Packet capture device and packet capture method

Abstract

This packet capture device (10) comprises: a packet analysis unit (11) that analyzes an input packet; a flow identification unit (12) that identifies a flow to be captured; an output adjustment unit (14) that adjusts the packet quantity of the flow to be captured which is output to a storage unit (16); a buffer unit that temporarily accumulates packets of the flow to be captured; and the storage unit (16) that stores the packets of the flow to be captured. The output adjustment unit (14) determines, on the basis of a measurement result of the quantity of a packet to be captured in a prescribed measurement interval, whether to output packets of the flow to be captured to the storage unit (16), for each prescribed measurement interval, and destroys the packets that are not output to the storage unit (16). This invention makes it possible to prevent consecutive capture data loss due to consecutive discards of input packets, while avoiding an increase in circuit scale.

Description

[Technical field]

[0001] The present invention relates to a packet capture technique for capturing packets in a network. [Background technology]

[0002] With the advancement of virtualization technology in NFV (Network Functions Virtualization) / SDN (Software Defined Networking), various services using VMs (Virtual Machines) are being provided, and networks are becoming larger and more complex. A packet capture device that can selectively capture packets of a specific flow (a collection of packets with the same rules that combine source / destination MAC addresses, IP addresses, etc.) is one of the essential devices for analyzing failures in the above-mentioned networks.

[0003] A configuration diagram of a conventional packet capture device (Patent Document 1) is shown in Fig. 11. The conventional packet capture device has a packet analysis unit 11 that analyzes the header of an input packet, and a flow identification unit 12 that identifies flows registered in a rule table. A filter unit 13 discards flow packets that were not matched by the flow identification unit 12, and outputs matched flows to a capture file generation unit, where multiple packets are buffered to be grouped together, then converted into a capture file and stored in a storage unit 16. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4955722 Summary of the Invention [Problem to be solved by the invention]

[0005] In the configuration of the conventional device, when the packet input rate exceeds the capture rate (the processing speed for creating a capture file and writing to a storage medium), the writing process of the capture file to the storage unit 16 cannot keep up, and a buffer overflow occurs. The buffer overflow causes a long period of continuous discarding of input packets, which may result in the loss of all capture data for the time period required for analysis.

[0006] One way to avoid continuous discards is to prepare a sufficient buffer, but the amount of buffer required to bridge the difference between the input rate and the internal processing speed in a high-speed network would be enormous, which would result in a large circuit scale.

[0007] The present invention has been made to solve the above-mentioned problems, and aims to provide a packet capture device that can prevent the loss of captured data due to continuous discarding of input packets while avoiding an increase in circuit size. [Means for solving the problem]

[0008] In order to solve the above problem, a packet capture device that captures packets flowing through a network to be captured includes a packet analysis unit that analyzes input packets, a flow identification unit that identifies the flow to be captured, an output adjustment unit that adjusts the amount of packets of the flow to be captured to be output to a memory unit, a buffer unit that temporarily accumulates the packets of the flow to be captured, and a memory unit that stores the packets of the flow to be captured, and the output adjustment unit is configured to determine whether to output packets of the flow to be captured to the memory unit at each specified measurement interval based on a measurement result of the amount of packets to be captured at the specified measurement interval, and to discard packets that are not output to the memory unit.

[0009] In order to solve the above problems, the packet capture method of the present invention is a packet capture method in a packet capture device that captures packets flowing through a network to be captured, and includes the steps of analyzing input packets, identifying the flow to be captured, adjusting the amount of packets of the flow to be captured to be stored, temporarily accumulating the packets of the flow to be captured, and storing the packets of the flow to be captured, and the step of adjusting the amount of packets determines whether to store packets of the flow to be captured at each specified measurement interval based on a measurement result of the amount of packets to be captured at the specified measurement interval, and discards packets that are not to be stored. Effect of the Invention

