JP3474155B2 - Network system and network monitoring method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network monitoring technique, and more particularly to a technique for controlling packet capture from a network.

[0002]

2. Description of the Related Art In order to analyze the cause of a network trouble, a LAN analyzer that captures packets on the network and holds the captured packets is widely used. Since the storage area for holding this packet has a limited capacity, it is used cyclically.
Therefore, even after a certain period of time has passed, even a captured packet is overwritten and lost.

Further, in a conventional LAN analyzer, for example, in the case of a network adopting TCP / IP as a protocol, protocol errors are detected in the physical layer, data link layer, network layer, transport layer and session layer. can do. When this error is detected, there is a stop trigger function that stops the acquisition of data and prevents the data currently held in the storage area from being lost.

[0004]

However, even if there is a cause in the communication process, if an error occurs in the data of the application layer, the LAN analyzer cannot recognize the error. Therefore, it is not possible to detect an error in the application layer and apply a stop trigger. So in this case,
There is a problem that the data in the storage area at the time of the error cannot be retained.

It is an object of the present invention to provide a network monitoring technique which pays attention to such a conventional problem and stops updating the data according to the taken data.

[0006]

In order to achieve the above object, the present invention performs the following processing. That is, the occurrence of a predetermined event is detected, and when the occurrence of the event is detected, a specific packet is output to the network. A packet on the network is captured and it is determined whether the captured packet is a specific packet. As a result of the determination, if the captured packet is not a specific packet, the captured packet is held. As a result of the discrimination, if the fetched packet is a specific packet, the packets after the packet are not held.

[0007]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is an overall configuration diagram of a network system to which the first embodiment is applied. That is, LAN analyzers 1a and 1b which are network monitoring devices
, Computers 2a and 2b, and test computers 3a and 3b are LAN (Local Area Network) 8a,
It is connected to 8b. LAN8 with the same configuration
a and 8b are connected by a WAN (Wide Area Network) 9. This network system uses TCP / IP as a communication protocol. However, the communication protocol is not limited to TCP / IP. For example, another communication protocol may be used, or IP (Internet protocol) and a higher level protocol other than TCP (transmission control protocol) may be combined.

In the present embodiment, the computers 2a, 2
b detects the occurrence of a predetermined event and converts it into an event that can be detected by the LAN analyzers 1a and 1b. Specifically, when the computers 2a and 2b detect an error or the like in the application layer, a ping command for an IP address (newly assigned IP address) that does not logically exist for all the computers on the network. Convert to the event of issue.

The LAN analyzer 1 is installed when a trouble occurs in the network, and captures and holds packets on the LAN 8. The network maintainer is LA
The packet held in the N analyzer is analyzed to help find the cause of the trouble. The detailed configuration of the LAN analyzer 1 will be described with reference to FIG.

The LAN analyzer 1 includes an input device 101 such as a keyboard and a CRT, as shown in FIG.
A display device 102 such as a liquid crystal display is connected. The LAN analyzer 1 includes a data acquisition unit 12 and an IP
An address storage unit 13, a data determination unit 14, a data acquisition control unit 16, and a display control unit 18 are provided as its internal functions. These internal functions are realized by the processor reading a predetermined program and executing it.

The data acquisition unit 12 includes a data acquisition unit 121.
And a data holding unit 122. Data acquisition unit 121
Captures a packet on the LAN. The captured packet is temporarily stored in a buffer (not shown).

The data holding unit 122 is a data fetching unit 12
1 holds the packet captured. Data holding unit 12
2 is composed of, for example, a cyclic buffer having a fixed capacity. That is, for example, the packet has a capacity of about 100 megabytes, and the packets are sequentially stored. When the data is stored in the entire area, the oldest data is overwritten and stored.

The IP address storage unit 13 has an area for storing the IP address 80 set in the test computer 3 connected to the same LAN 8 as the LAN analyzer 1. For example, the IP address storage unit 13 of the LAN analyzer 1a stores the IP address 80c (***. ***. 34.56) of the test computer 3a.

