JP4955722B2 - Packet capture system and packet capture method - Google Patents

Description

  The present invention relates to a technique for capturing a packet flowing through a network.

  As a method for pursuing the cause of the network trouble, there is a method for capturing and analyzing a packet flowing through the network. In some cases, trouble symptoms may not appear immediately, so network maintainers may go to the site where the trouble occurred and install a packet capture device to perform maintenance from a remote location.

  As a capture device, for example, the one described in Patent Document 1 is known.

JP 2001-103090 A

  When capturing a packet of maintenance data sent by the capture device itself, such as when the capture device is remotely maintained or when the capture device sends capture data to a remote maintenance site, the capture data increases as maintenance is performed. There's a problem.

  Some of the above problems can be solved by excluding the address of the capture device itself and the address of the remote maintenance base from the capture target. However, if all of the packets having the address of the remote maintenance base are excluded from the capture target, it is not possible to capture a packet of trial data communication with the remote maintenance base. In addition, when capturing a packet outside of NAT (Network Address Translation), the addresses of a plurality of devices inside the NAT are converted to the same address, so it is possible to identify the packet for each device inside the NAT. It is not possible to distinguish maintenance data packets that do not need to be captured.

  The present invention has been made in view of the above, and it is an object of the present invention to identify an uncaptured packet and suppress an increase in capture data.

A packet capture system according to a first aspect of the present invention is a packet capture system including a maintenance device that is remotely operated via a wide area network and a capture device that collects and accumulates packets. Capture means for collecting flowing packets; filter means for selecting packets collected by the capture means with reference to a list in which a set of network address and port number is registered; storage means for storing packets selected by the filter means; And the filter means detects a packet having a specific bit string sent from the maintenance device and registers a set of a transmission source network address and a port number of the packet in a list.

Packet capture method according to the second aspect of the present invention is a packet cab tea process according capture device for storing collect maintenance device and a packet which is remotely operated via a wide area network, according to the maintenance device, a particular bit sequence And a step of collecting packets flowing through the network by the capture device, detecting a packet having a specific bit string, and setting a pair of a source network address and a port number of the packet as a network address. and having a step of registering in a list registering a set of port numbers, and the step of selecting packets collected with reference to the list, a step of storing the selected in the step of selecting packet.

  According to the present invention, the maintenance device sends a packet having a specific bit string, the filter means of the capture device detects the packet having the specific bit string, and registers the transmission source network address and port number of the packet in the list. When the packet capture is performed, the filter means refers to the list, sorts the packets, and stores them in the storage means, so that the packet transmitted / received by the maintenance device can be identified. An increase in capture data can be suppressed.

It is a block diagram which shows the structure of the packet capture system in one Embodiment. It is a flowchart which shows the flow of the operation | movement which the packet capture system of FIG. 1 registers an exclusion list. It is a block diagram which shows the structure of another packet capture system in one Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a packet capture system in the present embodiment. The packet capture system shown in the figure includes a capture device 1 and a maintenance device 2 and is installed in a user's home where a network trouble occurs. The capture device 1 and the maintenance device 2 are connected to a remote maintenance base 50 via a network 100 such as the Internet, and are operated by a terminal 51 disposed at the remote maintenance base 50.

  In FIG. 1, the capture device 1 is connected to a WAN (Wide Area Network) side of a router 3 installed in a user's home, and the maintenance device 2 is connected to a LAN (Local Area Network) side of the router 3. An IP telephone 4 and a personal computer (not shown) are connected to the LAN side of the router 3. Note that the capture device 1 and the maintenance device 2 are installed when a network operator has a network trouble, and may not be installed in normal times.

  The capture device 1 captures packets flowing between the router 3 and the network 100, and excludes and accumulates maintenance packets by maintenance communication. The accumulated capture data is transmitted to the remote maintenance base 50. Details of the capture device 1 will be described later.

  The maintenance device 2 can be remotely operated from a terminal 51 arranged at the remote maintenance base 50, and transmits and receives maintenance packets. The packet for remote operation by the terminal 51 and the communication path of the maintenance data transmitted from the maintenance device 2 to the network 100 side include the capture points where the capture device 1 is installed. Accumulate by excluding packets. In FIG. 1, there is one maintenance device 2 arranged in the user's house, but a plurality of maintenance devices 2 may be arranged.