[0010] According to the present invention, it is possible to provide a packet capture device that can prevent loss of captured data due to continuous discarding of input packets while avoiding an increase in circuit scale. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a packet capture device according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram for explaining the operation of the output adjustment unit according to the first embodiment of the present invention. [Diagram 3] FIG. 3 is a diagram illustrating an example of a configuration of an output adjustment unit according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a flowchart showing the operation procedure of the packet capture method according to the first embodiment of the present invention. [Diagram 5] FIG. 5 is a diagram showing an example of a configuration of an output adjustment unit according to the second embodiment of the present invention. [Figure 6] FIG. 6 is a flowchart showing an operation procedure in the packet capture device according to the second embodiment of the present invention. [Figure 7]FIG. 7 is a diagram illustrating an example of a configuration of a packet capture device according to the third embodiment of the present invention. [Figure 8] FIG. 8 is a flowchart showing an example of an operation procedure in the threshold value determining unit according to the third embodiment of the present invention. [Figure 9] FIG. 9 is a flowchart showing another example of the operation procedure in the threshold value determining unit according to the third embodiment of the present invention. [Figure 10] FIG. 10 shows an example of the configuration of a computer for implementing a packet capture device according to this embodiment. [Figure 11] FIG. 11 is a diagram showing the configuration of a conventional packet capture device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings. The present invention is not limited to the following embodiments.

[0013] <First embodiment> A first embodiment of the present invention will be described. Fig. 1 is a diagram showing a configuration example of a packet capture device according to the first embodiment of the present invention. Fig. 2 is a diagram for explaining the operation of an output adjustment unit according to the first embodiment of the present invention.

[0014] <Configuration of packet capture device> The packet capture device 10 is a device that captures packets flowing through a capture target network 200. The packet capture device 10 includes a packet analysis unit 11 that analyzes input packets, a flow identification unit 12 that identifies a flow to be captured, a filter unit 13 that filters packets of the flow to be captured based on the identification result of the flow identification unit 12, an output adjustment unit 14 that adjusts the amount of packets of the flow to be captured to be output to a storage unit 16, a capture file generation unit 15 that has a buffer that temporarily accumulates packets to generate a capture file of the flow to be captured and generates the file, and a storage unit 16 that stores packets of the flow to be captured. The output adjustment unit 14 is disposed in front of the capture file generation unit 15 and is configured to determine whether to output packets of the flow to be captured to the storage unit 16 and discard packets that are not output to the storage unit 16. In the output adjustment unit 14, by discarding packets that have been thinned out at each measurement interval, it is possible to prevent the occurrence of long-term continuous discarding of input packets.

[0015] <Operation of output adjustment unit> 2 is a diagram for explaining the operation of the output adjustment unit according to the first embodiment of the present invention. The output adjustment unit is configured to determine whether or not to output packets of a flow to be captured to the storage unit 16 at each predetermined measurement interval based on a measurement result of the amount of packets to be captured at the predetermined measurement interval, and to discard packets that are not to be output to the storage unit 16.

[0016] In Fig. 2, the amount of packets to be captured is measured at a predetermined measurement interval, and if the measured amount of packets exceeds a predetermined judgment threshold, the packets to be captured that are input thereafter are discarded. When the measurement interval ends, the measured amount of packets is reset and measurement of the amount of packets is restarted. This operation is then repeated, and packets are discarded at the predetermined measurement interval.

[0017] This operation allows input packet discards to be thinned out at regular measurement intervals, making it possible to avoid long-term continuous packet discards while avoiding an increase in circuit scale without preparing a huge buffer capacity. In Fig. 2, the shorter the measurement interval, the higher the discard frequency becomes, and the smaller the amount of packets discarded in one measurement interval becomes. The user can set this measurement interval as appropriate according to system requirements such as the amount of packets to be captured and the amount of buffering.

[0018] <Output adjustment section configuration> Fig. 3 is a diagram showing a configuration example of an output adjustment unit according to a first embodiment of the present invention. In the configuration example of Fig. 3, the output adjustment unit 14 is composed of an accumulation counter unit 21 that accumulates and adds the byte (bit) length of an input packet for a measurement interval, and a discard determination unit 22 that compares the accumulated added value in the accumulation counter unit 21 with a determination threshold value to determine whether or not to discard the input packet. The discard determination unit 22 passes packets to be output to the storage unit 16 at each measurement interval as passing packets, and discards packets that are not to be output to the storage unit 16.

[0019] The counter of the cumulative counter unit 21 starts cumulative addition after the start of the measurement interval, and is reset after the measurement interval has elapsed, and this process is repeated. This makes it possible to determine packets to be output to the storage unit 16 at each measurement interval, and to discard packets that are not to be output to the storage unit 16. This measurement interval can be changed by the user, and can be set appropriately according to the system requirements.

