Information processing device, method and program

Abstract

To make it possible to automatically detect and manage an apparatus that performs communication without using a network layer address.SOLUTION: An information processing device connected to a network includes: a frame receiving unit that receives a frame flowing through the network; a loop detection frame detecting unit that detects a loop detection frame from the received frame received by the frame receiving unit; and an apparatus information recording unit that records transmission source information about the detected loop detection frame as apparatus information on a communication apparatus connected to the network.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to techniques for detecting devices on a network. [Background technology]

[0002] Conventionally, a technology has been proposed in which log information indicating loop detection from a floor switch with loop detection function is monitored in a switch log DB, and when a loop is detected, a switch port management DB is referenced, and the installation location of the switch is identified from the floor switch identification name contained in the log information, the connecting LAN cable number from the port number on the switch, and the installation location of the connected equipment, as well as an installation drawing ID indicating the installation location drawing, and a drawing pre-registered in a LAN wiring drawing management DB is read using the installation drawing ID, and the identified installation location of the loop-causing switch, the connecting LAN cable number, and the installation locations of the connected equipment are displayed on the screen and an alarm is issued, thereby notifying an administrator of the occurrence of a loop and its location when a network loop occurs, and outputting port usage status, without the need to install dedicated equipment for loop detection (see Patent Document 1).

[0003] In addition, when a network concentrator that constitutes a network system receives a specified HTTP request from a management computer, it responds with data displaying a management screen that can be operated on a web browser, and when a user sends a specified command using the management screen displayed on the management computer's display, the network concentrator sounds a buzzer and blinks a loop indicator LED.Furthermore, when the MAC chip of the network concentrator detects a loop through the network concentrator, it turns on a loop flag in a register, and the CPU of the network concentrator refers to this, and if the loop flag is ON, it sounds a buzzer and blinks the loop indicator LED, thereby easily identifying the location of the network concentrator (see Patent Document 2). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2012-151587 A [Patent Document 2] JP 2011-61870 A Summary of the Invention [Problem to be solved by the invention]

[0005] Conventionally, technologies have been used to automatically detect and manage devices connected to a network. However, conventional automatic device detection is performed by analyzing communications using network layer addresses such as IP addresses, and it has been difficult to automatically detect and manage devices that do not use network layer addresses for communication, such as switches.

[0006] In view of the above problems, an object of the present disclosure is to automatically detect and enable management of devices that communicate without using network layer addresses. [Means for solving the problem]

[0007] An example of the present disclosure is an information processing device connected to a network, Ethernet a frame receiving means for receiving a frame; and a received frame received by the frame receiving means. and detecting the received frame as a loop detection frame if the received frame matches the known loop detection frame detection information. A loop detection frame detection means; an estimation means for estimating whether a received frame that has not been detected as a loop detection frame by the loop detection frame detection means among the received frames is a loop detection frame that does not match the known loop detection frame detection information, and estimating that the received frame is a loop detection frame if the received frame has a predetermined Ether type and a predetermined type of MAC address and is periodically transmitted from the same sender; The information processing device includes a device information recording means for recording source information of the detected loop detection frame as device information of a communication device connected to the network.

[0008] The present disclosure can be understood as an information processing device, a system, a method executed by a computer, or a program executed by a computer. The present disclosure can also be understood as such a program recorded on a recording medium readable by a computer or other device, machine, etc. Here, a recording medium readable by a computer, etc. refers to a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read by a computer, etc. Effect of the Invention

[0009] According to the present disclosure, it becomes possible to automatically detect and manage devices that communicate without using network layer addresses. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic diagram showing a configuration of a system according to an embodiment. [Diagram 2] 1 is a diagram illustrating an outline of a functional configuration of an information processing device according to an embodiment. [Diagram 3] FIG. 13 is a diagram showing an example of a device management screen output in the system according to the embodiment. [Figure 4] 11 is a flowchart showing an overview of the flow of an L2 switch detection process according to the embodiment. [Diagram 5] 10 is a flowchart showing an overview of the flow of a loop detection frame estimation process according to the embodiment. [Figure 6] 1 is a flowchart showing an overview of the flow of alive / dead monitoring processing according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of an information processing device, a method, and a program according to the present disclosure will be described with reference to the drawings. However, the embodiment described below is merely an example of an embodiment, and the information processing device, a method, and a program according to the present disclosure are not limited to the specific configuration described below. In carrying out the present disclosure, a specific configuration according to the embodiment may be appropriately adopted, and various improvements and modifications may be made.

