Communication device and method for controlling the communication device

Abstract

To ensure that only the terminal information of a terminal directly connected to a communication device is outputted, even when a plurality of communication devices are arranged in a network whose network configuration is unknown.SOLUTION: A communication device comprises: a port information storage processing unit that stores terminal information of a terminal as a frame sender, in a terminal information storage unit, determines a port having received spontaneous frames transmitted spontaneously from other communication devices to be an exception port and stores exception port information in an exception port storage unit, refers to a correspondence table that holds identification information for identifying terminals connected to ports in association with the identification information of the port, and stores the identification information of the ports to which the terminals are connected, in association with the terminal information held in the terminal information storage unit; and a terminal information output processing unit that outputs terminal information, except terminal information that corresponds to the exception port, from among the terminal information pieces held in the terminal information storage unit, on the basis of a request for output of terminal information.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to a communication device and a method for controlling the communication device.

Background Art

[0002] In recent years, various terminals are connected to a network. To prevent unauthorized connections of terminals to the network or infection by malware from terminals using a vulnerable OS (Operating System), it is important for security to visualize what kind of terminals are connected to the network.

[0003] For example, in network devices such as L2 switches, there is a known method of outputting terminal information such as the port number to which a terminal is connected and the OS, MAC (Media Access Control) address, and IP (Internet Protocol) address used by the terminal. Thereby, the terminal information of the terminals connected to the network device is visualized (see, for example, Patent Document 1).

[0004] Also, there is a known method of connecting from an investigation terminal to a switch that holds a MAC address learning table, removing all pairs including the port corresponding to the MAC address of the investigation terminal from the MAC address learning table, and identifying the port to which the terminal is connected (see, for example, Patent Document 2).

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] For example, network devices collect terminal information by monitoring frames broadcast by other network devices. However, when multiple network devices are connected on the same network, terminal information is collected not only from terminals directly connected to a port, but also from terminals connected via other network devices. As a result, it becomes difficult to identify the network device to which a vulnerable terminal is directly connected. Consequently, if the network configuration is unknown, it becomes difficult to isolate vulnerable terminals from the network.

[0007] In one aspect, the present invention aims to output only terminal information of terminals directly connected to communication devices, even when multiple communication devices are arranged on a network whose network configuration is unknown. [Means for solving the problem]

[0008] From one perspective, a communication device is a communication device that has a plurality of ports to which terminals or other communication devices can be connected, and transmits and receives frames, and stores terminal information of the terminal that sent a frame received at a port in a terminal information storage unit, and determines that the port that received the spontaneous frame is an excluded port if the received frame is a spontaneous frame spontaneously transmitted from the other communication device, an excluded port storage unit that stores excluded port information that identifies the excluded port determined by the frame monitoring processing unit, and a port information storage processing unit that refers to a correspondence table that holds identification information of terminals connected to the port in association with the identification information of the port, and stores the identification information of the port to which the terminal is connected in association with the terminal information stored in the terminal information storage unit, From the management terminal used for managing the network including the aforementioned communication device Based on the terminal information output request, the terminal information stored in the terminal information storage unit is processed, excluding the terminal information corresponding to the port identification information stored in the excluded port storage unit. Towards the aforementioned management terminal It includes a terminal information output processing unit that outputs terminal information. [Effects of the Invention]

[0009] Even when multiple communication devices are deployed on a network with an unknown network configuration, it is possible to output only the terminal information of the terminal directly connected to the communication device. [Brief explanation of the drawing]

[0010] [Figure 1] This figure shows an example of a network configuration including a communication device in one embodiment. [Figure 2] Figure 1 is a block diagram showing an example of the hardware configuration of an L2 switch. [Figure 3] Figure 1 is a block diagram showing an example of the functional configuration of an L2 switch. [Figure 4] Figure 3 is a block diagram showing an example of the MAC address table, terminal information storage unit, and excluded port storage unit. [Figure 5] Figure 1 is an explanatory diagram showing an example of excluded ports on an L2 switch located in the subnetwork SNET1. [Figure 6] Figure 3 shows an example of the contents stored in the terminal information storage unit, which is generated by the frame monitoring processing unit and port information storage processing unit. [Figure 7] Figure 3 is a flowchart showing an example of the operation of the frame monitoring processing unit. [Figure 8] Figure 3 is a flowchart showing an example of the operation of the port information storage processing unit. [Figure 9] Figure 3 is a flowchart showing an example of the operation of the terminal information output processing unit. [Figure 10] Figure 3 shows an example of a list of terminal information included in the file output by the terminal information output processing unit. [Figure 11] This block diagram shows an example of the functional configuration of an L2 switch in another embodiment. [Figure 12] Figure 11 is a block diagram showing an example of the MAC address table, terminal information storage unit, excluded port storage unit, and specific MAC address storage unit. [Modes for carrying out the invention]

[0011] Hereinafter, embodiments will be described with reference to the drawings.

