Device and method for monitoring communication in network including a plurality of nodes

Patent metadata

Field	Value
Publication number	US-9942123-B2
Application number	US-201615060680-A
Country	US
Kind code	B2
Filing date	Mar 4, 2016
Priority date	Mar 13, 2015
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

A communication monitoring device is used in a network that includes a plurality of nodes. The communication monitoring device includes: a plurality of ports; and a processor. The processor is configured to execute a procedure including: detecting an abnormal frame from among received frames, a first arrival port at which the abnormal frame has arrived, and an order in which the abnormal frame arrived in received frames that have arrived at any of the plurality of ports, and transmitting order information that indicates the detected order to a node connected to the first arrival port.

First claim

What is claimed is:

1. A communication monitoring device used in a network that includes a plurality of nodes, the communication monitoring device comprising:
a plurality of ports;
a history memory that records therein arrival port identifiers, each of the arrival port identifiers indicating a port at which a data frame has arrived, in the order of arrival of the data frames; and
a processor configured to execute a procedure including:
adding, when a data frame arrives at the communication monitoring device, an arrival port identifier that indicates a port at which the data frame has arrived to the history memory,
detecting, when the data frame is an abnormal frame, an order in which the abnormal frame arrived among received data frames that have arrived at any of the plurality of ports,
deciding a first arrival port at which the abnormal frame has arrived by searching the history memory using the detected order,
generating a search frame including order information that indicates the detected order and a search instruction that instructs to search for a source node of the abnormal frame,
transmitting the search frame to a node connected to the first arrival port, wherein

the search instruction requests the node that receives the search frame to perform a process of identifying, according to the order information stored in the search frame, a second arrival port at which the abnormal frame has arrived from among a plurality of ports provided in the node that receives the search frame, a process of adding port information that indicates the second arrival port to the search frame, and a process of transmitting the search frame to which the port information is added to the communication monitoring device and a node connected to the second arrival port, and
the processor identifies the source node of the abnormal frame according to the port information added to the search frame when the communication monitoring device receives the search frame.

2. The communication monitoring device according to claim 1 , wherein
the order information indicates an order in which the abnormal frame arrived with respect to a latest received frame.

3. The communication monitoring device according to claim 1 , wherein
the order information indicates an order in which the abnormal frame arrived with respect to a received frame that is specified in advance.

4. A non-transitory computer-readable recording medium having stored therein a communication monitoring program for causing a processor to execute a communication monitoring process, the processor being provided in a communication monitoring device that has a plurality of ports and that is used in a network including a plurality of nodes, the process comprising:
adding, when a data frame arrives at the communication monitoring device, an arrival port identifier that indicates a port at which the data frame has arrived to the history memory that records therein arrival port identifiers, each of the arrival port identifiers indicating a port at which a data frame has arrived, in the order of arrival of the data frames;
detecting, when the data frame is an abnormal frame, an order in which the abnormal frame arrived among received data frames that have arrived at any of the plurality of ports;
deciding a first arrival port at which the abnormal frame has arrived by searching the history memory using the detected order;
generating a search frame including order information that indicates the detected order and a search instruction that instructs to search for a source node of the abnormal frame; and
transmitting the search frame to a node connected to the first arrival port, wherein
the search instruction requests the node that receives the search frame to perform a process of identifying, according to the order information stored in the search frame, a second arrival port at which the abnormal frame has arrived from among a plurality of ports provided in the node that receives the search frame, a process of adding port information that indicates the second arrival port to the search frame, and a process of transmitting the search frame to which the port information is added to the communication monitoring device and a node connected to the second arrival port, and
the process further includes identifying the source node of the abnormal frame according to the port information added to the search frame when the communication monitoring device receives the search frame.

5. A communication monitoring method used in a network that includes a plurality of terminal devices, a plurality of hub devices that relay a data frame between the plurality of terminal devices, and a communication monitoring device that monitors communication performed by the plurality of terminal devices, wherein
the communication monitoring device and the plurality of hub devices respectively have a history memory that records therein arrival port identifiers, each of the arrival port identifiers indicating a port at which a frame has arrived, in the order of arrival of data frames,
the communication monitoring device detects an abnormal frame from among the data frames that have arrived at the communication monitoring device,
the communication monitoring device detects an order in which the abnormal frame arrived, and identifies a first arrival port at which the abnormal frame has arrived at the communication monitoring device by referring to the history memory provided in the communication monitoring device using the detected order,
the communication monitoring device transmits a search frame including order information that indicates the detected order to a node connected to the first arrival port,
a hub device that receives the search frame refers to the history memory of the hub device according to the order information included in the search frame to identify a second arrival port at which the abnormal frame has arrived at the hub device,
the hub device that receives the search frame adds port information that indicates the second arrival port to the search frame, and transmits the search frame to the communication monitoring device, and
the communication monitoring device identifies a source node of the abnormal frame according to the port information included in the search frame to which the port information has been added.

Assignees

• Fujitsu Ltd

Inventors

• Yajima Jun
• Hasebe Takayuki
• Takenaka Masahiko

Classifications

• H04L2012/40273

  the transportation system being a vehicle · CPC title

• H04L2012/40215

  Controller Area Network CAN · CPC title

• H04L12/40169 Primary

  Flexible bus arrangements (arrangements for maintenance or administration involving management of faults; events, alarms H04L41/06; automatic restoration of network faults H04L41/0654) · CPC title

• H04L43/12 Primary

  Network monitoring probes · CPC title