[0012] In this embodiment, an information processing device, method, and program according to the present disclosure will be described as being implemented in a communication system in which a network monitoring device is installed. However, the information processing device, method, and program according to the present disclosure can be widely used in a technology for automatically detecting devices connected to a network, and the application of the present disclosure is not limited to the examples shown in the embodiment.

[0013] <System configuration> 1 is a schematic diagram showing the configuration of a system according to this embodiment. The system according to this embodiment includes one or more network monitoring devices 1 and one or more managed devices 9a and 9b that are connected to a network and capable of communicating with each other.

[0014] Conventionally, network monitoring devices transmit ARP (Address Resolution Protocol) requests or SNMP (Simple Network Management Protocol) packets to the segments and devices to be monitored, and identify the devices from the responses to those packets. Similarly, alive monitoring transmits ICMP (Internet Control Message Protocol) packets or SNMP packets, and monitors whether the devices are alive or dead based on the presence or absence of responses to those packets. However, with conventional network monitoring methods, it was difficult to detect and monitor whether devices without IP addresses (such as L2 switches) are alive or dead. Therefore, the only way to check the operating status of devices without IP addresses was to visually check the LEDs on the panel. Furthermore, L2 switches used as edge switches are often installed in places that cannot be seen, such as under floors or in the ceiling, so it may take a long time to identify a faulty L2 switch.

[0015] In view of the above situation, in this embodiment, a network monitoring device installed within a segment detects L2 switches from loop detection frames (hereinafter also referred to as "LDF") transmitted from the L2 switches, and performs alive monitoring by using the loop detection frames transmitted at intervals of several seconds as a heartbeat, thereby detecting and monitoring devices such as switches with loop detection functions.

[0016] The network monitoring device 1 is a computer including a central processing unit (CPU) 11, a read only memory (ROM) 12, a random access memory (RAM) 13, a storage device 14 such as an electrically erasable and programmable read only memory (EEPROM) or a hard disk drive (HDD), a communication unit 15 such as a network interface card (NIC), etc. However, the specific hardware configuration of the network monitoring device 1 can be omitted, replaced, or added as appropriate depending on the embodiment. In addition, the network monitoring device 1 is not limited to a device consisting of a single housing. The network monitoring device 1 may be realized by multiple devices using so-called cloud or distributed computing technology, etc.

[0017] The managed devices 9a and 9b are information devices used in offices, factories, etc., and include terminal devices 9a that perform IP communication and communication devices 9b that do not perform IP communication. The managed devices 9a are, for example, PCs (Personal Computers), scanners, printers, sensors, industrial machines, etc. Furthermore, the managed devices 9b are, for example, L2 switches.

[0018] 2 is a diagram showing an outline of the functional configuration of the system according to this embodiment. The network monitoring device 1 functions as an information processing device including a frame receiving unit 21, a device information acquiring unit 22, an upper layer processing unit 23, a detection information storing unit 24, a loop detection frame detecting unit 25, an estimation unit 26, a device information recording unit 27, a device status managing unit 28, and a display unit 29, by a program recorded in a storage device 14 being read into a RAM 13 and executed by a CPU 11, and each piece of hardware included in the network monitoring device 1 is controlled. Note that in this embodiment and other embodiments described later, each function included in the network monitoring device 1 is executed by the CPU 11, which is a general-purpose processor, but some or all of these functions may be executed by one or more dedicated processors.

[0019] The frame receiving unit 21 receives a frame (in this embodiment, an Ethernet frame) flowing through a network. An Ethernet frame includes a destination MAC address, a source MAC address, an Ether type / length, a data section, and an FCS (Frame Check Sequence). Note that the data section of an Ethernet frame may include vendor-specific information (for example, multiple source MAC addresses that transmit a loop detection frame).