[0012] FIG. 1 shows an example of the configuration of a network including a communication device in one embodiment. The network 100 shown in FIG. 1 includes a plurality of L2 (Layer 2) switches 10 (10A, 10B, 10C, 10D), a router 20, and a terminal 30 for a network administrator. Each L2 switch 10 has a plurality of ports that can connect a terminal TM such as an Ethernet port or another L2 switch 10 or the like. The number of ports is not limited to four. Hereinafter, each port is identified by four identification numbers 1-4. The L2 switch 10 is an example of a communication device.

[0013] The L2 switches 10C and 10D are connected to the router 20, and the L2 switches 10A and 10B are connected to the L2 switch 10C. Then, a subnetwork SNET1 is constructed by the L2 switches 10A, 10B, 10C and the terminals TM (TM-A, TM-B, TM-C, TM-D, TM-E, TM-F) connected to the L2 switches 10A and 10B. A subnetwork SNET2 is constructed by the L2 switch 10D and the terminal 30.

[0014] For example, ports 1, 2, and 3 of the L2 switch 10A are respectively connected to the terminals TM-A, TM-B, and TM-C. Port 4 of the L2 switch 10A is connected to port 1 of the L2 switch 10C. Ports 1, 2, and 3 of the L2 switch 10B are respectively connected to the terminals TM-D, TM-E, and TM-F. Port 4 of the L2 switch 10A is connected to port 2 of the L2 switch 10C. Port 4 of the L2 switch 10C is connected to the router 20. Two ports (not shown) of the L2 switch 10D are respectively connected to the router 20 and the terminal 30 for a network administrator.

[0015] FIG. 2 shows an example of the hardware configuration of the L2 switch 10 shown in FIG. 1. The L2 switch 10 has a CPU 11, a memory 12, a non-volatile memory 13, a switch device 14, ports 1-4, and a console port. The CPU 11 is connected to the memory 12, the non-volatile memory 13, the switch device 14, and the console port.

[0016] The CPU 11 functions as a control unit that controls the entire L2 switch 10. For example, the CPU 11 sets the transfer function of the switch device 14 and controls the transmission and reception of relay frames and spontaneous frames from other L2 switches 10 or routers 20. For example, a relay frame is a frame whose source is the terminal TM and is relayed by the L2 switch 10 or the router 20.

[0017] A spontaneous frame is a frame whose source is spontaneously transmitted by a network device such as the L2 switch 10 or the router 20 and is a frame other than a relay frame. Spontaneous frames are transmitted and received between network devices. For example, a BPDU (Bridge Protocol Data Unit) frame used in the STP protocol for loop avoidance control is one of the spontaneous frames of network devices and is transmitted and received between network devices.

[0018] The BPDU frame is an example of a spanning tree frame that the L2 switch 10 periodically broadcasts to prevent the network from becoming a loop path. Also, the BPDU frame is an example of a first frame that is transmitted from the L2 switch 10 but not from the terminal TM.

[0019] Memory 12 is, for example, volatile memory such as RAM (Random Access Memory). Memory 12 holds, for example, control programs executed by the CPU 11, and various setting data and information such as tables. Non-volatile memory 13 is, for example, flash memory, and holds control programs executed by the CPU 11 and various initial values. The control programs held in non-volatile memory 13 are loaded into memory 12 and then executed by the CPU 11. The CPU 11 that executes the control programs uses memory 12 or non-volatile memory 13 as a workspace.

[0020] The switch device 14 is mounted on, for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The switch device 14 controls the relaying of frames transmitted and received between ports of other L2 switches 10, etc., via Ethernet.

[0021] The console port is connected to a console terminal such as a PC (Personal Computer). The CPU 11 can perform configuration operations and input / output various information such as terminal information based on commands entered from the console terminal via the console port. Configuration operations and input / output of various information such as terminal information may also be performed by connecting remotely via the Ethernet port using protocols such as SSH (Secure Shell) or Telnet (Teletype network).

