JP2020141191A - Data acquisition device, client server system, data acquisition method, and program - Google Patents

Abstract

To provide a data acquisition device and the like that can contribute to automatically acquiring data when an intermittent failure occurs.SOLUTION: A control unit identifies a port of a network apparatus connected to a server based on an IP address of a server, ARP table information on the network apparatus, and MAC address table information and sets monitoring, acquires monitoring information including IP addresses corresponding to ports that are ranked in a first predetermined number from the one with the maximum communication data amount among ports to which monitoring is set, identifies ports that are ranked in a second predetermined number less than the first predetermined number based on the monitoring information, the ARP table information, and the MAC address table information and sets capture, and sets the network apparatus connected to a data acquisition device to output communication data of the ports to which capture is set.SELECTED DRAWING: Figure 5

Description

The present invention relates to a data acquisition device, a client-server system, a data acquisition method, and a program.

In a client-server system that uses network equipment (layer 3 switch, layer 2 switch), as a method of dealing with a failure that sometimes causes a decrease in processing performance, communication data is acquired from the client-server system and acquired when a failure occurs. A method of analyzing the communication data is generally used (see, for example, Patent Document 1). Normally, communication data is acquired when a failure occurs when a data acquisition device (personal computer, etc.) connected to the client-server system acquires the transmission / reception data of the server and the transmission / reception data of the client when a failure occurs. Will be.

Special Table 2003-534748

The following analysis is provided by the inventor of the present application.

However, in the case of an intermittent failure that causes a decrease in processing performance intermittently in the client server system, the LAN (Local Area Network) port connected to the server and the LAN port connected to the client are referred to. Set the packet capture (collection of communication data flowing to the target LAN port) and the monitor output LAN port (LAN port that monitors the data output) for packet capture, and then set the monitor output LAN. It is necessary to connect a data acquisition device to the port and manually execute data acquisition in the event of a failure. Therefore, there is a problem that it takes time to acquire data when an intermittent failure occurs.

A main object of the present invention is to provide a data acquisition device, a client-server system, a data acquisition method, and a program that can contribute to automatically acquiring data when an intermittent failure occurs.

The data acquisition device according to the first viewpoint is a data acquisition device that acquires data from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device. The data acquisition device controls a connection unit that is communicably connected to any one of at least one network device, a storage unit that stores an IP (Internet Protocol) address related to the server, the connection unit, and the storage unit. It also includes a control unit that performs predetermined information processing. The control unit includes the IP address of the server stored in the storage unit, ARP (Address Resolution Protocol) table information of the network device directly connected to the data acquisition device, and at least one of the above. Based on all the MAC (Media Access Control) address table information of the network device, the process of identifying the port of the network device to which the server is connected is performed. The control unit performs a process of setting monitoring for the port of the network device to which the server is connected. The control unit is an IP corresponding to a port in the order of the first predetermined number from the network device to which the server is connected to the port to which the monitoring is set and which has the largest amount of communication data. Performs the process of acquiring monitoring information including the address. Based on the acquired monitoring information, the ARP table information, and the MAC address table information, the control unit starts with the port having the largest amount of communication data among the ports for which the monitoring is set. A process for specifying a port that falls in the rank of the second predetermined number, which is smaller than the first predetermined number, is performed. The control unit performs a process of setting a capture for the port that falls in the second predetermined number of ranks. The control unit performs a process of setting the network device to which the data acquisition device is connected to output communication data of the port for which the capture is set.

The client-server system according to the second viewpoint includes a plurality of clients, a server, at least one network device that communicably connects the plurality of clients and the server, and a data acquisition device according to the first viewpoint. And.