[0020] When the capture rate that becomes a bottleneck is known in advance, the maximum count value can be set according to the capture rate that becomes a bottleneck by setting the value of the capture rate x the measurement interval as the judgment threshold in the discard judgment unit 22. The discard judgment unit 22 is configured to compare the calculated input packet rate with the judgment threshold, and discard the input packet when the cumulative counter value>the judgment threshold is established.

[0021] If the cumulative counter value>determination threshold is not satisfied, the input packet is output as a passing packet to capture file generation unit 15. Capture file generation unit 15 has a two-sided buffer with a passing packet writing surface and a writing surface to storage unit 16, and the two-sided buffer allows writing of the passing packet to the buffer and output from the buffer to storage unit 16 to be performed simultaneously.

[0022] <How the packet capture method works> The packet capture method of the present invention includes the steps of analyzing input packets, identifying a flow to be captured, temporarily accumulating packets of the flow to be captured, storing the packets of the flow to be captured in memory unit 16, and determining which packets to output to memory unit 16 at each predetermined measurement interval based on the measurement results of the amount of packets to be captured at the predetermined measurement interval, and discarding packets that are not output to memory unit 16.

[0023] 4 is a flowchart showing the operation procedure of the packet capture method according to the first embodiment of the present invention. When the packet capture device 10 receives a packet from the capture target network 200 (step S1-1), it buffers the received packet (step S1-2) and performs header analysis of the packet to extract header information (step S1-3).

[0024] Next, the header extracted by the header analysis is compared with the rules in the rule table 100 to identify whether or not the flow is a target for capture (step S1-4). If the flow does not match the rules (step S1-5: NO), the buffered packets are discarded (step S1-6).

[0025] If the flow matches the rule (step S1-5: YES), the packet length in the measurement interval is cumulatively added (step S1-7), and the cumulative packet length value is compared with the judgment threshold (step S1-8). If the cumulative value is greater than the judgment threshold (step S1-8: YES), the packet is discarded (step S1-6).

[0026] If the cumulative sum is equal to or less than the determination threshold value (step S1-8: NO), a capture file is generated (step S1-9), and the generated capture file is stored in the storage unit (step S1-10).

[0027] In this manner, in the first embodiment, an output adjustment unit 14 is provided which determines whether or not to output packets of a flow to be captured to the memory unit 16 at each predetermined measurement interval based on the measurement results of the amount of packets to be captured at the predetermined measurement interval, and discards packets that are not to be output to the memory unit 16. This makes it possible to discard input packets minutely at each measurement interval, and makes it possible to avoid long-term continuous discarding of input packets due to buffer overflow.

[0028] In the present embodiment, the case has been described where the cumulative sum of packet lengths is compared with the judgment threshold value to judge whether or not to output packets of a flow to be captured to the storage unit 16, but the amount of packets to be captured that serves as the criterion for judgment can also be obtained by other methods. For example, the output adjustment unit 14 may acquire the amount of packets accumulated in the buffer of the capture file generation unit 15 during a predetermined measurement interval, and judge whether or not to output packets to the storage unit 16 based on the amount of accumulation.

[0029] In this case, the discard judgment unit 22 is configured to output the input packet to be captured to the buffer unit when the amount of accumulation in the buffer of the capture file generation unit 15 is equal to or less than a predetermined judgment threshold, and to discard the input packet to be captured when the amount of accumulation in the buffer unit is greater than the predetermined judgment threshold.

[0030] Alternatively, the rate of the packets to be captured may be calculated using the cumulative sum of the packet length, which is the amount of packets to be captured, and the calculated rate may be compared with the capture rate of the capture file to determine whether or not to discard the packets. In this case, the write rate of the packets from the buffer unit to the storage unit 16 may be used as the determination threshold in the discard determination unit 22.

[0031] In this way, by using information on the amount of data stored in the buffer and the write rate of packets from the buffer to memory unit 16 to determine whether or not to discard packets, it is possible to avoid continuous discarding of input packets for long periods of time due to buffer overflow.

[0032] <Second embodiment> In the first embodiment, a configuration has been described in which the byte (bit) length of input packets is cumulatively added in a measurement interval, and input packets are discarded from when the cumulative added value exceeds a judgment threshold until the start of the next measurement interval, thereby making it possible to thin out the amount of discarded packets. In the second embodiment, a configuration example will be described in which discarded packet information is clarified by counting the types of discarded packets.