The data discriminating unit 14 discriminates whether or not the packet captured by the data capturing unit 12 is a specific packet. For example, the IP of the destination of the captured packet
I whose address is stored in the IP address storage unit 13
It is determined whether or not it matches the P address. Specifically, in the LAN analyzer 1a, the destination IP address of the captured packet is the IP address 80c (***. ***.
34.56). More preferably, it may also be determined whether or not the captured packet is a Ping command.

As a result of the discrimination, if the packet is a specific packet, the data acquisition control unit 16 is notified of that fact. If the packet is not a specific packet,
It instructs to write the packet stored in the buffer (not shown) to the data holding unit 122.

The data acquisition control unit 16 includes the data acquisition unit 1
2 controls data acquisition. For example, upon receiving a notification from the data discriminating unit 14,
Instructs not to keep packets after a specific packet. Preferably, LA is added after the specific packet.
It is also possible to restrict the packets transmitted over N so that the data capturing unit 121 does not capture them. Alternatively, a packet transmitted on the LAN after the specific packet and captured by the data capturing unit 121 may not be written to the data holding unit 122 from a buffer (not shown).

By doing so, the content stored in the data holding unit 122 is updated after the specific packet is received,
You can avoid being rewritten. As a result, the packet existing on the network immediately before receiving the specific packet is not overwritten and can be retained.

The input / output control unit 18 controls the input device 101 and the display device 102. For example, the input device 10
The input from 1 is accepted, and the display device 102 displays the data held in the data holding unit 122.

IP addresses 80a and 80b are assigned to the computer 2a and the computer 2b, respectively, to communicate with each other and execute a predetermined application. The detailed configuration of the computer 2 is shown in FIG.
Will be explained. As shown in FIG. 4B, the computer 2 includes a communication control unit 21 and one or more data processing units 2.
2, an error detection unit 23 for detecting an error occurrence in the data processing unit 22, and an IP address storage unit 24 as its internal functions. These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control unit 21 controls communication with other devices on the network. For example, a packet on the LAN 8 is acquired and a packet addressed to the own computer 2 is accepted. It also generates a packet and outputs it to the LAN 8 for transmission to another device on the network.

The data processing unit 22 performs a predetermined application process defined by the user based on the information indicated by the packet received by the communication control unit 21.

The error detection unit 23 monitors whether or not a predetermined event has occurred in the data processing unit 22, and when the event has occurred, it detects it as an error. The event that the error detection unit 23 should detect can be arbitrarily designated by the user. For example, the data processing unit 2
It is also possible to detect abnormal termination of the processing in 2, communication failure such as timeout in communication processing with other devices, error in upper layer of protocol, and the like. More preferably, a minor problem such as a so-called warning may be detected as an error.

Further, when the error detector 23 detects an error, the I stored in the IP address memory 24 is detected.
The device with the P address is notified of the error detection. For example, the communication control unit 21 is instructed to issue a Ping command addressed to the IP address stored in the IP address storage unit 24.

The IP address storage unit 24 stores the IP address 80 and WA set in the test computer 3 connected to the same LAN 8 as the LAN analyzer 1.
IP address 80 set in the test computer 3 connected to another LAN 8 connected via N9
Memorize For example, the IP addresses 80c (***. ***. 34.56) and 80d (***. ***. 12.78) of the test computers 3a and 3b are stored in both the IP address storage units 24 of the computers 2a and 2b. ) Is stored.

The test computers 3a and 3b are computers installed for analyzing network troubles. Therefore, it is not necessary to install it at normal times. IP addresses 80c and 80d are assigned to the test computers 3a and 3b, respectively. The test computer 3 may be any device as long as it can be connected to the LAN 8 by allocating an IP address.

The processing procedure in this embodiment will be described with reference to FIG.

FIG. 7 shows the processing procedure of the LAN analyzer 1a. The LAN analyzer 1b is the same except that the LAN 8a and the LAN 8b are different.