[0020] The device information acquisition unit 22 analyzes IP packets flowing through the network to collect device information including IP addresses related to the managed devices 9a connected to the network. Specifically, the device information acquisition unit 22 acquires packets and frames flowing through the network to which the network monitoring device 1 is connected, automatically detects and identifies the managed devices 9a connected to the network from information (e.g., IP addresses and MAC addresses) included in the acquired packets, etc., and further acquires and collects device information related to the detected managed devices 9a. In this embodiment, the device information may include the device name, IP address, MAC address, vendor name, device type, operating system type, user (owner) name, user (owner) affiliation, usage date and time, and other information of the managed devices 9a.

[0021] The upper layer processing unit 23 performs communication analysis for network monitoring and security maintenance related to upper layers such as layer 3 and layer 7. The specific content of the communication analysis may be similar to a conventional or future network monitoring technology, and therefore a description thereof will be omitted.

[0022] The detection information storage unit 24 stores loop detection frame detection information (hereinafter, "LDF detection information") used to detect a loop detection frame. In this embodiment, the LDF detection information to be compared with the received frame includes predefined known LDF detection information and learned LDF detection information. The predefined known LDF detection information is LDF detection information that is previously set in the network monitoring device 1 by a method such as being incorporated in advance in the network monitoring device 1 or being notified from a server or the like via a network. The known LDF detection information includes a vendor-specific Ether type whose use is not generally disclosed but which has already been defined in the network monitoring device 1 as being used for a loop detection frame. The learned LDF detection information is LDF detection information created based on a received frame that is estimated to be a loop detection frame by an estimation unit 26 described later.

[0023] The loop detection frame detection unit 25 detects a loop detection frame from a received frame received by the frame receiving unit 21. Specifically, for example, the loop detection frame detection unit 25 compares the received frame with the LDF detection information stored in the detection information storage unit 24, and detects the received frame as a loop detection frame if the received frame matches any of the LDF detection information.

[0024] Generally, the destination MAC address of a loop detection frame is a broadcast address, a multicast address, or the same address as the source MAC address. Also, the source MAC address of a loop detection frame is the MAC address of an L2 switch, and the L2 switch can be identified by referring to the source MAC address of the loop detection frame or the MAC address set in the data portion of the loop detection frame. For this reason, in this embodiment, the Ether type, the source MAC address, the destination MAC address, option information, and the like are used as the LDF detection information.

[0025] As an exception, there is a case where an ARP packet is used as the loop detection frame. In this embodiment, the following packet format is set as detection information for a loop detection frame using a packet whose Ether type is ARP. Hardware type: 0x0001 Protocol: 0x0800 HLEN: 0x06 PLEN: 0x04 Operation Code: 0x0001 Source MAC address: 00:00:00:00:00:00 Source IP address: 0.0.0.0 Destination MAC address: 00:00:00:00:00:00 Destination IP address: 0.0.0.0 Among these, when an ARP packet is used as a loop detection frame, the ARP packet is characterized in that the source MAC address field, the source IP address field, the destination MAC address field, and the destination IP address field are all left unset.

[0026] The estimation unit 26 estimates whether or not a received frame that has not been detected as a loop detection frame by the loop detection frame detection unit 25 among the received frames is a loop detection frame that does not match known LDF detection information (in other words, an unknown loop detection frame). For example, the estimation unit 26 estimates that a received frame is a loop detection frame when the received frame has a predetermined Ether type and a predetermined type of MAC address and is periodically sent from the same sender. Here, the predetermined Ether type is, for example, a vendor-specific Ether type that is registered in the IEEE but is unknown as to whether it is for LDF use (however, excluding a vendor-specific Ether type whose use is not generally disclosed but has already been defined or learned in the network monitoring device 1 as being for loop detection frame use), or an Ether type that is not registered in the IEEE. In addition, the predetermined type of MAC address is, for example, a broadcast address or a multicast address. In addition, the estimation unit 26 determines that a received frame is periodically sent when the received frame is repeatedly sent within a predetermined time and has been sent a predetermined number of times or more.