  The router 3 relays the packet between the LAN of the user's home and the network 100. The router 3 has a NAT function, and converts the start point address and end point address in the IP header. Specifically, the private address assigned to the device connected to the LAN side of the router 3 such as the maintenance device 2 or the IP telephone 4 is the global address assigned to the WAN side of the router 3 (in FIG. 2.2.2)) and assign a port number for each private address. The router 3 converts the transmission destination IP address of the packet transmitted from the WAN side into a private address.

  The IP telephone 4 is a telephone compatible with a telephone service provided by using VoIP (Voice over IP) technology, and makes a call by transmitting and receiving packets converted by digitizing voice via the network 100.

  Next, details of the capture device 1 will be described. As shown in FIG. 1, the capture device 1 includes a capture unit 11, a filter unit 12, and a storage unit 13.

  The capture unit 11 captures a packet that flows between the router 3 and the network 100.

  The filter unit 12 selects and accumulates the packets collected by the capture unit 11 in the accumulation unit 13. Specifically, out of the captured packets, packets that exclude the packets that meet the conditions described in the exclusion list are stored in the storage unit 13. The exclusion list is stored in a storage device included in the filter unit 12. In the exclusion list, an IP address and a set of an IP address and a port number are registered as conditions for the packet to be excluded. For example, if the source IP address of the captured packet matches the IP address registered in the exclusion list, the packet is not stored in the storage unit 13. Alternatively, when the transmission source IP address and port number of the captured packet match the pair of the IP address and port number registered in the exclusion list, the packet is not stored in the storage unit 13. Of course, the determination may be made based on whether or not the destination IP address matches the IP address registered in the exclusion list.

  When a plurality of private addresses are converted into one global address by the NAT function of the router 3 and a port number is assigned, the WAN side of the router 3 is a transmission source of packets transmitted from the maintenance device 2 and the IP telephone 4 Since the IP address is converted to the same global address “2.2.2.2”, whether the captured packet is a maintenance packet to be excluded (a packet transmitted and received by the maintenance device 2) only with the source IP address It cannot be determined whether or not. Further, the address of the remote maintenance base 50 (in FIG. 1, “1.1.1.1” attached to the network 100 side of the router 53) is registered in the exclusion list, and the transmission destination IP address is “1.1. Although the packet for maintenance can be excluded by excluding the packet “1.1”, it is experimental between the IP telephone 52 arranged at the remote maintenance base 50 and the IP telephone 4 arranged at the user's house. When performing data communication, it is impossible to capture the test packet. Therefore, by registering not only the IP address but also the pair of the IP address and the port number in the exclusion list, it is possible to determine whether or not the packet is transmitted and received by the maintenance device 2.

  In order to identify the port number assigned to the maintenance device 2 on the LAN side of the router 3, the filter unit 12 detects the packet transmitted by the maintenance device 2 and excludes the combination of the transmission source IP address and the port number of the packet. Register with. The detection of the packet transmitted by the maintenance device 2 is performed by the maintenance device 2 transmitting a packet having a specific bit string and detecting a packet having the specific bit string from the packets captured by the capture unit 11. Although the router 3 cannot know in advance the port number assigned to the maintenance device 2, the maintenance device 2 transmits a packet having a specific bit string to the network 100 side, so that the filter unit 12 has a packet having a specific bit string. The packet transmitted from the maintenance device 2 can be grasped, and the port number assigned to the maintenance device 2 can be known from the packet.

  The packet capture data stored in the storage unit 13 is transmitted to the remote maintenance base 50 via the network 100. At this time, the maintenance device 2 may read the capture data from the storage unit 13 and transmit it to the remote maintenance base 50.

  Next, the exclusion list registration process will be described. FIG. 2 is a flowchart showing a flow of processing for registering an exclusion target IP address and a combination of an IP address and a port number in an exclusion list before starting packet capture. After the maintenance person installs the capture device 1 and the maintenance device 2 at the user's home, the capture device 1 performs an exclusion list registration process.

  First, the IP address assigned to the maintenance device 2 is registered in the exclusion list (step S1). When the capture device 1 is installed on the LAN side of the router 3 or when the router 3 does not use the NAT function, the packet transmitted and received by the maintenance device 2 that does not need to be stored by registering the IP address of the maintenance device 2 in the exclusion list Can be excluded.

