JPH0662013A - Communication state monitoring system - Google Patents

Abstract

(57) [Summary] [Object] The present invention relates to a communication status monitoring method for monitoring the communication status of a network, and even if the apparatus does not have a special management information reporting function, the management apparatus (monitoring function) It is intended to be able to be found from a device) with a simple configuration. [Configuration] An address management table 3 for registering a source address is provided in a relay device 1, and relay is performed when the relay device 1 for relaying a plurality of networks receives a frame and is registered in the address management table 3. on the other hand,
When it is not registered, an entry is added and registered, the newly added source address is notified to the management device 6, and the newly added source address is displayed.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication status monitoring system for monitoring the communication status of a network.

In recent years, with the increase in scale and complexity of computer networks, the function of managing / monitoring them has been required. Therefore, it is necessary to be able to see the status of the entire network from one monitoring device.

[0003]

2. Description of the Related Art A conventional network monitoring device communicates with individual devices (for example, terminals and workstations) to be monitored, grasps the state of each device to be monitored from reported information, and Was adopted to display the status of the entire network.

On the other hand, in a distributed network such as a LAN (local area network), it is physically said that "a terminal / WS that is not registered and managed is arbitrarily connected to a transmission line without permission to participate in communication". Therefore, there is an increasing demand for monitoring such unauthorized communication.

However, the conventional network monitoring device is
Since it is premised that the device to be monitored communicates management information with the monitoring device, it is impossible to monitor a device that does not make such a report.

[0006]

Therefore, conventionally, since only a device having a function of reporting management information can be monitored, a device not having such a function is arbitrarily connected to the network without permission to perform communication. There was a problem that the surveillance device could not be seen even when going.

In order to solve this problem, the present invention enables even a device having no special management information reporting function to be found from a management device (monitoring device) by a simple configuration if it communicates. Is intended.

[0008]

[Means for Solving the Problems] Means for solving the problems will be described with reference to FIG. In FIG. 1, the relay device 1 relays a frame to another network and relays the received frame when the received frame is registered in the address management table 3, and on the other hand, when the received frame is not registered, an entry is made. Is added and registered, and the management device 6 is notified of the newly added source address.

The address management table 3 is for registering the number of frames, the number of bytes, etc. in association with the source address. The management device 6 monitors the state of the network, receives a notification of a new source address added from the relay device 1 and displays it, and periodically or arbitrarily instructs transmission of communication information. The source address, the number of frames, and the number of bytes transmitted from the address management table 3 of the relay device 1 are stored.

[0010]

As shown in FIG. 1, the present invention relays data when the source address is registered in the address management table 3 when the relay device 1 receives a frame, while it relays when the source address is not registered. The entry is added to register and relay the source address, the management device 6 is notified of the newly added source address, and the newly added source address is displayed.

Further, when the source address is registered in the address management table 3 when the relay device 1 receives the frame, the relay device 1 relays the frame and the number of frames and the number of bytes of the entry are counted up. When not present, an entry is added to register and relay the source address, the newly added source address is notified to the management device 6, and the newly added source address is displayed.

In addition, the management device 6 periodically or arbitrarily responds to a communication information transmission instruction, and the relay device 1 determines the source address, the number of frames, and the number of bytes registered in the address management table 3. The communication status (source address, number of frames, number of bytes) that summarizes these is displayed.

Therefore, even if the device (terminal) does not have the special management information reporting function, the relay device 1 can be used if it communicates.
From the device, the sender address is notified to the management device 6 and displayed, or the sender address, the number of frames and the number of bytes are periodically and arbitrarily notified and displayed, so that communication is performed by connecting to the network. It is possible to easily monitor the communication status such as the source address of the device (terminal 3), the number of frames, the number of bytes, etc. with a simple configuration.

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the construction and operation of an embodiment of the present invention will be described in detail with reference to FIGS.

FIG. 1 shows a block diagram of an embodiment of the present invention.
In FIG. 1, a relay device 1 connects a plurality of transmission lines such as a LAN (local area network) to each other, receives a frame transmitted to a certain LAN, and receives an address (source address) of this frame. (Address) is registered in the address management table 3, and when it is not registered, an entry is added to register and relay, and the newly added source address is notified to the management device 6. Is something you do,
The relay function unit 2 and the management protocol processing unit 4 are included.

The relay function section 2 has a function of connecting LANs to each other and is composed of an address management table 3 and the like. The address management table 3 registers the number of frames, the number of bytes, etc. in association with the source address. The address management table 3 is a table for automatically learning and registering the physical address of the terminal 5 that is communicating in the transmission path. Specifically, for example, in a MAC bridge device, a so-called “MAC address learning table” is used. In a router device, a different name is used for each relayed communication procedure. This is a table that is registered by the user, and both correspond to the address management table 3 of the present invention.

