METHOD, APPARATUS, AND PACKET ANALYZING SYSTEM

• US 20160226725A1
• Filed: 02/01/2016
• Published: 08/04/2016
• Est. Priority Date: 02/04/2015
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Iizuka, Fumiyuki, OHKAWA, NAOYOSHI, NOMURA, Yuji
• Granted Patent: US 9,866,453 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method includes receiving a first packet, the first packet being including a first packet identifier and a first error detection code, storing first information indicating the first packet identifier and second information indicating the first error detection code, receiving a second packet, the second packet being including a second packet identifier and a second error detection code, comparing the second packet identifier and the second error detection code with the first information and the second information, respectively, in response to a determination that the second packet identifier corresponds to the first information and the second error detection code corresponds to the second information, discarding the second packet, in response to a determination that at least one the second packet identifier and the second error detection code does not correspond to the first information and the second information, providing the first packet and the second packet for a packet analysis.

Claims

1. A method comprising:

receiving a first packet, the first packet being transmitted from a first packet capture point in a network, the first packet including a first packet identifier and a first error detection code (EDC);

storing first information indicating the first packet identifier and second information indicating the first EDC;

receiving a second packet, the second packet being transmitted from a second capturing point in the network, the second packet including a second packet identifier and a second EDC;

comparing the second packet identifier and the second EDC with the first information and the second information, respectively; and

in response to a determination according to the comparing that the second packet identifier corresponds to the first information and the second EDC corresponds to the second information, discarding the second packet, and in response to a determination according to the comparing that at least any one the second packet identifier or the second EDC does not correspond to either of the first information or the second information, providing the first and second packets for a packet analysis.

2. The method according to claim 1, further comprising:

storing third information indicating the second packet identifier and fourth information indicating the second EDC in response to the providing the first and second packets for the packet analysis, to thereby subsequently perform the comparing including the third and fourth information.

3. The method according to claim 1, wherein the storing the first information and the second information comprises

allocating a first set of memory regions in a storage unit, the first set of memory regions including a first memory region and a second memory region, the first memory region including a plurality of areas configured to store a plurality of packet identifiers including the first information, and the second memory region including a plurality of areas configured to store a plurality of EDCs including the second information,

wherein

the determination according to the comparing determines that the second packet identifier corresponds to the first information, when the first information is stored in a first area of the first memory region which corresponds to the second packet identifier, and

the determination according to the comparing determines that the second EDC corresponds to the second information, when the second information is stored in a second area of the second memory region which corresponds to the second EDC.

4. The method according to claim 3, wherein

the first area of the first memory region is an area indicated by an address obtained by adding the second packet identifier to a leading address of the allocated first memory region, and

the second area of the second memory region is an area indicated by an address obtained by adding the second EDC to a leading address of the allocated second memory region.

5. The method according to claim 3, further comprising:

allocating other sets of memory regions in the storage unit at a certain timing; and

deleting, from the storage unit, a set of memory regions from among the sets of memory regions when a certain time period elapses after the set of memory regions is allocated, wherein

a second set of memory regions which has been allocated just before from among the sets of memory regions is selected,

it is determined that the second packet identifier corresponds to the first information, when the first information is stored in a third area of the first memory region included in the first set of memory regions which corresponds to the second packet identifier, and

it is determined that the second error detection code corresponds to the first error detection code, when the second information is stored in a fourth area of the second memory region included in the first set of memory regions which corresponds to the second error detection code.

6. The method according to claim 5, further comprising:

selecting a third set of memory regions from the sets of memory regions when it is determined that the second packet identifier does not correspond to the first information or when it is determined that the second EDC does not correspond to the second information; and

discarding the second packet when the first information is stored in a fifth area corresponding to the first information, among the plurality of areas included in a fifth memory region of the second set of memory regions, and when the second information is stored in a sixth area corresponding to the second information, among the plurality of areas included in the sixth memory region of the second set of memory regions.

7. The method according to claim 1, further comprising:

determining whether a plurality of packet identifiers of a plurality of packets including the first packet and the second packet are random identifiers which vary randomly, when a communication session is initiated,

wherein the comparing is performed in response to the determining that the packet identifiers are random identifiers.

8. The method according to claim 7, wherein the plurality of packet identifiers include numeric values, the method further comprising:

receiving the plurality of packets;

storing the plurality of packets in the storage unit in an order of receiving; and

determining the plurality of packet identifiers are the random identifiers, when values of a plurality of packet identifiers included in the plurality of packets are not continuously increased in the order of receiving.

9. The method according to claim 8, wherein

it is determined that the packet identifiers are the random identifiers, when the values of the plurality of packet identifiers included in the plurality of packets are not continuously increased in the order of receiving and when a third packet identifier of a third packet is greater than the second packet identifier, the third packet being captured before a certain pieces of packets based on the second packet identifier of the second packet included in the plurality of packets.

10. The method according to claim 3, further comprising:

specifying a communication session of the packet based on a session identifier for specifying the communication session included in the packet;

determining whether fifth information corresponding to the communication session identifier and the third information are stored in the storage unit, and determining whether the fourth information and the fifth information are stored in the storage unit; and

storing the third information and the fifth information in the storage unit when the third information and the fifth information have not been stored in the storage unit, and storing the fourth information and the fifth information in the storage unit when the fourth information and the fifth information have not been stored in the storage unit.

11. An apparatus comprising:

a memory; and

a processor coupled to the memory and configured to

receive a first packet, the first packet being transmitted from a first packet capture point in a network and the first packet being including a first packet identifier and a first error detection code,

store first information indicating the first packet identifier and second information indicating the first error detection code,

receive a second packet, the second packet being transmitted from a second capturing point in the network and the second packet being including a second packet identifier and a second error detection code,

compare the second packet identifier and the second error detection code with the first information and the second information, respectively, and

in response to a determination that the second packet identifier corresponds to the first information and the second error detection code corresponds to the second information, discard the second packet, and in response to a determination that at least one the second packet identifier and the second error detection code does not correspond to the first information and the second information, provide the first packet and the second packet for a packet analysis.

12. A packet analyzing system which analyzes a plurality of packets, the system comprising:

a packet analyzing device;

a duplicate packet detection device;

a first switching device; and

a second switch device,

wherein

the first switching device is configured to

perform a first relay processing of a first packet, and

transmit a first copied packet including a first packet identifier and a first error detection code obtained by copying the first packet to the duplicate packet detection apparatus,

the second switching device is configured to

perform a second relay processing of the first packet, and

transmit a second copied packet including a second packet identifier and a second error detection code obtained by copying the first packet to the duplicate packet detection apparatus,

the duplicate packet detection device is configured to

receive the first copied packet,

store first information indicating the first packet identifier and second information indicating the first error detection code,

receive the second copied packet,

compare the second packet identifier and the second error detection code with the first information and the second information, respectively,

in response to a determination that the second packet identifier corresponds to the first information and the second error detection code corresponds to the second information, discard the second copied packet, and in response to a determination that at least one the second packet identifier and the second error detection code does not correspond to the first information and the second information, transmit the first copied packet to the packet analyzing device, and

the packet analyzing device is configured to

perform a packet analyzing using the first copied packet.