  Subsequently, the maintenance device 2 sends a packet having a specific bit string to the remote maintenance site 50 (step S2). The specific bit string is not data having regularity such as “0000...”, “FFFF...” Or “1234...” Used for padding, but is a unique bit string or a random bit string. The data length is arbitrary as long as the MTU (Maximum Transmission Unit) of the packet does not exceed the MTU of the line.

  Then, the capture device 1 captures the packet having the specific bit string transmitted from the maintenance device 2, and registers the combination of the transmission source IP address and the port number of the packet in the exclusion list (step S3). The maintenance device 2 may transmit one packet having a specific bit string, but may transmit a plurality of packets when there is a concern about packet loss or the presence of similar packets. In that case, the bit string of each packet may be different. For example, when the maintenance device 2 sends two packets, if the first packet is lost and only the second packet can be captured, the capture device 1 detects the second packet. The port number assigned to the maintenance device 2 can be specified.

  Thereafter, the capture device 1 starts capturing packets (step S4).

  FIG. 3 is a block diagram showing a configuration of another packet capture system in the present embodiment. The packet capture system 7 shown in the figure is provided with a capture function 71 and a maintenance function 72 in one apparatus. The capture function 71 has the same function as the capture device 1 shown in FIG. 1, and the maintenance function 72 has the same function as the maintenance device 2 shown in FIG. That is, the packet capture system 7 is configured by integrating the capture device 1 and the maintenance device 2 shown in FIG. By integrating the capture device 1 and the maintenance device 2, the device can be handled easily.

  In FIG. 3, the capture function 71 is connected to the WAN side of the router 3, and the maintenance function 72 is connected to the LAN side of the router 3. By providing an exclusion list in which a combination of an IP address and a port number is described as a condition for not capturing a packet, even when capture data of a packet accumulated by the capture function 71 is transmitted via the maintenance function 72, it is used for the communication. Can be set not to accumulate packets. Similarly to the packet capture system shown in FIG. 1, the maintenance function 72 transmits a packet having a specific bit string, and the capture function 71 detects a packet having the specific bit string, whereby the router 3 performs the maintenance function 72. Even when the address attached to is converted, the IP address and port number of the packet transmitted and received by the maintenance function 72 can be specified.

  Therefore, according to the present embodiment, even when the maintenance device 2 is installed inside the NAT and the capture device 1 is installed outside the NAT, the maintenance device 2 transmits a packet having a specific bit string and captures it. When the device 1 detects a packet having a specific bit string, the port number assigned to the maintenance device 2 by the router 3 can be specified. Therefore, the maintenance device 2 can be registered by registering the specified IP address and port number in the exclusion list. It is possible to exclude maintenance packets transmitted and received from the capture target.

  According to the present embodiment, the maintenance device 2 transmits a packet having a specific bit string, and the capture device 1 detects a packet having the specific bit string, thereby to which side of the capture point to which the capture device 1 is connected. It is possible to identify whether the maintenance device 2 exists.

  In this embodiment, IP addresses that are not captured are registered in the exclusion list. However, IP addresses that are captured may be registered.

DESCRIPTION OF SYMBOLS 1 ... Capture apparatus 2 ... Maintenance apparatus 3 ... Router 4 ... IP telephone 11 ... Capture part 12 ... Filter part 13 ... Storage part 50 ... Remote maintenance base 51 ... Terminal 52 ... IP telephone 53 ... Router 7 ... Packet capture system 71 ... Capture Function 72 ... Maintenance function 100 ... Network

Claims (2)

A packet cab system comprising a maintenance device remotely operated over a wide area network and a capture device for collecting and storing packets;
The capture device includes:
Capture means for collecting packets flowing through the network;
Filter means for selecting packets collected by the capture means with reference to a list in which a set of network address and port number is registered;
Storing means for storing the packets selected by the filter means,
The packet capturing system, wherein the filter unit detects a packet having a specific bit string transmitted from the maintenance device and registers a set of a transmission source network address and a port number of the packet in the list. A packet carburetion method by a maintenance device remotely operated via a wide area network and a capture device for collecting and storing packets,
According to the maintenance device,
Sending a packet having a specific bit string;
According to the capture device,
Collecting packets flowing through the network;
Detecting a packet having the specific bit string and registering a set of a source network address and a port number of the packet in a list in which a set of a network address and a port number is registered;
Screening packets collected with reference to the list;
A step of storing the packet selected in the step of selecting,
A packet capture method comprising:

Images