[0022] Figure 3 shows an example of the functional configuration of the L2 switch 10 shown in Figure 1. The L2 switch 10 has a memory unit 15 and a processing unit 16 as its functional configuration. The processing unit 16 functions as software that performs visualization processing to visualize information of terminals TM connected to the L2 switch 10. The memory unit 15 stores the information used for the visualization processing performed by the processing unit 16. The memory unit 15 is allocated to a data area (not shown) in the memory 12 of Figure 2. The processing unit 16 is allocated to a program area (not shown) in the memory 12 of Figure 2.

[0023] The storage unit 15 includes a MAC address table 121, a terminal information storage unit 122, and an excluded port storage unit 123. The MAC address table 121 stores the MAC addresses of terminals TM directly or indirectly connected to any of the ports, associated with the port numbers. The MAC address table 121 is an example of a correspondence table that stores identification information for terminals TM connected to a port, associated with the identification information of the port.

[0024] The terminal information storage unit 122 stores the MAC address, IP address, and terminal information of the terminal TM, associated with the port number. For example, the terminal information includes one or more of the following: the type of OS installed on the terminal TM, the OS version information, and the hostname.

[0025] The excluded port storage unit 123 stores excluded port numbers, which are port numbers that are excluded from the output of the terminal information list when the L2 switch 10 outputs a terminal information list. The excluded port number is an example of excluded port information that identifies excluded ports. An example of the MAC address table 121, terminal information storage unit 122, and excluded port storage unit 123 is shown in Figure 4.

[0026] The processing unit 16 includes a frame monitoring processing unit 111, a port information storage processing unit 112, and a terminal information output processing unit 113, which are realized by the execution of a terminal information output program by the CPU 11 and perform visualization processing of terminal information. The processing unit 16 also includes a frame transmission / reception processing unit 114, which are realized by the execution of a frame processing program by the CPU 11, and a command input / output processing unit 115, which are realized by the execution of a command processing program.

[0027] One or more of the frame monitoring processing unit 111, port information storage processing unit 112, terminal information output processing unit 113, frame transmission / reception processing unit 114, and command input / output processing unit 115 may be implemented by hardware.

[0028] The frame monitoring processing unit 111 performs a determination process to determine whether a frame received by the frame transmission / reception processing unit 114 is a frame to be analyzed, or whether it is a spontaneous frame transmitted by a network device. Furthermore, if the received frame is a spontaneous frame transmitted from another L2 switch 10, the frame monitoring processing unit 111 determines the port that received the spontaneous frame as an excluded port and stores the port number of the determined excluded port in the excluded port storage unit 123. An example of the operation of the frame monitoring processing unit 111 is shown in Figure 7.

[0029] The port information storage processing unit 112 periodically refers to the MAC address table 121 and stores the port numbers held in the MAC address table 121 in association with the terminal information held in the terminal information storage unit 122. An example of the operation of the port information storage processing unit 112 is shown in Figure 8.

[0030] The terminal information output processing unit 113 generates terminal information by referring to the terminal information storage unit 122 and the excluded port storage unit 123 in response to a terminal information output request received via the command input / output processing unit 115. For example, the terminal information output processing unit 113 generates terminal information from the terminal information stored in the terminal information storage unit 122, excluding terminal information corresponding to port numbers stored in the excluded port storage unit 123. Then, the terminal information output processing unit 113 outputs the generated terminal information to the command input / output processing unit 115. An example of the operation of the terminal information output processing unit 113 is shown in Figure 9.

[0031] The frame transmission / reception processing unit 114 performs frame transmission and reception processing. The command input / output processing unit 115 outputs terminal information received from the terminal information output processing unit 113 to the command line interface.

[0032] Figure 4 shows an example of the MAC address table 121, terminal information storage unit 122, and excluded port storage unit 123 shown in Figure 3. Figure 4 shows the information held in the storage unit 15 of the L2 switch 10A shown in Figure 1.

[0033] The MAC address table 121 holds the MAC addresses of terminals TM directly or indirectly connected to a port, for each port number. When an L2 switch 10 with multiple terminals TM connected is connected to a port, the MAC address table 121 holds multiple MAC addresses for a single port number.

[0034] The terminal information storage unit 122 stores the MAC address and port number copied from the MAC address table 121, along with the IP address and terminal information for each MAC address. In the example shown in Figure 4, the terminal information indicates the type of OS running on terminal TM, but the OS version may also be included. Note that the MAC address and IP address are also included in the terminal information. Windows 10 and Windows XP (Windows is a registered trademark) shown in the terminal information column of the terminal information storage unit 122 are just examples, and other types of OS may be shown.