The data acquisition method according to the third viewpoint is a data acquisition method in which data is acquired from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device by using a data acquisition device. is there. In the data acquisition method, the IP address of the server stored in advance, the ARP table information of the network device directly connected to the data acquisition device, and all the MAC address table information of the at least one network device are used. Includes the step of identifying the port of the network device to which the server is connected based on. The data acquisition method includes a step of setting monitoring for the port of the network device to which the server is connected. In the data acquisition method, the IP corresponding to the port corresponding to the first predetermined number of the ports having the largest amount of communication data among the ports for which the monitoring is set from the network device to which the server is connected. Includes a step to get monitoring information including the address. In the data acquisition method, based on the acquired monitoring information, the ARP table information, and the MAC address table information, the port for which the monitoring is set has the largest amount of communication data. The step includes identifying a port that enters the rank of the second predetermined number, which is less than the first predetermined number. The data acquisition method includes a step of setting a capture for the port that falls within the second predetermined number of ranks. In the data acquisition method, a step of setting the network device to which the data acquisition device is connected to output the communication data of the port for which the capture is set is performed.

The program according to the fourth viewpoint is a program that causes a data acquisition device to acquire data from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device. The program includes a pre-stored IP address of the server, ARP table information of the network device directly connected to the data acquisition device, and all MAC address table information of the at least one network device. Based on this, the process of identifying the port of the network device to which the server is connected is executed. The program executes a process of setting monitoring for the port of the network device to which the server is connected. The program assigns the IP address corresponding to the port corresponding to the first predetermined number of the ports having the largest amount of communication data among the ports for which the monitoring is set from the network device to which the server is connected. Execute the process to acquire the monitoring information including. Based on the acquired monitoring information, the ARP table information, and the MAC address table information, the program starts with the port having the largest amount of communication data among the ports for which the monitoring is set. 1 The process of specifying a port that falls in the rank of the second predetermined number less than the predetermined number is executed. The program executes a process of setting a capture for the port that falls in the second predetermined number of ranks. The program causes the network device to which the data acquisition device is connected to execute a process of setting the communication data of the port for which the capture is set to be output.

The program can be recorded on a computer-readable storage medium. The storage medium may be a non-transient such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. Further, in the present disclosure, it is also possible to embody it as a computer program product. The program is input to a computer device via an input device or an external communication interface, stored in a storage device, drives a processor according to a predetermined step or process, and steps the processing result including an intermediate state as necessary. Each can be displayed via a display device, or can communicate with the outside via a communication interface. Computer devices for this purpose, for example, typically include a processor, a storage device, an input device, a communication interface, and, if necessary, a display device that can be connected to each other by a bus.

According to the first to fourth viewpoints, it is possible to contribute to automatically acquiring data when an intermittent failure occurs.

It is a block diagram which shows typically the structure of the example of the client-server system which concerns on Embodiment 1. It is a flowchart which shows typically the operation of the control part of the data acquisition apparatus in the client server system which concerns on Embodiment 1. FIG. 5 is a flowchart following FIG. 2 schematically showing the operation of the control unit of the data acquisition device in the client-server system according to the first embodiment. FIG. 5 is a flowchart following FIG. 3 schematically showing the operation of the control unit of the data acquisition device in the client-server system according to the first embodiment. It is a block diagram which shows typically the structure of the data acquisition apparatus which concerns on Embodiment 2. It is a block diagram which shows the structure of a hardware resource schematically.

In the present disclosure described below, the data acquisition device according to mode 1 and its modification mode can be appropriately selected and combined. The data acquisition device according to mode 1 refers to a form of the data acquisition device. Further, the deformation mode means a deformed form.

The data acquisition device according to the mode 1 is a data acquisition device that acquires data from a client server system that communicably connects a plurality of clients and a server via at least one network device, and is the at least one network. A connection unit that is communicably connected to any one of the devices, a storage unit that stores the IP address of the server, a control unit that controls the connection unit and the storage unit, and a control unit that performs predetermined information processing. The control unit includes the IP address of the server stored in the storage unit, ARP table information of the network device directly connected to the data acquisition device, and at least one network device. Based on all the MAC address table information of, the process of identifying the port of the network device to which the server is connected and the monitoring setting for the port of the network device to which the server is connected are set. IP address corresponding to the processing to be performed and the port corresponding to the first predetermined number of the ports having the largest amount of communication data among the ports for which monitoring is set from the network device to which the server is connected. The largest amount of communication data among the ports for which monitoring is set based on the process of acquiring monitoring information including the above, the acquired monitoring information, the ARP table information, and the MAC address table information. A process of specifying a port having a second predetermined number less than the first predetermined number, a process of setting a capture for the port having a second predetermined number, and the above. It is possible to use the data acquisition device as a data acquisition device that performs a process of setting the network device to which the data acquisition device is connected to output communication data of the port for which the capture is set.

