Network inspection apparatus, network inspection method, and storage medium

Patent metadata

Field	Value
Publication number	US-10038600-B2
Application number	US-201515325495-A
Country	US
Kind code	B2
Filing date	Jul 13, 2015
Priority date	Jul 23, 2014
Publication date	Jul 31, 2018
Grant date	Jul 31, 2018

Abstract

Provided is an apparatus including: inspection target network information acquisition unit that acquires a transfer rule at a switch and physical network topology information about an inspection target network; backtrace function generation unit that generates, based on the transfer rule, a backtrace function that calculates a packet pattern of a packet being input to a port of a switch; physical link path acquisition unit that acquires, based on the physical network topology information and the transfer rule, a physical link path representing a series of ports from an incoming port to an outgoing port; backtrace function application unit that calculates a packet pattern at the incoming port of a packet that reaches the outgoing port, by sequentially applying the backtrace function with using a packet pattern cache storing the packet pattern at an intermediate port in the physical link path; and inspection result output unit that provides a processing result.

First claim

What is claimed is:

1. A network inspection apparatus comprising a processing circuitry and a memory, the processing circuitry being configured to:
acquire a transfer rule for a packet at each switch in an inspection target network and physical network topology information about the inspection target network;
generate, based on the transfer rule, a backtrace function that calculates backward, from a packet pattern of a packet that is output from a port of the switch, a packet pattern of a packet that is input to a port, being corresponding to the port from which a packet is output, of the switch;
acquire, based on the physical network topology information and the transfer rule, a physical link path that represents a series of ports that links an incoming port of the switch to an outgoing port of the switch, the incoming port being a port of the switch through which a packet being transferred from an external network flows into the inspection target network, the outgoing port being a port of the switch from which a packet being transferred from the inspection target network to an external network flows out;
calculate a packet pattern at the incoming port of a packet that reaches the outgoing port, by sequentially applying the backtrace function from the outgoing port toward the incoming port, while using a packet pattern cache that stores, in the memory, a packet pattern at an intermediate port on the physical link path of the packet that reaches the outgoing port from the intermediate port; and
provide the packet pattern at the incoming port being calculated.

2. The network inspection apparatus according to claim 1 , wherein the processing circuitry further being configured to:
when executing a packet pattern calculation processing, which includes
accepting, as an input, information that represents an input port of the switch, and providing information that represents a packet pattern at the input port, by applying the backtrace function to a packet pattern of a packet being able to reach the outgoing port from an output port corresponding to the input port in the switch, at the output port,
reuse the packet pattern at the output port of the packet that reaches the outgoing port from the output port, when the packet pattern at the output port of the packet is stored in the packet pattern cache, and
recursively execute, in order to determine the packet pattern, the packet pattern calculation processing, by accepting, as input, information representing an input port of a next one of switches which faces the output port, and stores the packet pattern being provided by the packet pattern calculation processing into the packet pattern cache, when the packet pattern is not stored in the packet pattern cache.

3. The network inspection apparatus according to claim 2 , wherein the processing circuitry further being configured to:
when the transfer rule includes information representing an input port, information representing a condition (matching pattern) to which the packet pattern input to the input port conforms, information representing a processing content (action) for the packet pattern when the packet pattern conforms to the condition, and information representing an output port that outputs a packet pattern on which processing of the action being performed,
generate the backtrace function so that the backtrace function outputs a packet pattern that is input to the input port, based on the matching pattern and the action, by using the packet pattern at the output port as an input.

4. A network inspection method comprising:
acquiring a transfer rule regarding a packet at each switch in an inspection target network and physical network topology information about the inspection target network;
generating, based on the transfer rule, a backtrace function that calculates backward, from a packet pattern of a packet that is output from a port of the switch, a packet pattern of a packet that is input to a port, corresponding to the port from which a packet is output, of the switch;
acquiring, based on the physical network topology information and the transfer rule, a physical link path that represents a series of ports that links an incoming port of the switch to an outgoing port of the switch, the incoming port being a port of the switch through which a packet being transferred from an external network flows into the inspection target network, the outgoing port being a port of the switch from which a packet being transferred from the inspection target network to an external network flows out;
calculating a packet pattern at the incoming port of a packet that reaches the outgoing port, by sequentially applying the backtrace function from the outgoing port toward the incoming port while using a packet pattern cache that stores a packet pattern at an intermediate port on the physical link path of the packet that reaches the outgoing port from the intermediate port; and
providing the packet pattern at the incoming port of the packet that reaches the outgoing port.

5. A non-transitory computer readable storage medium storing a network inspection program that causes a computer apparatus to execute:
processing for acquiring a transfer rule regarding a packet at each switch in an inspection target network and physical network topology information about the inspection target network;
processing for generating, based on the transfer rule, a backtrace function that calculates backward, from a packet pattern of a packet that is output from a port of the switch, a packet pattern of a packet that is input to a port corresponding to the port from which a packet is output, of the switch;
processing for acquiring, based on the physical network topology information and the transfer rule, a physical link path that represents a series of ports that links an incoming port of the switch to an outgoing port of the switch, the incoming port being a port of the switch through which a packet being transferred from an external network flows into the inspection target network, the outgoing port being a port of a switch from which a packet being transferred from the inspection target network to an external flows out;
processing for calculating a packet pattern at the incoming port of a packet that reaches the outgoing port, by sequentially applying the backtrace function from the outgoing port toward the incoming port while using a packet pattern cache that stores a packet pattern at an intermediate port on the physical link path of the packet that reaches the outgoing port from the intermediate port; and
processing for providing the packet pattern at the incoming port being calculated.

Assignees

• Nec Corp

Inventors

• Tonouchi Toshio

Classifications

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title

• H04L43/18

  Protocol analysers · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L67/2842

  Electricity · mapped topic

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title