[0035] The excluded port storage unit 123 holds the excluded port numbers stored by the frame monitoring processing unit 111 in Figure 3. Here, excluded ports are ports to which other network devices such as L2 switches 10 are connected, and which are not directly connected to terminals TM, and are determined by the reception of spontaneous frames as described above.

[0036] Figure 5 is an explanatory diagram showing an example of excluded ports in L2 switches 10A, 10B, and 10C located in the subnetwork SNET1 shown in Figure 1. The determination of excluded ports is performed by the frame monitoring processing unit 111 shown in Figure 3.

[0037] For example, L2 switch 10A receives spontaneous frames from L2 switch 10C on port 4, and therefore determines that no terminal TM is directly connected to port 4. L2 switch 10B also receives spontaneous frames from L2 switch 10C on port 4, and therefore determines that no terminal TM is directly connected to port 4.

[0038] Similarly, L2 switch 10C receives spontaneous frames from L2 switches 10A and 10B on ports 1 and 2 respectively, and therefore determines that no terminal TMs are directly connected to ports 1 and 2.

[0039] Furthermore, since the router 20 connected to port 4 of the L2 switch 10C does not send spontaneous frames, the L2 switch 10C does not determine port 4 as an excluded port. Also, port 3 of the L2 switch 10C is an empty port that is not connected to terminal TM, other L2 switches 10, or router 20, and does not receive spontaneous frames or relay frames. For this reason, the L2 switch 10C does not determine port 3 as an excluded port.

[0040] Figure 6 shows an example of the contents stored in the terminal information storage unit 122, which is generated by the frame monitoring processing unit 111 and the port information storage processing unit 112 in Figure 3. Figure 6 shows the contents of the terminal information storage unit 122 of the L2 switches 10A and 10B.

[0041] In Figure 6, the terminal TM identifiers shown in parentheses outside the frame of each terminal information storage unit 122 are for reference only and are not actually included in the terminal information storage unit 122. Furthermore, in the terminal information storage unit 122, records corresponding to terminal TM-C using older operating systems are shown in shaded areas. However, this shading is added for clarity, and the actual terminal information storage unit 122 does not contain information identifying older operating systems.

[0042] The port information storage processing unit 112 of each L2 switch 10A and 10B stores pairs of MAC addresses and port numbers obtained from the MAC address table 121 of its own L2 switch 10 in the terminal information storage unit 122. The frame monitoring processing unit 111 of each L2 switch 10A and 10B analyzes the received relay frame and extracts terminal information. The terminal information includes the IP address. The frame monitoring processing unit 111 stores the terminal information, including the IP address, in the record of the terminal information storage unit 122 corresponding to the port that received the relay frame whose terminal information has been analyzed.

[0043] The accumulation of terminal TM information in the terminal information storage unit 122 is performed by monitoring frames broadcast throughout the entire subnetwork SNET1. Therefore, the terminal information storage unit 122 generated by L2 switch 10A includes information on terminals TM-D, TM-E, and TM-F, which are not directly connected to L2 switch 10A. Similarly, the terminal information storage unit 122 generated by L2 switch 10B includes information on terminals TM-A, TM-B, and TM-C, which are not directly connected to L2 switch 10B. Consequently, it is difficult to determine which terminals TM are directly connected to each L2 switch 10 simply by referring to the terminal information storage unit 122 of each L2 switch 10.

[0044] Figure 7 shows an example of the operation of the frame monitoring processing unit 111 in Figure 3. In other words, Figure 7 shows an example of a control method for the communication device. The frame monitoring processing unit 111, which has started monitoring frames, waits for the L2 switch 10 to receive a frame in step S10. When the L2 switch 10 receives a frame, the frame monitoring processing unit 111 proceeds to step S11.

[0045] In step S11, the frame monitoring processing unit 111 determines the type (protocol) of the frame from the header information of the frame received by the L2 switch 10, and determines whether the received frame is a frame to be analyzed. If the received frame is a frame to be analyzed, the frame monitoring processing unit 111 proceeds to step S12. If the received frame is not a frame to be analyzed, the frame monitoring processing unit 111 returns to step S10 and waits for the L2 switch 10 to receive a frame.

[0046] In step S12, the frame monitoring processing unit 111 performs analysis processing on the received frame and determines whether the received frame is a spontaneous frame transmitted by another network device such as an L2 switch 10. If the received frame is a spontaneous frame, the frame monitoring processing unit 111 proceeds to step S13; otherwise, it proceeds to step S15.