[0033] 5 is a diagram showing an example of the configuration of an output adjustment unit according to a second embodiment of the present invention. The difference from the output adjustment unit 14 of the first embodiment is that it includes a discard counter unit 33 that counts the number of discarded packets for each type. The discard counter unit 33 identifies packets discarded by the discard determination unit 22 for each flow, and counts the number of packets discarded for each packet flow. The flow is identified using the result of type determination by the flow identification unit 12. A counter that counts the number of discarded packets may be prepared for each flow type, or if the scale of the counter for each flow becomes large, a counter that counts multiple flows collectively may be prepared.

[0034] 6 is a flowchart showing the operation procedure of the packet capture device according to the second embodiment of the present invention. The process is similar to that of the flowchart in FIG. 4 except that a process for storing the number of discarded packets for each flow (step S2-8) is added.

[0035] In this way, according to the second embodiment, by outputting the number of discarded packets for each packet flow to the storage unit 16, it is possible to grasp the type of discarded flow and the number of discarded packets through the storage unit 16. With this configuration, even if the contents of the packets cannot be grasped as a capture file, it is possible to grasp the type and number of discarded packet flows, making it possible to provide data that is useful for analysis after packet capture.

[0036] <Third embodiment> In the first and second embodiments, the output adjustment unit 14 accumulates the byte (bit) length of input packets during a measurement interval, and discards input packets from when the accumulated value exceeds the judgment threshold until the start of the next measurement interval, thereby thinning out the amount of discarded packets. In the first and second embodiments, since it is not determined whether to discard based on the buffer accumulation amount of the capture file generation unit 15, when the capture rate is reduced due to processing other than the capture rate that becomes a bottleneck, if the judgment threshold for determining whether to discard is constant, a buffer overflow may occur. In the third embodiment, a configuration example will be described in which the judgment threshold is dynamically changed based on the buffer accumulation amount of the capture file generation unit 15.

[0037] 7 is a diagram showing an example of the configuration of a packet capture device according to a third embodiment of the present invention. Compared to the first and second embodiments, this embodiment differs in that a threshold determination unit 17 that dynamically determines a threshold based on the buffer accumulation amount of the capture file generation unit 15 is added.

[0038] In the threshold determination unit 17, since the number of packet processes that can be processed without causing buffer overflow can be grasped from the buffer accumulation amount, for example, when the buffer accumulation amount is large, it is an imminent situation just before buffer overflow. Therefore, by setting a small determination threshold value, packets are quickly discarded for thinning. On the other hand, when the buffer accumulation amount is relatively small, since there is a margin in the buffer amount, control is performed such that a determination threshold value with a relatively large value is determined according to the buffer accumulation amount.

[0039] <Control of Determination Threshold According to Buffer Accumulation Amount> The threshold determination unit 17 dynamically determines a threshold based on the buffer accumulation amount of the capture file generation unit 15. In the present embodiment, it has a plurality of accumulation amount thresholds for determining the magnitude of the packet accumulation amount and a plurality of predetermined determination threshold values, and determines the determination threshold value based on the comparison result between the packet accumulation amount and the plurality of accumulation amount thresholds. The change of the determination threshold value is executed for each measurement interval.

[0040] For example, divide the packet accumulation amount in the buffer into four levels, and define accumulation amount thresholds (AC_high, AC_mid, AC_low, AC_high>AC_mid>AC_low) as the three buffer accumulation amount thresholds that are the boundaries of each level, and determine the determination threshold values (TH_low, TH_mid, TH_high1, TH_high2, TH_low<TH_mid<TH_high1<TH_high2) corresponding to these accumulation amount thresholds. In the following description, the case where the packet accumulation amount in the buffer is divided into four levels will be described, but the number of accumulation amount thresholds and determination threshold values is not limited to this. The number of accumulation amount thresholds and determination threshold values can be appropriately determined by the user according to system requirements such as the amount of packets to be captured and the buffer amount.

[0041] If the accumulation amount threshold indicating a large amount of buffer accumulation is AC_high (first accumulation amount threshold), the accumulation amount threshold indicating a medium amount of buffer accumulation is AC_mid (second accumulation amount threshold), and the accumulation amount threshold indicating a small amount of buffer accumulation is AC_low (third accumulation amount threshold), when the buffer accumulation amount > AC_high, the buffer is on the verge of overflowing, so the judgment threshold is set to the lowest TH_low (first judgment threshold) and packets are promptly discarded.