[0027] The device information recording unit 27 records the device information of the managed device 9b, including the source information of the detected loop detection frame, and the device information of the managed device 9a, including the IP address acquired by the device information acquisition unit 22, in the device management ledger as device information of the managed devices 9a, 9b connected to the network.

[0028] Furthermore, in the network monitoring device 1 according to this embodiment, the user can add information to the automatically acquired device information via a management screen provided by the Web server of the network monitoring device 1. The device information recording unit 27 records device information manually input by the user in addition to the automatically acquired information. Below, examples of the types of device information recorded by the device information recording unit 27 according to this embodiment and the setting method for each piece of information are shown. Device Name: User Input Device type: Automatic configuration (based on MAC address and OID information) / User input MAC address: Obtain automatically IP address: Obtain automatically / Enter by user Operation status: Automatically acquired (when device monitoring is enabled) Device monitoring enable / disable: User input Location: User Input Device Image: User Input Detection Date and Time: Automatic setting Last seen: Automatically set No communication timeout date and time: Internal information This enables the device information recording unit 27 to record device information that the network monitoring device 1 cannot automatically obtain.

[0029] The installation location of the device information is information indicating the location where the managed devices 9a, 9b are installed, which is acquired by inputting by the user on a management screen provided by the Web server of the network monitoring device 1, and can be recorded as text (for example, "under the floor of the first island"), but the installation location recorded in this embodiment may include location information associated with a map image. A user can upload a map image file indicating the floor plan and layout of an office to the network monitoring device 1 via the Web server of the network monitoring device 1, drag the device name from the device name list to place the device icon 8 on the map image, and move the device icon 8 on the map image to specify the location of the device on the map image. The device information recording unit 27 generates location information indicating the location in the map image where the device icon 8 is placed by the user's operation, and records the location information as the installation location of the device.

[0030] When the non-reception state of a frame or packet having a recorded source address reaches a predetermined criterion, the device status management unit 28 determines that the communication device 9b related to the source information has stopped or has been disconnected from the network. Note that the frame for determining the non-reception state does not have to be limited to the loop detection frame.

[0031] The display unit 29 displays an image showing the managed device 9a and an image showing the managed device 9b related to the source information of the loop detection frame, both recorded by the device information recording unit 27, at positions corresponding to the position information in one map for visualizing the network configuration. That is, according to the system according to this embodiment, the user can check the installation locations of devices that use IP communication and devices that do not perform IP communication (such as L2 switches) on one map.

[0032] 3 is a diagram showing an example of a device management screen output in the system according to this embodiment. The network monitoring device 1 includes a Web server, and receives a request for a device management screen from a Web browser of a user terminal (which may be any of the devices 9a to be managed, or may be other devices not shown). When a request for a device management screen is received, the display unit 29 references device information in the device management ledger, and generates a device management screen by superimposing an image showing device information, installation location, and operating status of the detected and monitored devices on a map image, and the Web server outputs the generated device management screen to the Web browser from which the access originates.

[0033] More specifically, the display unit 29 displays the installation locations of the managed devices 9a, 9b including the L2 switch 9b using a map image and device icons 8 arranged on the map image according to location information, and displays device information when a device icon 8 is selected. When an icon 8 is selected by a user operation, device information including the device name, device type, MAC address, operating status, device monitoring enabled / disabled, installation location, device image, etc. is displayed. Here, the operating status of the device may be visually represented by the color of the device icon 8 (for example, green when operating, red when stopped) or by blinking.

[0034] <Processing flow> Next, a flow of processing executed by the system according to the present embodiment will be described. Note that the specific contents and processing order of the processing described below are an example for implementing the present disclosure. The specific contents and processing order may be appropriately selected according to the embodiment of the present disclosure.

[0035] 4 is a flowchart showing an outline of the flow of an L2 switch detection process according to this embodiment. The process shown in this flowchart is executed when the network monitoring device 1 receives a frame.