Upon receiving a predetermined instruction from the input device 101,
The data acquisition 121 starts data acquisition (S1
01). The captured packet is the test computer 3
It is determined whether it is addressed to a (S102).
If the packet is not addressed to the test computer 3a, the packet is written and held in the data holding unit 122 (S
103). Then, the process returns to S101 and the process is repeated.
This includes communication between the computers 2a and 2b,
The packets on the LAN 8a are held.

At this time, for example, it is assumed that an error has occurred in the data processing section 22 of the computer 2b. Then, the error detection unit 23 of the computer 2b detects an error. Then, the Ping command is issued from the computer 2b to the test computers 3a and 3b.

When the LAN analyzer 1a fetches a packet addressed to the test computer 3a (S101, S
102), the data acquisition control unit 16 prohibits acquisition of a packet transmitted on the LAN 8a after the packet (S104). As a result, the data holding unit 122
Is not updated. That is, the packet stored in the data holding unit 122 at the time when the packet addressed to the test computer 3a is acquired is held as it is.

Next, FIG. 2 shows an overall configuration diagram of a network system to which the second embodiment of the present invention is applied.
That is, a LAN analyzer 1 which is a network monitoring device, a computer 2, and a test computer 3
And are connected to the LAN 8. Monitoring computer 5
Is connected to the LAN 8b, and the LANs 8a and 8b are connected by the WAN 9. In the following embodiments, the first
The same configurations as those of the embodiment may be denoted by the same reference numerals and the description thereof may be omitted.

LAN analyzer 1 used in this embodiment,
The configurations of the computer 2 and the test computer 3 are similar to those of the first embodiment.

The monitor computer 5 monitors the state of the computer 2. As shown in FIG. 5, the configuration of the monitoring computer 5 includes a communication control unit 51, a monitoring control unit 52, and an IP.
An address storage unit 53 is provided as its internal function.
These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control unit 51 controls communication with other devices on the network. For example, the packet on the LAN 8 is acquired, and the packet addressed to the self-monitoring computer 5 is accepted. It also generates a packet and outputs it to the LAN 8 for transmission to another device on the network.

The monitor controller 52 monitors the operating state of the computer 2. For example, a message is periodically output to the computer 2 to check whether there is a response. If there is no response, it is considered that the computer 2 has some abnormality, and the test computer 3 is notified of the abnormality. Specifically, P sent to the computer 2 is regularly
The communication control unit 51 is instructed to output the ing command. The response to this Ping is received via the communication control unit 51. If there is no response within the fixed time, the communication control unit 51 is instructed to output the Ping command to the test computer 3.

The IP address storage unit 53 has at least the following:
The IP addresses 80a and 80c set in the computer 21 and the test computer 3 are stored.

The processing procedure of the monitoring computer 5 in this embodiment will be described. The processing procedure of the LAN analyzer 1 is the same as in FIG.

The computer 2 is performing predetermined processing while communicating with other devices not shown. At this time, the monitoring computer 5 periodically sends a Ping command to the computer 2 and confirms the response (S201, S202). When an abnormality is detected, such as when there is no response within a predetermined time, the monitoring computer 5 issues a Ping to the test computer 3 (S203).

Pin for this test computer 3
The LAN analyzer 1 that has received g operates according to the flow of FIG. 7.

In the first embodiment, the computer 2 itself detects an error and detects the Pin to the test computer 3.
issued g. Therefore, if the computer 2 hangs up or down and cannot issue the Ping by itself, the error cannot be detected. However, in this embodiment, an error can be detected even in such a case.

Further, in the first embodiment, it is necessary to provide the error detecting section 23 inside the computer 2. However, in reality, there are cases where it is not desirable to provide an error detection unit inside the computer 2. In such a case, if the configuration according to the present embodiment is adopted, the same function can be realized by adding the monitoring computer 5 to the network without modifying the computer 2.

Next, FIG. 3 shows an overall configuration diagram of a network system to which the third embodiment of the present invention is applied.
That is, the computers 2a and 2b and the network monitoring device computers 6a and 6b are connected to the LANs 8a and 8b.
It is connected to the. LANs 8a and 8 of the same configuration
b is connected by WAN9. Each of the network monitoring computers 6a and 6b has an IP address 80
e, 80f are allocated.