As a modification mode of the data acquisition device according to the mode 1, the connection unit is connected to any one of the at least one network device so as to be communicable using the first communication standard, and at least the first connection unit. It has one of one network device and a second connection unit that is communicably connected using a second communication standard different from the first communication standard, and the control unit is connected to the server. A process for identifying a port of the network device, a process for setting the monitoring, a process for acquiring the monitoring information, a process for identifying the port in the second predetermined number of orders, and a process for setting the capture. It is possible to control such that the process of performing the process is performed through the first connection unit and the process of setting the communication data of the port of the network device for which the capture is set to be output is performed through the second connection unit. it can.

As a modification mode of the data acquisition device according to the mode 1, the first connection unit is an interface for transmitting and receiving information using an interface standard of a serial port, and the second connection unit is an interface of a LAN port. It can be an interface that sends and receives information using standards.

As a modification mode of the data acquisition device according to the mode 1, in the process of specifying the port of the network device to which the server is connected, the IP address is obtained from the network device directly connected to the data acquisition device. A process of acquiring the ARP table information associated with the MAC address, and a process of specifying the MAC address corresponding to the IP address of the server stored in the storage unit using the acquired ARP table information. , The server connects based on the MAC address related to the specified server by the process of acquiring the MAC address table information from all of the at least one network device and the acquired MAC address table information. It is possible to perform a process of specifying the port of the network device.

As a modification mode of the data acquisition device according to the mode 1, in the process of acquiring the MAC address table information, the MAC address table information is transmitted from a network device other than the network device directly connected to the data acquisition device. Can be remotely connected to the other network device when the data is acquired.

As a modification mode of the data acquisition device according to the mode 1, in the process of specifying the port that enters the second predetermined number of orders, the acquired monitoring information is used to enter the second predetermined number of orders. The process of specifying the IP address corresponding to the above, and the process of specifying the MAC address corresponding to the IP address corresponding to the port in the specified second predetermined number of ranks by using the acquired ARP table information. Then, using the acquired MAC address table information, it is possible to perform a process of specifying the port that falls in the order of the specified MAC address.

As a modification mode of the data acquisition device according to the mode 1, in the process of acquiring the monitoring information, a process of performing a communication confirmation test on the IP address related to the server and a current response time by the communication confirmation test And the previous response time are compared, and the process of determining whether or not the delay is made by a predetermined ratio or more, and when the delay is made by the predetermined ratio or more, the monitoring is set from the network device to which the server is connected. It is possible to perform a process of acquiring the monitoring information at the port.

In the present disclosure, as the client-server system according to the mode 2, a plurality of clients, a server, at least one network device for communicably connecting the plurality of clients and the server, and a data acquisition device according to the mode 1 are provided. It is possible to make a client-server system equipped with and. The client-server system according to mode 2 refers to the form of the client-server system.

In the present disclosure, as a data acquisition method according to mode 3, data acquisition is performed by using a data acquisition device to acquire data from a client server system that communicably connects a plurality of clients and a server via at least one network device. The method is a pre-stored IP address for the server, ARP table information for the network device directly connected to the data acquisition device, and all MAC address table information for the at least one network device. Based on, the step of specifying the port of the network device to which the server is connected, the step of setting monitoring for the port of the network device to which the server is connected, and the step of the server From the connected network device, the monitoring information including the IP address corresponding to the port corresponding to the first predetermined number of the ports having the largest amount of communication data among the ports for which the monitoring is set is acquired. Based on the step, the acquired monitoring information, the ARP table information, and the MAC address table information, the first of the ports for which the monitoring is set has the largest amount of communication data. The data acquisition device is connected to a step of specifying a port having a second predetermined number of ranks less than one predetermined number, a step of setting a capture for the port having a rank of the second predetermined number, and a step of setting a capture. It is possible to use the data acquisition method of performing the step of setting the network device to output the communication data of the port for which the capture is set. The data acquisition method according to the mode 3 refers to a form of the data acquisition method.

