PACKET MONITORING METHOD, PACKET MONITORING APPARATUS, AND STORAGE MEDIUM

• US 20160036680A1
• Filed: 05/20/2015
• Published: 02/04/2016
• Est. Priority Date: 07/30/2014
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: MIYAZAKI, Keiji
• Application Number:
  US14/717,337
• Publication Number:
  US 20160036680A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 30/0627 using item specifications
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A packet monitoring method includes storing acquisition time indicating time when a packet including the transmission source information and the destination information is obtained lastly, and a first counter value into a first memory, in association with a combination of transmission source information and destination information of a plurality of packets; receiving a first packet; extracting acquisition time associated with a combination of transmission source information and destination information included in the first packet from the first memory; determining whether a time period from the extracted acquisition time to acquisition time of the first packet is shorter than a predetermined time; and increasing the first counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.

Claims

1. A packet monitoring method executed by a packet monitoring apparatus, the packet monitoring method comprising:

storing acquisition time indicating time when a packet including the transmission source information and the destination information is obtained lastly, and a first counter value into a first memory, in association with a combination of transmission source information and destination information of a plurality of packets;

receiving a first packet;

extracting acquisition time associated with a combination of transmission source information and destination information included in the first packet from the first memory;

determining whether a time period from the extracted acquisition time to acquisition time of the first packet is shorter than a predetermined time; and

increasing the first counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.

2. The packet monitoring method according to claim 1, further comprising:

storing a second counter value into the first memory, in association with a combination of transmission source information and destination information of a packet; and

increasing the second counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is equal to or longer than the predetermined time.

3. The packet monitoring method according to claim 1, further comprising:

storing a third counter value into a second memory in association with a uniform resource identifier (URI); and

increasing the third counter value stored in the second memory and associated with the URI included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.

4. The packet monitoring method according to claim 3, further comprising:

storing a fourth counter value in association with the URI into a second data storage unit; and

increasing the fourth counter value stored in the second data storage unit and associated with the URI included in the first packet by a predetermined value when it is determined that the time period is equal to or longer than the predetermined time.

5. The packet monitoring method according to claim 3, further comprising:

calculating a value by dividing the fourth counter value by a sum of the third counter value and the fourth counter value; and

storing the calculated value into the second memory.

6. The packet monitoring method according to claim 1, wherein

the storing into the first memory includes storing the acquisition time into the first memory in association with a combination of packet transmission source information of and destination information and a URI,

the extracting includes extracting acquisition time associated with transmission source information and destination information included in the first packet, and a URI.

7. The packet monitoring method according to claim 1, further comprising:

storing time when the first packet is obtained, and an initial value of the first counter into the first memory in association with a combination of transmission source information and destination information included in the first packet when there are no combinations of transmission source information and destination information included in the first packet in the first memory.

8. The packet monitoring method according to claim 1, further comprising:

changing the predetermined time in accordance with a protocol identifier included in the first packet.

9. A packet monitoring apparatus comprising:

a first memory configured to store, in association with a combination of transmission source information and destination information of a plurality of packets, acquisition time indicating time when a packet including the transmission source information and the destination information is obtained lastly, and a first counter value; and

a processor coupled to the first memory and configured to;

receive a first packet,

extract acquisition time associated with a combination of transmission source information and destination information included in the first packet from the first memory,

determine whether a time period from the extracted acquisition time to acquisition time of the first packet is shorter than a predetermined time, and

increase the first counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.

10. The packet monitoring apparatus according to claim 9, wherein the processor is further configured to:

store a second counter value into the first memory, in association with a combination of transmission source information and destination information of a packet; and

increase the second counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is equal to or longer than the predetermined time.

11. The packet monitoring apparatus according to claim 9, wherein the processor is further configured to:

store a third counter value into a second memory in association with a uniform resource identifier (URI); and

increase the third counter value stored in the second memory and associated with the URI included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.

12. The packet monitoring apparatus according to claim 11, wherein the processor is further configured to:

store a fourth counter value in association with the URI into a second data storage unit; and

increase the fourth counter value stored in the second data storage unit and associated with the URI included in the first packet by a predetermined value when it is determined that the time period is equal to or longer than the predetermined time.

13. The packet monitoring apparatus according to claim 11, wherein the processor is further configured to:

calculate a value by dividing the fourth counter value by a sum of the third counter value and the fourth counter value; and

store the calculated value into the second memory.

14. A non-transitory computer-readable storage medium storing a program that causes one or more processors included in a computer to execute a process, the computer including a first memory configured to store acquisition time indicating time when a packet including the transmission source information and the destination information is obtained lastly, and a first counter value, in association with a combination of transmission source information and destination information of a plurality of packets, the process comprising:

receiving a first packet,

extracting acquisition time associated with a combination of transmission source information and destination information included in the first packet from the first memory,

determining whether a time period from the extracted acquisition time to acquisition time of the first packet is shorter than a predetermined time, and

increasing the first counter value stored in the first memory and associated with the combination of transmission source information and destination information included in the first packet by a predetermined value when it is determined that the time period is shorter than the predetermined time.