Network monitoring system

• US 20040117481A1
• Filed: 10/10/2003
• Published: 06/17/2004
• Est. Priority Date: 10/15/2002
• Status: Active Grant

• Current Assignee: Yamatake Corporation
• Original Assignee: Yamatake Corporation
• Inventors: Arimoto, Michiharu, Mishima, Takashi, Seki, Hidenobu, Komoriya, Yoshiaki, Sanai, Daiji
• Granted Patent: US 8,150,471 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

In a network monitoring system according, first, a data acquisition section acquires a plurality of packets flowing on a network. Then, a data analysis section acquires action explanation information for explaining a single action from the plural packets acquired by the data acquisition section. Then, a display-information generation section displays the single action on the network on the single screen based on the action explanation information acquired by this data analysis section.

Claims

1. A network monitoring system for monitoring a communication state on a network in which action explanation information for explaining a single action is divided into a plurality of packets, the network monitoring system comprising:

a data acquisition section for acquiring the plurality of packets flown on the network;

a data analysis section for acquiring the action explanation information from the plurality of packets acquired by the data acquisition section; and

a display-information generation section for generating display information, which is used to display the single action on the network on a single screen on the basis of the action explanation information acquired by the data analysis section.

2. The network monitoring system according to claim 1, wherein the action explanation information is defined in advance.

3. The network monitoring system according to claim 1, wherein the data analysis section identifies kinds of the packets acquired by the data acquisition section and acquires the action explanation information from the packets on the basis of the identified kinds of the packets.

4. The network monitoring system according to claim 1, wherein the action explanation information includes sending source computer information, destination computer information, and action information.

5. The network monitoring system according to claim 1, further comprising:

an analysis data storage section for storing the action explanation information acquired by the data analysis section, wherein;

the display-information generation section regenerates the display information used to playback and display the action explanation information stored by the analysis data storage section in response to a request of a user.

6. The network monitoring system according to claim 5, wherein:

the action explanation information stored by the analysis data storage section includes time information, which corresponds to time at which the single action was performed; and

the display-information generation section regenerates the display information used to playback and display the action explanation information stored by the analysis data storage section in accordance with the time information, in response to a request of a user.

7. The network monitoring system according to claim 5, wherein the display-information generation section continuously plays back and displays the action explanation information stored by the analysis data storage section at the same time interval to an accuracy of 500 msec as the action was executed, in response to a request of a user.

8. The network monitoring system according to claim 1, wherein the display-information generation section extracts and generates the display information in accordance with display setting by a user.

9. A network monitoring method for monitoring a communication state on a network in which action explanation information for explaining a single action is divided into a plurality of packets, the method comprising:

acquiring the plurality of packets flown on the network;

acquiring the action explanation information from the plurality of acquired packets; and

generating display information, which is used to display the single action on the network on a single screen on the basis of the acquired action explanation information.

10. The network monitoring method according to claim 9, wherein the action explanation information is defined in advance.

11. The network monitoring method according to claim 9, wherein in the acquisition of the action explanation information, kinds of the packets acquired by the packet acquisition are identified and the action explanation information is acquired from the packets on the basis of the identified kinds of the packets.

12. The network monitoring method according to claim 9, wherein the action explanation information includes sending source computer information, destination computer information, and action information.

13. The network monitoring method according to claim 9, further comprising:

storing the acquired action explanation information, wherein;

in the generation of the display information, the display information is regenerated, the regenerated display information used to play back and display the stored action explanation information in response to a request of a user.

14. The network monitoring method according to claim 13, wherein:

the stored action explanation information includes time information, which corresponds to time at which the single action was performed; and

in the generation of the display information, the display information is regenerated, the regenerated display information used to play back and display the stored action explanation information in accordance with the time information in response to a request of a user.

15. The network monitoring method according to claim 13, further comprising continuously playing back and displaying the stored action explanation information at the same time interval to an accuracy of 500 msec as the action was executed in response to a request of a user.

16. The network monitoring method according to claim 9, wherein in the generation of the display information, the display information is extracted and generated in accordance with display setting by a user.

17. A network monitoring program for monitoring a communication state on a network in which action explanation information for explaining a single action is divided into a plurality of packets, the program making a computer perform a process comprising:

acquiring the plurality of packets flown on the network;

acquiring the action explanation information from the plurality of acquired packets; and

generating display information, which is used to display the single action on the network on a single screen on the basis of the acquired action explanation information.

18. The network monitoring program according to claim 17, wherein the action explanation information is defined in advance.

19. The network monitoring program according to claim 17, wherein in the acquisition of the action explanation information, kinds of the packets acquired by the packet acquisition are identified and the action explanation information is acquired from the packets on the basis of the identified kinds of the packets.

20. The network monitoring program according to claim 17, wherein the action explanation information includes sending source computer information, destination computer information, and action information.

21. The network monitoring program according to claim 17, wherein:

the process further comprises storing the acquired action explanation information; and

in the generation of the display information, the display information is regenerated, the regenerated display information used to play back and display the stored action explanation information in response to a request of a user.

22. The network monitoring method according to claim 21, wherein:

the stored action explanation information includes time information, which corresponds to time at which the single action was performed; and

in the generation of the display information, the display information is regenerated, the regenerated display information used to play back and display the stored action explanation information in accordance with the time information in response to a request of a user.

23. The network monitoring program according to claim 21, wherein the process further comprises:

continuously playing back and displaying the stored action explanation information at the same time interval to an accuracy of 500 msec as the action was executed in response to a request of a user.

24. The network monitoring program according to claim 17, wherein in the generation of the display information, the display information is extracted and generated in accordance with display setting by a user.