[0047] For example, if the frame type is BPDU, the frame monitoring processing unit 111 determines that the received frame is a spontaneous frame sent by a network device such as the L2 switch 10. Alternatively, if the frame type is LLDP, the frame monitoring processing unit 111 may determine whether or not it is a spontaneous frame from a network device based on the "System Capability" code. For example, if the "System Capability" code is "B: Bridge" or "R: Router", it can be determined that it is a spontaneous frame.

[0048] Thus, the frame monitoring processing unit 111 determines that a received frame is a spontaneous frame if it is a frame transmitted from another L2 switch 10 but not from the terminal TM. In other words, the frame monitoring processing unit 111 determines that a received frame is a spontaneous frame if it is a frame type used for controlling the L2 switch 10, such as BPDU or LLDP.

[0049] Furthermore, if the frame monitoring processing unit 111 determines that the MAC address of the frame's source is a specific MAC address, it may determine that the frame is a spontaneous frame sent by a network device such as the L2 switch 10. Alternatively, the frame monitoring processing unit 111 may determine a spontaneous frame by combining the frame type with the values ​​of data other than the frame type.

[0050] In step S13, the frame monitoring processing unit 111 searches the MAC address table using the MAC address of the frame's source as the key and identifies the port number of the L2 switch 10 that received the spontaneous frame. Alternatively, the frame monitoring processing unit 111 may obtain the port number based on management information obtained from the storage area by the control program of the switch device 14 (e.g., the receive descriptor) when the frame is received.

[0051] Next, in step S14, the frame monitoring processing unit 111 stores the port number that received the spontaneous frame identified in step S13 as an excluded port number in the excluded port storage unit 123. After step S14, the process proceeds to step S15.

[0052] In step S15, the frame monitoring processing unit 111 extracts various information contained in the frame according to the protocol identified by the frame analysis in step S11. For example, the various information may include one or more of the following: MAC address, IP address, OS name, OS version, and host name, which can be determined from the fields in the frame. The frame monitoring processing unit 111 stores the extracted information as terminal information in the terminal information storage unit 122. After step S15, the process returns to step S10.

[0053] Figure 8 shows an example of the operation of the port information storage processing unit 112 in Figure 3. In other words, Figure 8 shows an example of a control method for a communication device. The port information storage processing unit 112, which has started the process of assigning port number information, repeatedly executes the flow shown in Figure 8 at regular intervals.

[0054] First, in step S20, the port information storage processing unit 112 sequentially retrieves record information, which consists of MAC addresses and port numbers, from the MAC address table 121 in the storage unit 15. Next, in step S21, the port information storage processing unit 112 compares the index indicating the record number in the terminal information storage unit 122 with the maximum number of records. Here, the index is set to the minimum number of records when the process moves from step S20 to step S21. If the index is less than or equal to the maximum number of records, the port information storage processing unit 112 moves the process to step S22; if the index is greater than the maximum number of records, the process moves to step S25.

[0055] In step S22, the port information storage processing unit 112 searches the records in the terminal information storage unit 122 using the source MAC address of the frame received by the L2 switch 10 as the key. Next, in step S23, the port information storage processing unit 112 updates the port number in the terminal information storage unit 122 for records where the MAC address matches the source MAC address. That is, the port number is added to the terminal information such as MAC address, IP address, OS name, and OS version stored by the frame monitoring processing unit 111.

[0056] The port number stored in the terminal information storage unit 122 may be obtained from management information (receive descriptor) stored in a storage area such as the memory 12 by the control program of the switch device 14 shown in Figure 2 when the L2 switch 10 receives a frame.

[0057] Next, in step S24, the port information storage processing unit 112 increments the index by 1 and returns to step S21. This allows the port numbers of all records in the terminal information storage unit 122 to be updated.

[0058] On the other hand, in step S25, the port information storage processing unit 112 waits for a predetermined time T1, then proceeds to step S20 and performs the port number update process described above.

[0059] Figure 9 shows an example of the operation of the terminal information output processing unit 113 in Figure 3. In other words, Figure 9 shows an example of a control method for the communication device. The flow shown in Figure 9 is initiated in response to a request from the command input / output processing unit 115 in Figure 3.

[0060] First, in step S30, the terminal information output processing unit 113 compares the index indicating the record number of the terminal information storage unit 122 with the maximum number of records. The index is set to the minimum number of records when the process shown in Figure 9 starts. If the index is less than or equal to the maximum number of records, the terminal information output processing unit 113 proceeds to step S31. If the index is greater than the maximum number of records, the process shown in Figure 9 is terminated because the output of terminal information for all records has been completed.