In the present disclosure, as a program related to mode 4, a program for causing a data acquisition device to acquire data from a client server system that connects a plurality of clients and a server via at least one network device so as to be communicable. Based on the stored IP address of the server, ARP table information of the network device directly connected to the data acquisition device, and all MAC address table information of the at least one network device, the said The process of specifying the port of the network device to which the server is connected, the process of setting monitoring for the port of the network device to which the server is connected, and the network to which the server is connected. The process of acquiring monitoring information including the IP address corresponding to the port corresponding to the first predetermined number of ports from the device having the largest amount of communication data among the ports for which monitoring is set, and the acquired said. Based on the monitoring information, the ARP table information, and the MAC address table information, among the ports for which the monitoring is set, the one with the largest amount of communication data is less than the first predetermined number. For the process of specifying a port that enters the second predetermined number of orders, the process of setting capture for the port that enters the second predetermined number of orders, and the network device to which the data acquisition device is connected. Therefore, it is possible to make a program that executes a process of setting the communication data of the port for which the capture is set to be output. The program related to mode 4 refers to the form of the program.

Hereinafter, embodiments will be described with reference to the drawings. In addition, when the drawing reference reference numerals are attached in this application, they are solely for the purpose of assisting understanding, and are not intended to be limited to the illustrated aspects. Further, the following embodiments are merely examples, and do not limit the present invention. Further, the connecting line between blocks such as drawings referred to in the following description includes both bidirectional and unidirectional. The one-way arrow schematically shows the flow of the main signal (data), and does not exclude interactivity. Further, in the circuit diagram, the block diagram, the internal configuration diagram, the connection diagram, and the like shown in the disclosure of the present application, although not explicitly stated, an input port and an output port exist at the input end and the output end of each connection line, respectively. The same applies to the input / output interface. The program is executed via a computer device, which comprises, for example, a processor, a storage device, an input device, a communication interface, and a display device as required, and the computer device is in the device or through the communication interface. It is configured to be able to communicate with external devices (including computers) regardless of whether it is wired or wireless.

[Embodiment 1]
The client-server system according to the first embodiment will be described with reference to the drawings. FIG. 1 is a block diagram schematically showing a configuration of an example of a client-server system according to the first embodiment.

In the client-server system 1, at least one switch (layer 3 in FIG. 1) is composed of at least one client terminal (terminals 51 to 56 in FIG. 1) and a server to be measured (measurement target server 50 in FIG. 1). It is a system connected so that data communication is possible via the switch 20 and the layer 2 switch 40) (see FIG. 1). The client-server system 1 includes a data acquisition device 10 in addition to a basic component including a measurement target server 50, terminals 51 to 56, a layer 3 switch 20, and a layer 2 switch 40.

The data acquisition device 10 is a device that automatically acquires communication data from the basic configuration unit (layer 3 switch 20 in FIG. 1) of the client server system 1 when a failure occurs in the client server system 1 (see FIG. 1). As the data acquisition device 10, for example, a computer having a serial connection unit 14 and a LAN connection unit 15 can be used, and for example, a notebook personal computer can be used. The data acquisition device 10 includes a control unit 11, an input unit 12, an output unit 13, a serial connection unit 14, a LAN connection unit 15, and a storage unit 16.

The control unit 11 is a functional unit that controls an input unit 12, an output unit 13, a serial connection unit 14, a LAN connection unit 15, and a storage unit 16 (see FIG. 1). The control unit 11 controls the input unit 12 to take in the information input from the input unit 12. The control unit 11 controls the output unit 13 to cause the output unit 13 to output information. The control unit 11 controls the serial connection unit 14 to send and receive information to and from the layer 3 switch 20. The control unit 11 controls the LAN connection unit 15 to send and receive information to and from the layer 3 switch 20. The control unit 11 inputs / outputs data to / from the storage unit 16 and writes / reads data to / from the storage unit 16. The control unit 11 performs predetermined information processing by executing software (including the switch control tool 19). The details of the operation when the control unit 11 is executing the switch control tool 19 will be described later.