The management protocol processing unit 4 sends and receives data to and from the management device 6, and here,
When the address of the frame received by the relay function unit 2 is not registered in the address management table 3 and is newly added, the newly added address (source address, physical address), the number of frames, the number of bytes, etc. are managed by the management device. For example, the data is transmitted to the mobile terminal 6 (see FIG. 2).

The terminal 5 is a terminal connected to a LAN which is a transmission line, WS (workstation), etc.
Data is transmitted / received to / from the other terminal 5 or the like via N.

The management device 6 is for monitoring the state of the network, receives the notification of the new source address added from the relay device 1 and displays it, and periodically or arbitrarily transmits communication information. It stores the source address, the number of frames, the number of bytes transmitted from the address management table 3 of the relay device 1 that has been instructed by the management protocol processing unit 7 and the addition / deletion monitoring unit 8. It is composed.

The management protocol processing section 7 sends and receives data to and from the relay device 1, and here,
It receives the newly added address (source address, physical address), the number of frames, the number of bytes, etc. transmitted from the management protocol processing unit 4 of the relay device 1 (see FIG. 2).

The addition / deletion monitoring unit 8 receives the newly added address (source address, physical address), the number of frames, the number of bytes, etc. transmitted from the relay device 1 and displays them for the administrator, and manages the registration. The list of the addresses of the unauthorized terminals 5 is extracted by collating with the list of the physical addresses stored and displayed to the administrator.

Next, the operation of the configuration of FIG. 1 will be described in detail with reference to FIG. In FIG. 2A, S1 receives a frame. In this, the relay device 1 of FIG. 1 receives a frame transmitted by any one of the terminals 5 of the LAN which is the transmission path.

In step S2, the address management table 3 is searched. This searches whether the source address set in the frame received in S1 is registered in the address management table 3.

In step S3, it is determined whether or not there is an entry in the address management table 3. In the case of YES, since the source address set in the received frame has already been registered in the address management table 3, the entry is counted up in S8, for example, the frame of the entry of the corresponding source address in FIG. The number counter and the byte number counter are counted up, and the process proceeds to S9. On the other hand, NO in S3
In this case, since the source address set in the received frame is not registered in the address management table 3, the entry addition report is sent to the management device 6 in S4, the entry is added in S7, and the S8 is added. The count of entries is incremented by and the process proceeds to S9.

In S5, the management device 6 which has received the entry addition report (newly added source address etc.) transmitted from the relay device 1 in S4 saves the entry addition report and displays it. This display is a new WS addition display in S6, that is, the sender address (WS, terminal 5) newly added to the address management table 3 is displayed on the screen to notify the administrator.

In step S9, it is determined whether relay is necessary. In the case of YES, the relay process is performed in S10, that is, the frame is transmitted toward the destination transmission path. In the case of NO, the relay process is not required, and it is determined that the frame is in the own transmission line.
Discard the frame received in.

In step S12, in response to the output request of the statistical information from the administrator, the management device 6 collects the storage information from the address management table 3 according to (b) of FIG. 2 and stores it in the management device 6 in step S13. (Including the information that has been obtained) is totaled, and the totalized result is displayed on the screen in S14 to notify the administrator. Here, as the totalized result, for example, the source address, the number of frames: transmission / reception, and the number of bytes: transmission / reception are totaled and displayed. And, for example, if it is a source address that is not registered in advance and the received amount of frames and bytes is abnormally large, it can be determined that a large amount of information has been extracted from the database without warning. To notify the administrator.

By the above procedure from S1 to S14, when the source address set in the frame received by the relay device 1 from the transmission path is not registered in the address management table 3, the management device 6 is notified as a new address. Then, it is possible to display this, or to collect and display the information registered in the address management table 3 of the relay device 1 by (b) of FIG.

In FIG. 2B, in S21, the management device 6 instructs the collection of information in the address management table 3 periodically. This is because the management protocol processing unit 7 of FIG. 1 transfers to the management protocol processing unit 4 of the relay device 1 via the communication path.
It is instructed to collect the information of the address management table 3.

In S22, the relay device 1 transmits the contents of the address management table 3 to the management device 6 in response to the instruction in S21. This is because the management protocol processing unit 4 of the relay device 1 of FIG. 1 manages the contents (source address, number of frames, number of bytes, etc.) registered in the address management table 3 by the management device 6 via the communication path. It is transmitted to the protocol processing unit 7.

In S23, the contents (collected information) transmitted by the management device 6 in S22 are stored. The stored information (source address, number of frames, number of bytes, etc.) and the content stored in S5 of FIG. 2A (newly added source address) are S12, S13 of FIG. S14
Display the result on the screen by totaling.

FIG. 3 shows an example of the address management table of the present invention. This shows an image of the “address management table 3” in the relay device 1. In this example, the source address, the number of frames, and the number of bytes set in the frame received by the relay device 1 are accumulated, and the following contents are managed.

-Source address-Reception port-Entry lifetime-First registration date / time-Frame number counter-Byte number counter-Others Here, the source address is the origination of the originator terminal 5 set in the received frame. It is the original address (physical address).