[0036] In steps S101 and S102, a loop detection frame is detected based on the LDF detection information. The frame receiving unit 21 receives an Ethernet frame (step S101), and the loop detection frame detecting unit 25 detects a loop detection frame by comparing the received frame with the LDF detection information stored in the detection information storing unit 24 (step S102). As described above, in this embodiment, the LDF detection information compared with the received frame includes predefined known LDF detection information and learned LDF detection information. If the received frame matches the known LDF detection information or the learned LDF detection information (YES in step S102), the process proceeds to step S103. On the other hand, if the received frame does not match either the known LDF detection information or the learned LDF detection information (NO in step S102), the process proceeds to step S106.

[0037] In steps S103 to S105, the device information corresponding to the detected loop detection frame is updated. If the received frame matches known LDF detection information or learned LDF detection information, that is, if the received frame is determined to be a loop detection frame, the device information recording unit 27 checks whether the source device of the loop detection frame has been registered in the device management ledger by searching the device management ledger using the source MAC address field or the MAC address set in the data section of the detected loop detection frame (step S103).

[0038] If the confirmation result shows that the corresponding device information does not exist in the device management ledger (NO in step S103), the device information recording unit 27 adds the device information of the source device of the loop detection frame to the device management ledger (step S104). At this time, the device information recording unit 27 sets the last detection date and time and the no-communication timeout date and time in the device information of the source device of the loop detection frame, and sets the operation status to in operation. After that, the process shown in this flowchart ends. Here, the no-communication timeout date and time is calculated by adding a predetermined time to the last detection date and time. On the other hand, if the confirmation result shows that the corresponding device information exists in the device management ledger (YES in step S103), the device information recording unit 27 resets the last detection date and time and the no-communication timeout date and time in the device information of the source device of the loop detection frame, and sets the operation status to in operation (step S105). After that, the process proceeds to step S106.

[0039] In steps S106 to S109, estimation and learning are performed for an unknown loop detection frame. The estimation unit 26 executes a loop detection frame estimation process for estimating whether or not a received frame determined in step S102 to not match either the known LDF detection information or the learned LDF detection information is an unknown loop detection frame (step S106). A specific flow of the loop detection frame estimation process will be described later with reference to FIG. 5.

[0040] In the loop detection frame estimation process, when the currently-learned LDF detection information related to the received frame becomes learned LDF detection information (YES in step S107), the received frame is treated as a loop detection frame, and the detection information storage unit 24 stores the newly obtained learned LDF detection information (step S108). The learned LDF detection information stored here is compared with the received frame in step S102 of the subsequent L2 switch detection process. In other cases (NO in step S107), the received frame is treated as an Ethernet frame other than a loop detection frame, and is sent to the analysis process of other protocols by the upper layer processing unit 23 (which performs, for example, L3 analysis or L7 analysis) included in the network monitoring device 1 (step S109). After that, the process shown in this flowchart ends.

[0041] 5 is a flowchart showing an outline of the flow of the loop detection frame estimation process according to the present embodiment. The process shown in this flowchart corresponds to step S106 of the L2 switch detection process described with reference to FIG.

[0042] In step S201, the received frame is compared with a predetermined frame format. The estimation unit 26 determines whether the received Ethernet frame corresponds to a predetermined frame format for determining the possibility that the frame is an unknown loop detection frame. Specifically, the estimation unit 26 determines that the received Ethernet frame corresponds to the predetermined frame format when the following conditions are met: (1) The destination MAC address is a multicast address or a broadcast address. (2) A vendor-specific Ether type that is registered with the IEEE but whose LDF use is unknown (excluding vendor-specific Ether types whose use has not been publicly disclosed but whose use has already been defined or learned in the network monitoring device 1 as being for LDF use), or an Ether type that is not registered with the IEEE. If it is determined that the received frame does not conform to the predetermined frame format (NO in step S201), the process shown in this flowchart ends. On the other hand, if it is determined that the received frame conforms to the predetermined frame format (YES in step S201), the process proceeds to step S202.