The input unit 12 is a functional unit for inputting information to the data acquisition device 10 by a user operation (see FIG. 1). For the input unit 12, for example, a keyboard, mouse, touch panel, microphone, button, or other input means can be used, and an information terminal or the like having an input unit communicably connected via a communication unit (not shown) is used. You may.

The output unit 13 is a functional unit for outputting (display, audio output, printing, etc.) information from the data acquisition device 10 to the outside (see FIG. 1). As the output unit 13, for example, a display for displaying, a printer for printing, or other output means can be used, and an information terminal or the like having an output unit communicably connected via a communication unit (not shown) is used. May be good. Further, instead of using the output unit 13, another information terminal or the like (not shown; for example, a terminal used by the user) connected through the communication unit and the network may be used to output the information. ..

The serial connection unit 14 is an interface (first connection unit) that transmits and receives information one bit at a time using the interface standard of the serial port (first communication standard; for example, RS-232) (FIG. 6). 1). The serial connection portion 14 is detachably connected to the serial cable 60. The serial connection unit 14 is communicably connected (serial connection) to the console port 23 of the layer 3 switch 20 via the serial cable 60.

The LAN connection unit 15 is an interface (second connection unit) for transmitting and receiving information using an interface standard (second communication standard; for example, Ethernet (registered trademark)) of a LAN port (FIG. 1). reference). The LAN connection unit 15 is detachably connected to the LAN cable 63. The LAN connection unit 15 is communicably connected (LAN connection) to the LAN port of the layer 3 switch 20 (the third LAN port 26 in FIG. 1 and other LAN ports are also possible) via the LAN cable 63.

The storage unit 16 is a functional unit that stores information such as various data, programs (including tool software), and files (see FIG. 1). As the storage unit 16, for example, a storage device such as a RAM (Random Access Memory), a flash memory (nonvolatile memory), an HDD (Hard Disk Drive), or an SSD (Solid State Drive) can be used. The storage unit 16 contains an IP address related to the measurement target server 50, a port number used by the measurement target application on the measurement target server 50, and a user name and password required for logging in to the layer 3 switch 20 and the layer 2 switch 40. , Is remembered. The storage unit 16 stores device information 17, communication data acquisition information 18, and switch control tool 19.

The device information 17 is information about a switch device (layer 3 switch 20 and layer 2 switch 40 in FIG. 1) in the client-server system 1 (see FIG. 1). The device information 17 includes layer 3 switch information 17a, layer 2 switch information 17b, and communication confirmation test result 17c.

The layer 3 switch information 17a is information about the layer 3 switch 20 (see FIG. 1). The layer 3 switch information 17a has ARP table information, MAC address table information, and NetFlow information.

The ARP table information is information in which the IP address and the MAC address are associated with each other. The IP address is a number for identifying a device that sends and receives packets in IP. The MAC address is a physical address assigned to the hardware of the network device set to identify each node on the network. The MAC address table information is information that associates a MAC address with a LAN port. NetFlow is a technology developed by Cisco Systems, Inc. in the United States that monitors and analyzes information on network traffic, and is a function that passively monitors the traffic flow flowing on the network. NetFlow information is information related to NetFlow settings.

In the NetFlow settings, ingress, egress, and top-talkers top 10 are set. In the ingress setting, the bandwidth information (traffic) is set to be measured at the timing of inputting to a specific LAN port of the switch. In the egress setting, the bandwidth information (traffic) is set to be measured at the timing of output from the specific LAN port of the switch. In the top-talkers top 10 setting, the IP addresses related to 10 nodes are specified in descending order of the largest amount of communication data for the IP addresses set in NetFlow.

The layer 2 switch information 17b is information about the layer 2 switch 40 (see FIG. 1). The layer 2 switch information 17b has MAC address table information and NetFlow information.

The communication confirmation test result 17c is information regarding the result (response time) of the communication confirmation test (Ping command execution) performed by executing the switch control tool 19.

The communication data acquisition information 18 is information related to data (transmission / reception data of the measurement target server 50, transmission / reception data of terminals 51 to 55 of the top talker top 5) that captures packets input from the LAN connection unit 15.

