the same as those in the first embodiment.

[0067] As described in the first embodiment, the ring buffer unit 30 of the short-term capture function unit 3 accumulates packets of all flows, including packets other than those of the flow to be captured. For this reason, the short-term capture function unit 3 of the first embodiment converts packets of all flows into capture files.

[0068] On the other hand, the short-term capture file generator 31a of this embodiment compares the packets retrieved from the ring buffer unit 30 with the conditions of the capture target flow registered in the flow table 32, and selectively converts only the packets that match the conditions into a capture file. By such selective file conversion, this embodiment can prevent packets of flows that are not the capture target from being converted into a capture file. As a result, this embodiment not only makes it easier to analyze a fault using a capture file, but also makes it possible to reduce the capacity of the storage unit 4.

[0069] [Third Example] Next, a third embodiment of the present invention will be described. Fig. 10 is a block diagram showing the configuration of a packet capture device according to the third embodiment of the present invention. A packet capture device 1b of this embodiment includes a normal capture function unit 2b (first capture function unit), a short-term capture function unit 3b (second capture function unit), an arbitration unit 5, and a storage unit 4.

[0070] The normal capture function unit 2b includes a flow table 20, a filter unit 21b that compares the packet with the conditions registered in the flow table 20 each time a packet is received from the network 100 and outputs the comparison result to the short-term capture function unit 3b, a buffer unit 22, a capture file generation unit 23, and a capture control unit 24.

[0071] The short-term capture function unit 3b includes a ring buffer unit 30, a short-term capture file generation unit 31, and an inversion filter unit 33 (second filter unit) that passes only those packets received from the network 100 that do not match the conditions registered in the flow table 20.

[0072] This embodiment differs from the first embodiment in that the filter unit 21b of the normal capture function unit 2b outputs the result of matching the conditions of the flow to be captured registered in the flow table 20 with the mirroring packet, and in that the short-term capture function unit 3b newly includes an inverted filter unit 33.

[0073] FIG. 11 is a flowchart for explaining the operation of the filter unit 21b, the buffer unit 22 and the capture file generator 23 of the normal capture function unit 2b, and FIG. 12 is a flowchart for explaining the operation of the inverting filter unit 33 of the short-term capture function unit 3b.

[0074] The filter unit 21b of the normal capture function unit 2b, every time it receives a mirroring packet from the network 100, checks the packet against the conditions of the flow to be captured registered in the flow table 20, passes packets that match the conditions, and discards packets that do not match the conditions. At the same time, the filter unit 21b outputs the check result (match / no match) to the short-term capture function unit 3b (Step S300b in FIG. 11).

[0075] The inverting filter unit 33 of the short-term capture function unit 3b receives a matching result from the filter unit 21b each time it receives a mirroring packet from the network 100 (step S500 in FIG. 12), and outputs only those packets for which the matching result indicates that they do not match the conditions of the flow to be captured to the downstream ring buffer unit 30 (steps S501 and S502 in FIG. 12).

[0076] The operation of the ring buffer unit 30 and the short-term capture file generation unit 31 of the short-term capture function unit 3b (FIG. 2), the operation of the buffer unit 22 and the capture file generation unit 23 of the normal capture function unit 2b (FIG. 11 steps S301 to S307), the operation of the capture control unit 24 of the normal capture function unit 2b (FIG. 3), and the operation of the memory unit 4 and the arbitration unit 5 (FIG. 5) are the same as those in the first embodiment.

[0077] As described in the first embodiment, the time lag of the normal capture function unit 2b is the time required from the arrival of a capture start instruction to the registration of the conditions of the flow to be captured in the flow table 20. When the conditions of the flow to be captured are registered in the flow table 20, a stop instruction signal is output from the capture control unit 24 to the ring buffer unit 30, and a file generation instruction signal is output to the short-term capture file generation unit 31 and the capture file generation unit 23.

[0078] Until the conditions of the flow to be captured are registered in the flow table 20, the filter unit 21b outputs a collation result indicating that the packets of the flow to be captured do not match the conditions. Therefore, the inverting filter unit 33 outputs the packets of the flow to be captured to the subsequent ring buffer unit 30. The filter unit 21b does not output the packets of the flow to be captured to the subsequent buffer unit 22.

[0079] When the time lag of the normal capture function unit 2b has elapsed and the conditions of the flow to be captured are registered in the flow table 20, the filter unit 21b outputs a collation result indicating that the packets of the flow to be captured match the conditions. As a result, the inverting filter unit 33 discards the packets of the flow to be captured and does not output them to the downstream ring buffer unit 30. On the other hand, the filter unit 21b outputs the packets of the flow to be captured to the buffer unit 22.

[0080] In other words, until the time lag of the normal capture function unit 2b has elapsed, packets of the flow to be captured are accumulated only in the short-term capture function unit 3b, and after the time lag has elapsed, they are accumulated only in the normal capture function unit 2b, making it possible to prevent duplicate accumulation of packets of the target flow in the short-term capture function unit 3b and the normal capture function unit 2b.

[0081] In this embodiment, not only do the capture periods for the same flow by the normal capture function unit 2b and the short-term capture function unit 3b not overlap, but data already being captured by the normal capture function unit 2b is not output from the short-term capture function unit 3. This allows the ring buffer unit 30 to efficiently hold packets, and also makes it possible to reduce the capacity of the storage unit 4.