Computers 2a, 2 used in this embodiment
The configuration of b is the same as that of the first embodiment. The configuration of the network monitoring computers 6a and 6b is shown in FIG.

The network monitoring computer 6 is shown in FIG.
As shown in, an input device 101 such as a keyboard and a display device 102 such as a CRT or a liquid crystal display are connected. The network monitoring computer 6 includes a communication control unit 61, a data acquisition unit 12, an IP address storage unit 13, a data determination unit 14, and a data acquisition control unit 16.
And the display control unit 18 as its internal functions.
These internal functions are realized by the processor reading a predetermined program and executing it.

The communication control unit 61 controls communication with other devices on the network. For example, to create a packet and send it to another device on the network.
Output to 8. Specifically, in the case of the network monitoring computer 6a, when the data discriminating unit 14 receives the notification, the IP address 80f of the network monitoring computer 6b is acquired from the IP address storage unit 13, and the Pin
send g.

The IP address storage unit 13 has an area for storing the IP address 80 assigned to the own network monitoring computer 6 and the IP address 80 assigned to the network monitoring computer 6 connected to another LAN 8. Prepare For example, in the case of the network monitoring computer 6a, the IP address 80e (***. ***. 34.78) is stored in the area for the own computer 6 and the IP address 8e is stored in the area of another network monitoring computer.
It stores 0f (***. ***. 12.89).

The data discriminating unit 14 discriminates whether or not the IP address of the transmission destination of the captured packet matches the IP address stored in the own device IP address storage area of the IP address storage unit 13. That is, in the network monitoring computer 6a, the destination IP address of the captured packet is the IP address 80e (***. **).
* .12.89) is determined. If they match as a result of the discrimination, the fact is notified to the communication control unit 61 and the data acquisition control unit 16.

Since an IP address is assigned to the network monitoring computer 6 of this embodiment, it is not necessary to provide the test computer 3 unlike the other embodiments. That is, when the packet addressed to the own computer 6 is received, the data holding unit 122 is not updated. As a result, the packet stored in the data holding unit 122 at the time when the packet addressed to the own computer 6 is acquired is
It is kept as it is.

Further, since the packet can be sent to other devices on the network, the computer 2 may send a Ping for notifying the error detection to the network monitoring computer 6 on the same LAN 8.

In the first embodiment, the LAN analyzer 1 and the computer 2 may be integrated, or in the third embodiment, the network monitoring computer 6 and the computer 2 may be integrated. . Further, the respective configurations described in the above embodiment can be changed, added, omitted or the like in combination as much as possible.

Further, in any of the above embodiments, the two LANs 8a and 8b connected by the WAN 9 are used.
However, the same applies to the case where the number of LANs 8 is more than this.

[0053]

As described above, according to the present invention, it is possible to prevent the held data from being updated according to the data taken in by the network monitoring device.

[Brief description of drawings]

FIG. 1 is an overall configuration diagram of a network system in a first embodiment to which the present invention is applied.

FIG. 2 is an overall configuration diagram of a network system in a second embodiment to which the present invention is applied.

FIG. 3 is an overall configuration diagram of a network system in a third embodiment to which the present invention is applied.

FIG. 4A shows L in the embodiment according to the present invention.
It is explanatory drawing explaining the structure of AN analyzer, (b).
FIG. 3 is an explanatory diagram showing a configuration of a computer according to an embodiment of the present invention.

FIG. 5 is an explanatory diagram showing a configuration of a monitoring computer according to an embodiment of the present invention.

FIG. 6 is an explanatory diagram showing a configuration of a network monitoring computer according to an embodiment of the present invention.

FIG. 7 is a flowchart showing a processing procedure of the LAN analyzer according to the present invention.

FIG. 8 is a flowchart showing a processing procedure of the monitoring computer according to the present invention.