[0042] Similarly, when AC_high≧buffer accumulation amount>AC_mid, the judgment threshold is set to TH_mid (second judgment threshold), when AC_mid≧buffer accumulation amount>AC_low, the judgment threshold is set to TH_high1 (third judgment threshold), and further, when AC_low≧buffer accumulation amount≧0, the judgment threshold is set to TH_high2 (fourth judgment threshold).

[0043] Fig. 8 is a flowchart showing an example of an operation procedure in the threshold determination unit according to the third embodiment of the present invention. Fig. 8 shows the operation procedure when the threshold is changed according to the measurement interval. When the measurement interval starts (step S3-1), the accumulation amount of the buffer is checked (step S3-2). If the accumulation amount of the buffer is greater than AC_high (step S3-3: YES), the judgment threshold is determined to be TH_low (step S3-4).

[0044] If the accumulation amount in the buffer is equal to or less than AC_high (step S3-3: NO), the accumulation amount in the buffer is compared with AC_mid (step S3-5), and if the accumulation amount in the buffer is greater than AC_mid (step S3-5: YES), the judgment threshold is determined to be TH_mid, which is greater than TH_low (step S3-6).

[0045] If the accumulation amount in the buffer is equal to or less than AC_mid (step S3-5: NO), the accumulation amount in the buffer is compared with AC_low (step S3-7), and if the accumulation amount in the buffer is greater than AC_low (step S3-7: YES), the judgment threshold is determined to be TH_high1, which is greater than TH_mid (step S3-8).

[0046] If the amount of accumulation in the buffer is equal to or less than AC_low (step S3-7: NO), the determination threshold is determined to be TH_high2, which is greater than TH_high1 (step S3-9).

[0047] Fig. 9 is a flowchart showing another example of the operation procedure in the threshold value determining unit according to the third embodiment of the present invention. In Fig. 8, the determination threshold value is changed according to the measurement interval, but in Fig. 9, the determination threshold value is changed at a timing independent of the measurement interval.

[0048] In Fig. 9, checking the buffer accumulation amount and changing the judgment threshold based on the buffer accumulation amount are repeated at a predetermined time interval. In Fig. 9, a timer at a predetermined time interval is reset (step S4-1), and checking the buffer accumulation amount and changing the judgment threshold based on the buffer accumulation amount are performed (steps S4-2 to S4-9). The process contents of steps S4-2 to S4-9 are similar to steps S3-2 to S3-9 in Fig. 8.

[0049] If a timeout occurs after changing the judgment threshold (step S4-10: YES), the timer is reset (step S4-1), and the buffer accumulation amount is checked again and the judgment threshold is changed based on the buffer accumulation amount (steps S4-2 to S4-9).If a timeout does not occur (step S4-10: NO), the process returns to checking the buffer accumulation amount (step S4-2), and the judgment threshold is changed based on the buffer accumulation amount.

[0050] 9 can be appropriately determined by the user depending on system requirements such as the amount of packets to be captured, the amount of buffering, etc. For example, it may be set to a time interval that ensures the processing time required to process steps S4-2 to S4-9 in FIG.

[0051] In this way, according to the third embodiment, by dynamically changing the judgment threshold for determining which packets to discard in the output adjustment unit depending on the amount of accumulated buffer, it is possible to avoid buffer overflow even in cases where the capture rate has decreased due to processing other than the bottleneck capture rate.

[0052] <Example of packet capture device configuration> The packet capture device 10 in this embodiment can be implemented in various forms. For example, the packet capture device 10 may be realized by hardware on a board on a server, or the functions of the packet capture device 10 may be realized by software running on a computer.

[0053] 8 shows an example of the configuration of a computer that operates as the packet capture device 10. Each part of the packet capture device 10 that constitutes the packet capture system of this embodiment can be realized by a computer equipped with a CPU (Central Processing Unit), a storage device, and an external interface (hereinafter, external I / F), and a program that controls these hardware resources.

[0054] The computer 300 includes a CPU 400, a storage device 600, and an external I / F 700, which are connected to each other via an I / O interface 500. A packet capture program for implementing the operation of the packet capture system of this embodiment and data such as a capture file are stored in the storage device 600, and another external computer 800 that transmits and receives signals and a computer that constitutes a network are connected to the external I / F 700. The CPU 400 can execute the packet capture process described in this embodiment according to the processing program stored in the storage device 600. This processing program can also be recorded on a computer-readable recording medium or provided via a network.