[0082] The packet capture devices 1, 1a, and 1b described in the first to third embodiments can be realized by a computer having a CPU (Central Processing Unit), a storage device, and an interface, and a program that controls these hardware resources. An example of the configuration of this computer is shown in FIG.

[0083] The computer includes a CPU 300, a storage device 301, and an interface device (I / F) 302. A packet receiving circuit and a device to which captured data is output are connected to the I / F 302. In such a computer, a program for implementing the packet capture method of the present invention is stored in the storage device 301. The CPU 300 executes the processes described in the first to third embodiments in accordance with the program stored in the storage device 301.

[0084] Furthermore, a part of the packet capture devices 1, 1a, and 1b described in the first to third embodiments may be configured with hardware logic such as an application specific integrated circuit (ASIC) or a field-programmable gate array (FPGA). [Industrial Applicability]

[0085] The present invention can be applied to, for example, a technique for analyzing the cause of a communication failure in a network. [Explanation of symbols]

[0086] 1, 1a, 1b...packet capture device, 2, 2a, 2b...normal capture function unit, 3, 3a, 3b...short-term capture function unit, 4...memory unit, 5...arbitration unit, 20, 32...flow table, 21, 21b...filter unit, 22...buffer unit, 23...capture file generation unit, 24, 24a...capture control unit, 30...ring buffer unit, 31, 31a...short-term capture file generation unit, 33...invert filter unit.

Claims

1. a first capture function unit configured to accumulate packets that match a condition of a target flow registered in a first flow table in response to an external capture start instruction among packets flowing through a network to be monitored, and convert the packets into a capture file; and a second capture function unit configured to accumulate packets received from the network within the period required from the arrival of the capture start instruction to the registration of the conditions of the target flow in the first flow table and convert them into a capture file.

2. 2. The packet capture device according to claim 1, The first capture function unit includes: the first flow table configured to store conditions of the target flow; a first filter unit configured to pass only packets that match a condition registered in the first flow table among packets received from the network; a first buffer configured to store packets that have passed through the first filter; a first capture file generating unit configured to convert the packets stored in the first buffer unit into a capture file; a capture control unit configured to register a condition of a target flow designated by the capture start instruction in the first flow table; The second capture function unit includes: a second buffer section having a ring buffer structure configured to store packets received from the network; a second capture file generating unit configured to convert the packets stored in the second buffer unit into a capture file; the capture control unit instructs the second buffer unit to stop storing packets when the registration in the first flow table is completed; A packet capture device characterized in that the second capture file generation unit instructs the second buffer unit to resume storing packets when output of the capture file generated from the packets stored in the second buffer unit is completed.

3. 2. The packet capture device according to claim 1, The packet capture device according to the present invention is characterized in that the second capture function unit selectively converts, from among the accumulated packets, only packets that match the conditions of the target flow into a capture file.

4. 4. The packet capture device according to claim 3, The first capture function unit includes: the first flow table configured to store conditions of the target flow; a first filter unit configured to pass only packets that match a condition registered in the first flow table among packets received from the network; a first buffer configured to store packets that have passed through the first filter; a first capture file generating unit configured to convert the packets stored in the first buffer unit into a capture file; a capture control unit configured to register a condition of a target flow designated by the capture start instruction in the first flow table and a second flow table of the second capture function unit; The second capture function unit includes: the second flow table configured to store conditions of the target flow; a second buffer section having a ring buffer structure configured to store packets received from the network; and a second capture file generation unit configured to selectively convert, from among the packets stored in the second buffer unit, only those packets that match conditions registered in the second flow table into capture files.

5. 2. The packet capture device according to claim 1, the first capture function unit compares the packet with a condition registered in the first flow table every time the first capture function unit receives a packet from the network, and outputs a comparison result to the second capture function unit; The second capture function unit is a packet capture device characterized in that it accumulates only packets received from the network within the period required from the arrival of the capture start instruction to the registration of the conditions of the target flow in the first flow table, and converts them into capture files, for which the comparison result indicates that the packets do not match the conditions registered in the first flow table.

6. 6. The packet capture device according to claim 5, The first capture function unit includes: the first flow table configured to store conditions of the target flow; a first filter unit configured to pass only packets that match a condition registered in the first flow table among packets received from the network, and to output the matching result to the second capture function unit; a first buffer unit configured to store packets that have passed through the first filter unit; a first capture file generating unit configured to convert the packets stored in the first buffer unit into a capture file; a capture control unit configured to register a condition of a target flow designated by the capture start instruction in the first flow table; The second capture function unit includes: a second filter unit configured to pass only packets that do not match the conditions registered in the first flow table among packets received from the network; a second buffer unit having a ring buffer structure configured to accumulate packets that have passed through the second filter unit; and a second capture file generating unit configured to convert the packets stored in the second buffer unit into a capture file.

7. 7. The packet capture device according to claim 1, a storage unit for storing a capture file output by each of the first capture function unit and the second capture function unit; and an arbitration unit configured to control the writing of the capture file generated by the first capture function unit to be given priority when writing the capture file to the memory unit.

8. a first step of accumulating in a first buffer packets that match a condition of a target flow registered in a flow table in response to an external capture start instruction, among packets flowing through a network to be monitored; a second step of converting the packets stored in the first buffer into a capture file; a third step of accumulating in a second buffer the packets received from the network within a period required from the arrival of the capture start instruction to the registration of the target flow conditions in the flow table; and a fourth step of converting the packets stored in the second buffer section into a capture file.

Images