[Explanation of symbols]

1 ... LAN analyzer, 2 ... Computer, 3 ... Test computer, 5 ... Monitoring computer, 6 ... Network monitoring computer, 8 ... LAN, 9 ... WAN.

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Mutsuji Takesada 2 504 Shinanomachi, Totsuka-ku, Yokohama-shi, Kanagawa 2 Hitachi Electronic Service Co., Ltd. (56) Reference JP-A-6-132960 (JP, A) JP 2000 -106586 (JP, A) JP 59-202756 (JP, A) JP 10-21171 (JP, A) JP 2002-64492 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) H04L 12/28-12/46 H04L 29/14

Claims (7)

(57) [Claims] 1. A network system in which a network monitoring device and an electronic computer are connected via a network, wherein the electronic computer includes a processing unit that performs a predetermined application process, and an event that is predetermined by the processing unit. When an occurrence is detected, a test installed for trouble analysis
Packet with device identification information set as the destination
And includes an event detecting unit for force out to to the network, the network monitoring device takes in packets on the network sequentially, a packet acquisition unit that holds the destination of the packet captured by the said packet acquisition unit Knowledge
A discriminating unit that discriminates whether the different information is the identification information of the test device, and the discrimination result of the discrimination unit , the identification information of the transmission destination.
Is the identification information of the test device , the packet acquisition unit controls so as not to hold a packet subsequent to the packet, and a network system. 2. A network system according to claim 1, wherein the packet acquisition unit includes a capturing unit for capturing the packet from the network, and a holding portion for holding the take-up Write-section taken packet, As a result of the determination by the determination unit, the identification information of the transmission destination of the packet captured by the capturing unit is the test device.
If the identification information is, the control unit causes the capturing unit to stop capturing a packet after the packet. 3. The network system according to claim 1, wherein the packet acquisition unit includes a holding unit that holds the packet, and a loading unit that loads the packet from the network and writes the packet in the holding unit. As a result of the determination by the determination unit, the identification information of the transmission destination of the packet captured by the capturing unit is the test device.
If the identification information is, the network unit is characterized in that the control unit stops the writing of packets after the packet captured by the capturing unit into the holding unit. 4. The network system according to any one of claims 1 to 3, wherein the communication protocol of the network is an Internet protocol, and the packet on the network is at least The destination packet includes an IP address of the destination device, and the specific packet includes a specific I
A network system characterized by being a packet of a ping command in which a P address is set. 5. A process for performing a predetermined application process and, when detecting that a predetermined event has occurred in the application process, sets up for trouble analysis.
The identification information of the installed test equipment is set as the destination.
The in and packet processing for force out to to the network, captures packets on a network, identification information of the transmission destination of the captured packets, identification of the test device
The process of determining whether it is information, and the result of the determination is that the identification information of the destination of the captured packet
If the information is not the identification information of the test device , the captured packet is held and the captured packet is transmitted.
When the identification information of the recipient is the identification information of the test device, a process of not holding packets after the packet is performed . 6. A process for performing a predetermined application process and a process for trouble analysis when a predetermined event occurs in the application process is detected.
The identification information of the installed test equipment is set as the destination.
The in and packet processing for force out to to the network, captures packets on a network, identification information of the transmission destination of the captured packets, identification of the test device
The process of determining whether it is information, and the result of the determination is that the identification information of the destination of the captured packet
If the information is not the identification information of the test device , the captured packet is held and the captured packet is transmitted.
A computer-readable recording medium having recorded thereon a program for causing a computer to execute a process of holding no packets after the packet when the identification information of the recipient is the identification information of the test device . 7. A network monitoring device connected to an electronic computer via a network, a packet acquisition unit that sequentially captures and holds packets on the network, and an identification of a destination of the packet captured by the packet acquisition unit.
Test equipment installed for trouble analysis in another information
Of a determination unit identification information to determine whether it is set, the determination in the determination unit result, identification information of the transmission destination
Is the identification information of the test device , the packet acquisition unit controls so as not to hold a packet subsequent to the packet, and a network monitoring device.