[0061] In step S31, the terminal information output processing unit 113 obtains information from the record in the terminal information storage unit 122 indicated by the current index. Next, in step S32, the terminal information output processing unit 113 determines whether the port number included in the obtained record matches any of the excluded port numbers stored in the excluded port storage unit 123.

[0062] If the terminal information output processing unit 113 finds that the port number matches any of the excluded port numbers, it returns to step S30 because the information in the record obtained in step S31 is not information about a terminal TM directly connected to its own L2 switch 10. If the port number does not match any of the excluded port numbers, the terminal information output processing unit 113 proceeds to step S33 because the information in the record obtained in step S31 is information about a terminal TM directly connected to its own L2 switch 10.

[0063] In step S33, the terminal information output processing unit 113 retrieves the record information (i.e., terminal information) contained in the record acquired in step S31 from the terminal information storage unit 122, and outputs the acquired record information to a file, for example, as a string.

[0064] Next, in step S34, the terminal information output processing unit 113 increments the index by 1 and returns the process to step S30. As a result, terminal information for terminals TM connected to ports other than those indicated by the excluded port numbers can be output from all records in the terminal information storage unit 122. The file output from the terminal information output processing unit 113 is referenced by the command input / output processing unit 115 and output to the command line interface.

[0065] Figure 10 shows an example of a list of terminal information included in the file output by the terminal information output processing unit 113 in Figure 3. As with Figure 6, the terminal identifiers TM shown in parentheses outside the frame of each terminal information list are for reference only and are not included in the actual terminal information list. Also, the shading shown in the terminal information list is for explanatory purposes only and is not included in the actual terminal information list.

[0066] For example, a network administrator connects to L2 switches 10A and 10B via SSH through terminal 30 and obtains terminal information list files from each of L2 switches 10A and 10B. Terminal 30 displays the terminal information list contained in the files received from each of L2 switches 10A and 10B as a command line on terminal 30's display device, for example. Figure 10 is also the terminal information list of L2 switches 10A and 10B that terminal 30 displays on its display device, based on the terminal information list files output from the terminal information output processing units 113 of L2 switches 10A and 10B.

[0067] By viewing the list of terminal information displayed on the display device, the network administrator can easily identify, for example, terminal TM-C using an older OS (Windows XP in this example) and the L2 switch 10 to which terminal TM-C is connected. The network administrator can then determine that if they want to disconnect terminal TM-C from the network, they should simply block port 3 of the L2 switch 10A.

[0068] In contrast, if the contents of the terminal information storage unit 122 shown in Figure 6 are sent as a file to the network administrator's terminal 30, it is difficult to recognize the L2 switch 10 and port number to which terminal TM-C, which is using an older OS, is connected. Therefore, it is difficult for the network administrator to determine which port on which L2 switch 10 should be blocked in order to isolate terminal TM-C from the network. In other words, if the network configuration to which terminal TM-C is connected is unknown, it is difficult for the network administrator to isolate terminal TM-C from the network.

[0069] In this embodiment, even when multiple L2 switches 10 are deployed on a network with an unknown network configuration, each L2 switch 10 can output a terminal information list that includes only the terminal information of the terminal TM directly connected to its own L2 switch 10. The terminal information list is transmitted to the terminal 30, for example, based on a terminal information output request from the terminal 30 used by the network administrator.

[0070] This allows network administrators to view a list of terminal information displayed on the display device, making it easy to identify, for example, terminal TM-C using an older OS and the L2 switch 10 to which terminal TM-C is connected. Therefore, if a network administrator wants to isolate terminal TM-C from the network, they can determine that they should simply block port 3 of the L2 switch 10A.

[0071] Furthermore, for example, vulnerable terminals TM-C can be quickly isolated from the network, protecting the network from malware infections and other threats. As a result, the spread of malware infection can be suppressed, and disruptions such as business interruptions caused by infections spreading to a large number of terminals TM can be prevented.

[0072] For example, the frame monitoring processing unit 111 can determine if a frame received on a port is a spontaneous frame if it is transmitted only from other L2 switches 10, and can exclude the port that received the spontaneous frame. For example, the frame monitoring processing unit 111 can exclude a port that receives a BPDU frame broadcast by another L2 switch 10.

[0073] Each L2 switch 10 determines which port a terminal TM is directly connected to. Therefore, even if the terminal 30 used by the network administrator is connected to a different subnetwork SNET2 than subnetwork SNET1, which outputs the terminal information list, the terminal information list can still be received. This allows the network administrator to identify the L2 switch 10 and port number to which the vulnerable terminal TM-C is connected.