[0055] <Extended embodiment> Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration of the present invention within the scope of the present invention. [Explanation of symbols]

[0056] 10: packet capture device, 11: packet analysis section, 12: flow identification section, 13: filter section, 14: output adjustment section, 15: capture file generation section, 16: storage section, 100: rule table, 200: capture target network.

Claims

1. A packet capture device that captures packets flowing through a capture target network, comprising: a packet analysis unit that analyzes input packets, a flow identification unit that identifies a flow to be captured, an output adjustment unit that adjusts the amount of packets of the flow to be captured that are output to a storage unit, a buffer unit that temporarily accumulates packets of the flow to be captured, and a storage unit that stores packets of the flow to be captured; The output adjustment unit is a determination is made as to whether or not to output packets of a flow to be captured to the storage unit at each predetermined measurement interval based on a measurement result of an amount of packets to be captured at the predetermined measurement interval, and packets that are not to be output to the storage unit are discarded; The output adjustment unit is Based on a measurement result of the amount of packets to be captured during a predetermined measurement interval and a write rate of packets from the buffer unit to the storage unit, it is determined whether or not to output packets of the flow to be captured during each predetermined measurement interval to the storage unit. Packet capture device.

2. 2. The packet capture device according to claim 1, The output adjustment unit is configured to output information on the number of packets discarded for each packet flow to the storage unit. Packet capture device.

3. 3. The packet capture device according to claim 1, The output adjustment unit is a counter unit that accumulates packet lengths of packets of a flow to be captured that are input during the predetermined measurement interval; a discard determination unit that outputs the input packet to be captured to the buffer unit when an accumulated value in the counter unit is equal to or smaller than a predetermined determination threshold, and discards the input packet to be captured when the accumulated value is greater than the predetermined determination threshold; A packet capture device comprising:

4. 3. The packet capture device according to claim 1, The output adjustment unit is acquiring information on the amount of packets stored in the buffer unit during the predetermined measurement interval; a discard determination unit that outputs the input packet to be captured to the buffer unit when the accumulated amount of the packets is equal to or less than a predetermined determination threshold, and discards the input packet to be captured when the accumulated amount of the packets is greater than the predetermined determination threshold; A packet capture device comprising:

5. 5. A packet capture device according to claim 3, a threshold determination unit that determines the predetermined judgment threshold in accordance with an amount of packets stored in the buffer unit; The threshold determination unit has a plurality of accumulation amount thresholds for determining the magnitude of the accumulation amount of the packets and a plurality of the predetermined judgment thresholds, and is configured to determine the predetermined judgment thresholds based on a comparison result between the accumulation amount of the packets and the accumulation amount thresholds. Packet capture device.

6. 6. The packet capture device according to claim 5, The threshold determination unit: The determination threshold is set to a first determination threshold when the accumulation amount of the packets is greater than a first accumulation amount threshold, the determination threshold is set to a second determination threshold greater than the first determination threshold when the accumulation amount of the packets is equal to or less than the first accumulation amount threshold and greater than a second accumulation amount threshold smaller than the first accumulation amount threshold, the determination threshold is set to a third determination threshold greater than the second determination threshold when the accumulation amount of the packets is equal to or less than the second accumulation amount threshold and greater than a third accumulation amount threshold smaller than the second accumulation amount threshold, and the determination threshold is set to a fourth determination threshold greater than the third determination threshold when the accumulation amount of the packets is equal to or less than the third accumulation amount threshold. Packet capture device.

7. A packet capture method in a packet capture device that captures packets flowing through a capture target network, comprising: The packet capture device includes a packet analysis unit, a flow identification unit, an output adjustment unit, a buffer unit, and a storage unit. the packet analysis unit analyzing input packets, the flow identification unit identifying a flow to be captured, the output adjustment unit adjusting an amount of packets of the flow to be captured to be stored, the buffer unit temporarily storing packets of the flow to be captured, and the storage unit storing packets of the flow to be captured, The step of adjusting the amount of packets includes: determining whether to store packets of a flow to be captured at each predetermined measurement interval based on a measurement result of an amount of packets to be captured at the predetermined measurement interval, and discarding packets that are not to be stored; The step of adjusting the amount of packets includes: Based on a measurement result of the amount of packets to be captured during a predetermined measurement interval and a write rate of packets from the buffer unit to the storage unit, it is determined whether or not to store packets of the flow to be captured at each predetermined measurement interval. Packet capture method.

Images