[0043] In steps S202 and S203, new LDF detection information corresponding to the received frame is recorded in the learning table. The estimation unit 26 checks whether or not LDF detection information corresponding to the received frame exists in the learning table by searching a learning table for holding LDF detection information being learned (step S202). If the LDF detection information corresponding to the received frame does not exist in the learning table (NO in step S202), the estimation unit 26 creates new LDF detection information for the received frame, records it in the learning table as LDF detection information being learned (step S203), and ends the process. On the other hand, if the LDF detection information corresponding to the received frame exists in the learning table (YES in step S202), the process proceeds to step S204.

[0044] In steps S204 to S208, it is determined whether a frame (Ethernet frame with the same source MAC address) corresponding to the LDF detection information being learned is periodically received. The estimation unit 26 checks whether the difference between the reception date and time of the received frame (which may be the current date and time) and the last detection date and time of the LDF detection information corresponding to the received frame is within a predetermined time (for example, within 10 seconds), in other words, whether a frame matching the LDF detection information being learned corresponding to the received frame is received within a predetermined time (step S204). If the difference between the reception date and time of the received frame and the last detection date and time of the corresponding LDF detection information is not within the predetermined time (NO in step S204), the estimation unit 26 deletes the corresponding LDF detection information being learned from the learning table (step S205) and ends the process.

[0045] On the other hand, if the difference between the reception date and time of the received frame and the last detection date and time of the corresponding LDF detection information is within a predetermined time (YES in step S204), the estimation unit 26 judges whether the number of detections of the frame related to the corresponding currently-learning LDF detection information is a predetermined number or more (e.g., 10 times) (step S206). If the number of detections of the frame related to the corresponding currently-learning LDF detection information is less than the predetermined number, the estimation unit 26 adds 1 to the number of detections (step S207) and ends the process. On the other hand, if the number of detections of the frame related to the corresponding currently-learning LDF detection information is the predetermined number or more, the estimation unit 26 changes the corresponding currently-learning LDF detection information to learned LDF detection information (step S208). Thereafter, the process shown in this flowchart ends.

[0046] According to the system shown in this embodiment, by executing the L2 switch detection process and loop detection frame estimation process described above, it is possible to identify the switch 9b based on the source MAC address of the loop detection frame sent by the switch 9b with loop detection function and the MAC address set in the data portion of the loop detection frame.

[0047] 6 is a flowchart showing an outline of the flow of alive monitoring processing according to this embodiment. The processing shown in this flowchart is periodically and repeatedly executed for the managed devices 9a, 9b registered in the device management ledger. For example, the processing shown in this flowchart may be repeatedly executed in order from the managed devices 9a, 9b registered at the top of the device management ledger to the managed devices 9a, 9b registered at the bottom.

[0048] The device status management unit 28 reads out the device information pointed to as a monitoring target from the device management ledger, and checks whether device monitoring is enabled for the device (step S301). If device monitoring is not enabled (NO in step S301), the process shown in this flowchart ends. On the other hand, if device monitoring is enabled (YES in step S301), the device status management unit 28 checks whether the no-communication timeout date and time of the device information related to the device has already passed (step S302).

[0049] If the check shows that the no-communication timeout date and time has already passed, the device status management unit 28 sets the operation status of the target device information to stopped (step S303). If the device whose operation status has been set to stopped is the L2 switch 9b, the stop of the L2 switch 9b will also cut off communication with the other managed devices 9a and 9b connected to the L2 switch 9b, so the operation status of these managed devices 9a and 9b may also be set to stopped. On the other hand, if the no-communication timeout date and time has not been reached, the device status management unit 28 sets the operation status of the device information to operating (step S304). After that, the process shown in this flowchart ends.

[0050] The loop detection frames transmitted by the switch 9b with the loop detection function are transmitted continuously at intervals of several seconds. Therefore, according to the system shown in the present embodiment, by executing the alive monitoring process described above, it becomes possible to detect the stop of the L2 switch 9b at the point when the transmission of the loop detection frames stops.

[0051] <Variations> In the embodiment described above, the network monitoring device 1 is equipped with a device information acquisition unit 22 and an upper layer processing unit 23, and is therefore capable of managing managed devices 9a other than the L2 switch 9b. However, if managed devices 9a other than the L2 switch 9b are not to be managed, the device information acquisition unit 22 and the upper layer processing unit 23 may be omitted.