The receiving port is a port of the relay device 1 that has received the frame, and stores that the terminal 5 having the source address exists on the transmission path beyond the receiving port. When a frame addressed to an address arrives, the frame is transmitted to the receiving port.

The entry life is determined by the address management table 3
This is for setting the time until the entry is deleted after being registered in (setting the remaining time), and for automatically deleting the unused entry. If the entry is to be made resident, it is set not to be automatically deleted.

The date and time of initial registration is to register the date and time of initial registration in the address management table 3. The frame counter is the number of frames of the source address received by the relay device 1 (the number of frames transmitted, the number of frames received).
Is a count (total).

The number-of-bytes counter is the number of bytes of the source address received by the relay device 1 (the number of bytes transmitted,
It is a count (total) of the number of bytes received. When the above items are registered in the address management table 3 and the source address set in the frame received by the relay device 1 is not registered in the address management table 3, a newly added source address (physical address) Then, the management device 6 is notified and displayed on the screen to notify the manager. In addition, the contents of the address management table 3 are periodically or arbitrarily collected and saved in the management device 6, and the saved contents are totaled and displayed in the order of the number of frames and the number of bytes. Inform the administrator of the status on the transmission path.

FIG. 4 shows a table explanatory diagram of the present invention.
FIG. 4A shows an image of the "newly added WS table" in the management device. This is a collective display of the contents (newly added source address) saved by the management device 6 in S5 of FIG. 2A. Here, ・ Sender address ・ First registration date and time are displayed. At this time, a warning is added to the unauthorized source addresses that have not been registered by checking the list of source addresses that are also registered. As a result, it is possible to easily find the WS (device, terminal 5) that is connected to the transmission path and is transmitting a frame without permission.

FIG. 4B shows an image of the "traffic management table for each WS" in the management device. This is a display in which the contents (contents of the address management table 3 of FIG. 3) saved by the management device 6 in S23 of FIG. 2B are aggregated and displayed. Here, ・ Source address ・ Frame counter: send / receive ・ Byte counter: send / receive are displayed. At this time, the state of the traffic volume of the transmission path can be known by sorting and displaying in descending order of the frame number counter and the byte number counter.

[0040]

As described above, according to the present invention,
When the relay device 1 that relays a plurality of networks receives a frame and when the frame is not registered in the address management table 3, an entry is added and registered, and the newly added source address is notified to the management device 6. A configuration is adopted in which a newly added source address is displayed, the contents of the address management table 3 are notified to the management device 6 periodically or arbitrarily, and the number of frames and the number of bytes for each source address are displayed. Therefore, even a device (terminal) that does not have a special management information reporting function can notify and display the information from the relay device 1 to the management device 6 by communication, and can monitor the information. . As a result, when there is a person who connects the terminal 5 to the transmission line without permission and transmits the information, the state (source address, number of transmitted / received frames, number of bytes) is displayed on the management device 6. It is possible to monitor and prohibit unauthorized communication, and further display and monitor the traffic volume on the transmission path for each source address (terminal 3, device).

[Brief description of drawings]

FIG. 1 is a configuration diagram of an embodiment of the present invention.

FIG. 2 is an operation explanatory diagram of the present invention.

FIG. 3 is an example of an address management table of the present invention.

FIG. 4 is an explanatory diagram of a table of the present invention.

[Explanation of symbols]

 1: Relay device 2: Relay function unit 3: Address management table 4, 7: Management protocol processing unit 5: Terminal 6: Management device 8: Addition / deletion monitoring unit

Continuation of front page (51) Int.Cl. ⁵ Identification number Office reference number FI technical display area H04L 12/24 12/26

Claims (3)

[Claims] 1. A communication status monitoring method for monitoring a communication status of a network, an address management table (3) for registering a source address.
Is provided in the relay device (1), and when the relay device (1) relaying a plurality of networks receives a frame, the address management table (3)
When it is not registered, the relay is performed, while when it is not registered, an entry is added and registered, and the newly added source address is notified to the management device (6), and this newly added call is transmitted. A communication status monitoring method characterized by being configured to display the original address. 2. A communication status monitoring method for monitoring a communication status of a network, an address management table (3) for registering a source address.
Is provided in the relay device (1), and when the relay device (1) relaying a plurality of networks receives a frame, the address management table (3)
When it is not registered, it is relayed and the number of frames and bytes of the corresponding entry is counted up. On the other hand, when it is not registered, an entry is added and registered, and this newly added source address is managed by the management device. A communication state monitoring method characterized by being configured to notify (6) and display the newly added source address. 3. The contents (source address) registered in the address management table (3) of the relay device (1) in response to the information transmission instruction from the management device (6) periodically or arbitrarily. The number of frames, the number of bytes, and the number of bytes) are notified to the management device (6), and information (source address, number of frames, number of bytes) summarizing the information is displayed. Communication status monitoring method described.