[0074] Furthermore, the terminal information list includes terminal TM identification information such as IP addresses. Therefore, if a network administrator wants to block a terminal TM with a specific IP address from the network, they can search for the IP address in the terminal information list displayed on the command line and identify the L2 switch 10 and port number to which the terminal TM to be blocked is connected. This makes it easy to block terminal TMs with specific IP addresses from the network.

[0075] Figure 11 shows an example of the functional configuration of the L2 switch 10 in another embodiment. Elements similar to those in the embodiments described above are denoted by the same reference numerals, and detailed descriptions are omitted. The hardware configuration of the L2 switch 10 shown in Figure 11 is the same as that in Figure 2. Furthermore, the network configuration including the L2 switch 10 shown in Figure 11 is the same as that in Figure 1.

[0076] The L2 switch 10 in this embodiment has the same functional configuration as the L2 switch 10 shown in Figure 3, except that a specific MAC address storage unit 124 is assigned to the storage unit 15. The specific MAC address storage unit 124 is used by the frame monitoring processing unit 111 to identify network devices that transmit spontaneous frames. This makes it possible to determine spontaneous frames not only by the frame type described in Figure 7, but also by identifying network devices such as the L2 switch 10 that transmit spontaneous frames based on the MAC address of the frame source.

[0077] Figure 12 shows an example of the MAC address table 121, terminal information storage unit 122, excluded port storage unit 123, and specific MAC address storage unit 124 shown in Figure 11. The information stored in the MAC address table 121, terminal information storage unit 122, and excluded port storage unit 123 is the same as the information shown in Figure 4.

[0078] The specific MAC address storage unit 124 has multiple records that hold pairs of common MAC addresses capable of identifying multiple L2 switches 10 that send spontaneous frames, and mask codes used to mask a specific set of bits in the MAC address. The common MAC address is masked with a predetermined number of lower bytes of the MAC address being "00". This allows the common MAC address to indicate, for example, a product from a specific vendor, or a specific product from a specific vendor (e.g., a specific network device).

[0079] The MAC address mask code "ff" indicates that the byte at the position corresponding to "ff" in the MAC address of the frame's source will not be masked. The mask code "00" indicates that the byte at the position corresponding to "00" in the MAC address of the frame's source will be masked.

[0080] The frame monitoring processing unit 111 (Figure 3) then calculates a logical AND of the MAC address contained in the frame received by the L2 switch 10 and the mask code held in the specific MAC address storage unit 124, and generates a MAC address for comparison. If the generated MAC address for comparison matches the common MAC address, the frame monitoring processing unit 111 determines that the received frame is a self-initiated frame.

[0081] In other words, the frame monitoring processing unit 111 determines that a received frame is a spontaneous frame if the MAC address obtained by masking a specific set of bits of the MAC address contained in the received frame with a mask code matches the common MAC address. The frame monitoring processing unit 111 determines that a received frame is not a spontaneous frame if the MAC address generated for comparison does not match the common MAC address.

[0082] As shown in Figure 12, if the specific MAC address storage unit 124 holds multiple records, the frame monitoring processing unit 111 performs a logical AND calculation with the mask code for each record, and compares the MAC address obtained from the calculation with the common MAC address.

[0083] The operation of the frame monitoring processing unit 111 is the same as in Figure 7, except that a determination process using the specific MAC address storage unit 124 is added to the spontaneous frame determination process in step S12 of Figure 7. The operation of the port information storage processing unit 112 is the same as in Figure 8. The operation of the terminal information output processing unit 113 is the same as in Figure 9. The contents held in the terminal information storage unit 122 are the same as in Figure 6. The list of terminal information included in the file output by the terminal information output processing unit 113 is the same as in Figure 10.

[0084] As described above, the same effects as those of the embodiments described can be obtained in this embodiment as well. For example, even when multiple L2 switches 10 are placed on a network whose network configuration is unknown, each L2 switch 10 can output a list of terminal information that includes only the terminal information of the terminal TM directly connected to its own L2 switch 10. This allows the network administrator to view the list of terminal information displayed on the display device and easily recognize, for example, a terminal TM-C using an older OS and the L2 switch 10 to which terminal TM-C is connected.

[0085] Furthermore, in this embodiment, each L2 switch 10 assigns a specific MAC address storage unit 124, which stores a common MAC address and a mask code, to the storage unit 15. This allows the frame monitoring processing unit 111 to not only determine a spontaneous frame based on the frame type, but also to determine the network device, such as the L2 switch 10, that sends the spontaneous frame based on the MAC address of the frame's source.

