APPARATUS AND METHOD FOR MONITORING COMMUNICATION

• US 20140297699A1
• Filed: 03/04/2014
• Published: 10/02/2014
• Est. Priority Date: 03/27/2013
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Fujishima, Yuki, Morinaga, Masanobu
• Granted Patent: US 9,645,759 B2
• Time in Patent Office: Days
• US Class Current: 707/827
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0643 Management of files
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 3/0689 Disk arrays, e.g. RAID, JBOD

Abstract

An apparatus acquires a packet transmitted according to a protocol employing block access, from a communication network, and determines which one of a system attribution block storing stores file system attribution data, a file attribution block storing file attribution data, and a file name block storing file name data the packet is related to. The apparatus calculates a block number of the file attribution block, based on addresses provided to the system and file attribution blocks, when the packet is determined to be related to the file attribution block. The apparatus calculates an identification number of each piece of the file attribution data, based on the system attribution data and the calculated block number, and associates file attribution data stored in the file attribution block with file name data stored in the file name block, based on the calculated identification numbers and identification numbers provided to the file name data.

Claims

1. A method for monitoring communication, the method comprising:

an acquisition process of acquiring a communication packet that is transmitted according to a protocol employing block access, from a communication network;

a determination process of determining which one of a system attribution block, a file attribution block, and a file name block the communication packet is related to, the system attribution block storing file system attribution data representing an attribution of a file system, the file attribution block storing plural pieces of file attribution data representing an attribution of a file, the file name block storing plural pieces of file name data representing a name of the file;

a first calculation process of calculating a block number of the file attribution block, based on a first address that is provided to the system attribution block and a second address that is provided to the file attribution block, when the communication packet is determined to be related to the file attribution block;

a second calculation process of calculating an identification number of each piece of the file attribution data, based on the system attribution data and the calculated block number; and

a first association process of associating plural pieces of file attribution data that are stored in the file attribution block with plural pieces of file name data that are stored in the file name block, respectively, based on the calculated identification numbers and identification numbers that are provided to the plural pieces of file name data.

2. The method of claim 1, further comprising:

a second association process of associating the file name data with a command file, based on first time stamps of the plural pieces of file name data associated with the plural pieces of file attribution data, and second time stamps of the command file that has caused the file name data to flow into the communication network.

3. The method of claim 2, wherein

the second association process is performed based on file sizes of two files on which an operation of the command file has been performed.

4. The method of claim 2, wherein

the first time stamps includes at least one of a time stamp related to access time, a time stamp related to modify time, and a time stamp related to change time.

5. An apparatus for monitoring communication, the apparatus comprising:

a processor configured;

to acquire a communication packet that is transmitted according to a protocol employing block access, from a communication network,

to determine which one of a system attribution block, a file attribution block, and a file name block the communication packet is related to, the system attribution block storing file system attribution data representing an attribution of a file system, the file attribution block storing plural pieces of file attribution data representing an attribution of a file, the file name block storing a plurality of pieces of file name data representing a name of the file,

to calculate a block number of the file attribution block, based on a first address that is provided to the system attribution block and a second address that is provided to the file attribution block, when the communication packet is determined to be related to the file attribution block,

to calculate an identification number of each piece of the file attribution data, based on the system attribution data and the calculated block number, and

to associate plural pieces of file attribution data that are stored in the file attribution block with plural pieces of file name data that are stored in the file name block, respectively, based on the calculated identification numbers and identification numbers that are provided to the plural pieces of file name data; and

a memory configured to store the system attribution block, the file attribution block, and the file name block.

6. The apparatus of claim 5, wherein

the processor associates the file name data with a command file, based on first time stamps of the plural pieces of file name data associated with the plural pieces of file attribution data, and second time stamps of the command file that has caused the file name data to flow into the communication network.

7. The apparatus of claim 6, wherein

the processor associates the file name data with the command file, based on file sizes of two files on which an operation of the command file has been performed.

8. The apparatus of claim 6, wherein

the first time stamps includes at least one of a time stamp related to access time, a time stamp related to modify time, and a time stamp related to change time.

9. A non-transitory computer-readable recording medium stored therein a program for causing a computer to execute a procedure comprising:

an acquisition process of acquiring a communication packet that is transmitted according to a protocol employing block access, from a communication network;

a determination process of determining which one of a system attribution block, a file attribution block, and a file name block the communication packet is related to, the system attribution block storing file system attribution data representing an attribution of a file system, the file attribution block storing plural pieces of file attribution data representing an attribution of a file, the file name block storing a plurality of pieces of file name data representing a name of the file;

a first calculation process of calculating a block number of the file attribution block, based on a first address that is provided to the system attribution block and a second address that is provided to the file attribution block, when the communication packet is determined to be related to the file attribution block;

a second calculation process of calculating an identification number of each piece of the file attribution data, based on the system attribution data and the calculated block number; and

a first association process of associating plural pieces of file attribution data that are stored in the file attribution block with plural pieces of file name data that are stored in the file name block, respectively, based on the calculated identification numbers and identification numbers that are provided to the plural pieces of file name data.

10. The non-transitory computer-readable recording medium of claim 9, wherein the procedure further including:

a second association process of associating the file name data with a command file, based on first time stamps of the plural pieces of file name data associated with the plural pieces of file attribution data, and second time stamps of the command file that has caused the file name data to flow into the communication network.

11. The non-transitory computer-readable recording medium of claim 10, wherein

the second association process is performed based on file sizes of two files on which an operation of the command file has been performed.

12. The non-transitory computer-readable recording medium of claim 10, wherein

the first time stamps includes at least one of a time stamp related to access time, a time stamp related to modify time, and a time stamp related to change time.