[0052] In addition, in the embodiment described above, an L2 switch was used as an example of the managed device 9b, but devices other than an L2 switch can also be detected as the managed device 9b as long as they send out frames for loop detection.

[0053] Furthermore, in the above-described embodiment, Ethernet frames have been used as an example of frames flowing through a network, but the technology disclosed herein is broadly applicable to automatic detection of devices that communicate without using network layer addresses, and the lower layers are not limited to Ethernet. [Explanation of symbols]

[0054] 1. Network monitoring equipment

Claims

1. An information processing device connected to a network, A frame receiving means for receiving an Ethernet frame passing through the network; a loop detection frame detection means for comparing a received frame received by the frame receiving means with predefined known loop detection frame detection information, and detecting the received frame as a loop detection frame if the received frame matches the known loop detection frame detection information; an estimation means for estimating whether a received frame that has not been detected as a loop detection frame by the loop detection frame detection means among the received frames is a loop detection frame that does not match the known loop detection frame detection information, and estimating that the received frame is a loop detection frame if the received frame has a specified Ether type and a specified type of MAC address and is periodically transmitted from the same sender; a device information recording means for recording source information of the detected loop detection frame as device information of a communication device connected to the network; An information processing device comprising:

2. a detection information storage means for storing frame detection information created based on the received frame that is estimated by the estimation means to be a loop detection frame as learned loop detection frame detection information, The loop detection frame detection means further compares the received frame with the learned loop detection frame detection information, and detects the received frame as a loop detection frame if the received frame matches the learned loop detection frame detection information. The information processing device according to claim 1 .

3. the estimation means determines that the received frame is periodically transmitted when the received frame is repeatedly transmitted within a predetermined time period and transmitted a predetermined number of times or more; The information processing device according to claim 1 .

4. The method further includes a device information acquisition unit that acquires device information of a terminal that is connected to the network and performs IP communication by analyzing an IP packet that flows through the network, The device information recording means further records the acquired device information of the terminal. The information processing device according to claim 1 .

5. a display unit that displays an image of a communication device related to the source information of the loop detection frame and an image of a terminal related to the IP address, both of which are recorded by the device information recording unit, on a map for visualizing a configuration of the network. The information processing device according to claim 4.

6. The device information further includes location information indicating a location where the communication device or the terminal is installed, the display means displays an image representing the communication device and an image representing the terminal at a position on one of the maps corresponding to the position information; The information processing device according to claim 5 .

7. and a device status management means for determining, when a non-reception state of a frame having the source information reaches a predetermined standard, that a communication device related to the source information has stopped or has been disconnected from the network. The information processing device according to claim 1 .

8. A computer connected to a network a frame receiving step of receiving an Ethernet frame flowing through the network; a loop detection frame detection step of comparing the received frame received in the frame reception step with predefined known loop detection frame detection information, and detecting the received frame as a loop detection frame if the received frame matches the predefined known loop detection frame detection information; an estimation step of estimating whether or not a received frame that was not detected as a loop detection frame in the loop detection frame detection step among the received frames is a loop detection frame that does not match the known loop detection frame detection information, in which the received frame is estimated to be a loop detection frame if it has a predetermined Ether type and a predetermined type of MAC address and is periodically transmitted from the same sender; a device information recording step of recording source information of the detected loop detection frame as device information of a communication device connected to the network; How to do it.

9. Computers connected to a network A frame receiving means for receiving an Ethernet frame passing through the network; a loop detection frame detection means for comparing a received frame received by the frame receiving means with predefined known loop detection frame detection information, and detecting the received frame as a loop detection frame if the received frame matches the known loop detection frame detection information; an estimation means for estimating whether a received frame that has not been detected as a loop detection frame by the loop detection frame detection means among the received frames is a loop detection frame that does not match the known loop detection frame detection information, and estimating that the received frame is a loop detection frame if the received frame has a specified Ether type and a specified type of MAC address and is periodically transmitted from the same sender; a device information recording means for recording source information of the detected loop detection frame as device information of a communication device connected to the network; A program that functions as a

Images