[0086] In the above-described embodiment, an example was explained in which the L2 switch 10 is equipped with a function to determine excluded ports and generate and output a list of terminal information based on the determined excluded ports. However, the function to determine excluded ports and generate and output a list of terminal information based on the determined excluded ports may also be equipped in a communication device such as an L3 switch, router, or wireless LAN access point.

[0087] The features and advantages of the embodiments will become clear from the detailed description above. This is intended to be so as not to deviate from the spirit and scope of the claims, that the features and advantages of the embodiments described above are included. Furthermore, any improvement and modification should be readily conceivable to a person with ordinary skill in the art. Therefore, there is no intention to limit the scope of inventive embodiments to those described above, and it is also possible to rely on appropriate improvements and equivalents that fall within the scope disclosed in the embodiments. [Explanation of symbols]

[0088] 10 (10A, 10B, 10C, 10D) L2 switch 11 CPU 12 memory 13 Non-volatile memory 14 Switch Devices 15 Storage section 16 Processing Unit 20 Routers 30 devices 100 Networks 111 Frame monitoring processing unit 112-port information storage processing unit 113 Terminal Information Output Processing Unit 114 Frame transmission / reception processing unit 115 Command Input / Output Processing Unit 121 MAC Address Table 122 Terminal Information Storage Unit 123 Excluded Port Storage Unit 124 Specific MAC Address Storage Unit SNET1, SNET2 Subnetwork TM (TM-A, TM-B, TM-C, TM-D, TM-E, TM-F) terminal

Claims

1. A communication device having multiple ports to which terminals or other communication devices can be connected, and which transmits and receives frames, A frame monitoring processing unit stores terminal information of the source terminal of the frame received at the port in the terminal information storage unit, and if the received frame is a spontaneous frame spontaneously transmitted from another communication device, it determines that the port that received the spontaneous frame is an excluded port. An excluded port storage unit stores excluded port information that identifies the excluded port determined by the frame monitoring processing unit, A port information storage processing unit refers to a correspondence table that stores identification information for a terminal connected to the port in association with the identification information for the port, and stores the identification information for the port to which the terminal is connected in association with the terminal information stored in the terminal information storage unit. A terminal information output processing unit outputs terminal information to the management terminal from the terminal information storage unit, excluding terminal information corresponding to port identification information stored in the excluded port storage unit, based on a terminal information output request from a management terminal used for managing the network including the communication device. A communication device having the following features.

2. The frame monitoring processing unit determines that a frame received at the port is a spontaneous frame if the destination is not uniquely specified. The communication device according to claim 1.

3. The frame monitoring processing unit determines that a frame received at the port is a spontaneous frame if it is a frame that is periodically reported. The communication device according to claim 2.

4. The identification information that identifies the aforementioned terminal is the MAC address. The frame monitoring processing unit determines that the received frame is the spontaneous frame if the MAC address included in the received frame is a specific MAC address indicating the communication device that transmitted the spontaneous frame. A communication device according to any one of claims 1 to 3.

5. It has a specific MAC address storage unit that holds a common MAC address capable of identifying multiple specific MAC addresses and a mask code used to mask a specific set of bits of a MAC address, The frame monitoring processing unit determines that the received frame is a spontaneous frame if the MAC address obtained by masking the specific bit group of the MAC address contained in the received frame with the mask code matches the common MAC address. The communication device according to claim 4.

6. A method for controlling a communication device that has multiple ports to which terminals or other communication devices can be connected, and which transmits and receives frames, The frame monitoring processing unit of the communication device stores terminal information of the source terminal of the frame received at the port in the terminal information storage unit, and if the received frame is a spontaneous frame spontaneously transmitted from another communication device, it determines the port that received the spontaneous frame as an excluded port, and stores excluded port information identifying the determined excluded port in the excluded port storage unit. The port information storage processing unit of the communication device refers to a correspondence table that stores identification information for terminals connected to the port in association with the identification information of the port, and stores the identification information of the port to which the terminal is connected in association with the terminal information stored in the terminal information storage unit. The terminal information output processing unit of the communication device outputs terminal information to the management terminal, based on a request for output of terminal information from a management terminal used for managing the network including the communication device, from the terminal information stored in the terminal information storage unit, excluding terminal information corresponding to the identification information of ports stored in the excluded port storage unit. A method for controlling communication devices.

Images