Apparatus and method to collect packets related to abnormal connection

• US 10,305,754 B2
• Filed: 11/04/2016
• Issued: 05/28/2019
• Est. Priority Date: 12/03/2015
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Iizuka, Fumiyuki, Nomura, Yuji
• Primary Examiner(s): Katsikis, Kostas J
• Application Number:
  US15/343,581
• Publication Number:
  US 20170163499A1
• Time in Patent Office: 935 Days
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

An apparatus allocates a packet-identifier to each packet captured from a network, and stores the each packet in a buffer. The apparatus associates, with each of the packet-identifiers, a connection-identifier specifying a connection of a packet identified by the each packet-identifier, and detects a connection to which a primary abnormality is occurring by analyzing packets stored in the buffer. The apparatus stores, for each connection to which the primary abnormality has occurred, a primary-abnormality group of packets to which the packet-identifiers associated with the connection-identifier of the each connection are allocated, in a first storage-region, detects a connection to which a secondary abnormality is occurring, based on a statistical value related to results of analyses on packets captured in a sampling duration, and writes, in a second storage-region, packets related to connections to which the secondary abnormality has occurred, among the primary-abnormality groups stored in the first storage-region.

Claims

1. A method performed by a computer, the method comprising:

allocating a packet identifier to each of packets captured from a network, and storing the each packet in a buffer;

associating, with each of the packet identifiers, a connection identifier specifying a connection for a packet identified by the each packet identifier;

detecting a connection to which a primary abnormality is occurring by analyzing packets stored in the buffer;

storing, for each of connections to which the primary abnormality has occurred, a primary-abnormality group of packets to which the packet identifiers associated with the connection identifier of the each connection are allocated, in a first storage region;

detecting a connection to which a secondary abnormality is occurring, based on a statistical value related to results of analyses on packets captured in a sampling duration; and

writing, in a second storage region, secondary-abnormality groups of packets related to connections to which the secondary abnormality has occurred, among the primary-abnormality groups of packets stored in the first storage region.

2. The method of claim 1, further comprising

deleting, from the first storage region, the secondary-abnormality groups of packets and groups of packets related to connections to which no secondary abnormality has occurred.

3. The method of claim 1, wherein

the primary abnormality is an abnormality detected before detection of the secondary abnormality in an identical connection.

4. A non-transitory, computer-readable recording medium having stored therein a program for causing a computer to execute a process comprising:

allocating a packet identifier to each of packets captured from a network, and storing the each packet in a buffer;

associating, with each of the packet identifiers, a connection identifier specifying a connection for a packet identified by the each packet identifier;

detecting a connection to which a primary abnormality is occurring by analyzing packets stored in the buffer;

storing, for each of connections to which the primary abnormality has occurred, a primary-abnormality group of packets to which the packet identifiers associated with the connection identifier of the each connection are allocated, in a first storage region;

detecting a connection to which a secondary abnormality is occurring, based on a statistical value related to results of analyses on packets captured in a sampling duration; and

writing, in a second storage region, secondary-abnormality groups of packets related to connections to which the secondary abnormality has occurred, among the primary-abnormality groups of packets stored in the first storage region.

5. An apparatus comprising:

a memory including a buffer, a first storage region, and a second storage region; and

a processor coupled to the memory and configured to;

allocate a packet identifier to each of packets captured from a network, and store the each packet in the buffer,

associate, with each of the packet identifiers, a connection identifier specifying a connection for a packet identified by the each packet identifier,

detect a connection to which a primary abnormality is occurring by analyzing packets stored in the buffer,

store, for each of connections to which the primary abnormality has occurred, a primary-abnormality group of packets to which the packet identifiers associated with the connection identifier of the each connection are allocated, in the first storage region,

detect a connection to which a secondary abnormality is occurring, based on a statistical value related to results of analyses on packets captured in a sampling duration, and

write, in the second storage region, secondary-abnormality groups of packets related to connections to which the secondary abnormality has occurred, among the primary-abnormality groups stored in the first storage region.