The switch control tool 19 remotely connects to a switch (layer 3 switch and layer 2 switch in FIG. 1) in the client-server system 1, sets the switch and acquires information, a communication confirmation test, a processing performance deterioration determination, and communication data acquisition. It is a program to execute.

The layer 3 switch 20 is a switch that operates (transfers) at layer 3 (network layer) in the OSI (Open System Interconnection) reference model among the switches that relay the network (see FIG. 1). The layer 3 switch 20 is for not being affected by the aging time (MAC address retention time; standard value is 5 minutes in the case of a Cisco switch) of the FDB (Forwarding DataBase) of the layer 2 switch 40. It is a thing. For the layer 3 switch 20, for example, a commercially available product can be used. The layer 3 switch 20 has a control unit 21, a storage unit 22, a console port 23, and LAN ports 24 to 31.

The control unit 21 is a functional unit that controls the storage unit 22, the console port 23, and the LAN ports 24 to 31 (see FIG. 1). The control unit 21 controls the LAN port 31 to send and receive information to and from the LAN port 43 of the corresponding layer 2 switch 40. The control unit 21 inputs / outputs data to / from the storage unit 22 and writes / reads data to / from the storage unit 22. The control unit 21 performs a relay operation based on the information stored in the storage unit 22. The control unit 21 controls the console port 23 to send and receive information to and from the data acquisition device 10. The control unit 21 controls the first LAN port 24 to send and receive information to and from the measurement target server 50. The control unit 21 controls the second LAN port 25 to send and receive information to and from the terminal 51. The control unit 21 controls the third LAN port 26 to send and receive information to and from the LAN connection unit 15 of the data acquisition device 10. The control unit 21 controls the fourth LAN port 27 to send and receive information to and from the terminal 56. The control unit 21 controls the fifth LAN port 28 to send and receive information to and from the terminal 55. The control unit 21 controls the sixth LAN port 29 to send and receive information to and from the terminal 54. The control unit 21 controls the 7th LAN port 30 to send and receive information to the terminal or the device when connected to the 7th LAN port 30. The control unit 21 controls the eighth LAN port 31 to send and receive information to and from the first LAN port 43 of the layer 2 switch 40. The control unit 21 is controlled by a remote connection of the control unit 11 of the data acquisition device 10.

The storage unit 22 is a functional unit that stores information such as various data, programs, and files (see FIG. 1). The storage unit 22 stores setting information, ARP table information, MAC address table information, and NetFlow information. The setting information is information related to the setting for constructing the virtual network of each LAN port 24 to 31.

The console port 23 is an interface for transmitting and receiving information one bit at a time using an interface standard of a serial port (for example, RS-232) (see FIG. 1). The console port 23 is detachably connected to the serial cable 60, and is communicably connected to the serial connection portion 14 of the data acquisition device 10 via the serial cable 60.

LAN ports 24 to 31 are interfaces for transmitting and receiving information using the Ethernet standard (see FIG. 1). The first LAN port 24 is detachably connected to the LAN cable 61, and is communicably connected to the measurement target server 50 via the LAN cable 61. The second LAN port 25 is detachably connected to the LAN cable 62, and is communicably connected to the terminal 51 via the LAN cable 62. The third LAN port 26 is detachably connected to the LAN cable 63, and is communicably connected to the LAN connection unit 15 of the data acquisition device 10 via the LAN cable 63. The fourth LAN port 27 is detachably connected to the LAN cable 64, and is communicably connected to the terminal 56 via the LAN cable 64. The fifth LAN port 28 is detachably connected to the LAN cable 65, and is communicably connected to the terminal 55 via the LAN cable 65. The sixth LAN port 29 is detachably connected to the LAN cable 66, and is communicably connected to the terminal 54 via the LAN cable 66. No LAN cable is connected to the 7th LAN port 30. The eighth LAN port 31 is detachably connected to the LAN cable 71, and is communicably connected to the first LAN port 43 of the layer 2 switch 40 via the LAN cable 71.

The layer 2 switch 40 is a switch that operates at layer 2 (data link layer) in the OSI reference model among the switches that relay the network (see FIG. 1). The layer 2 switch 40 determines the relay destination based on the MAC address included in the packet and performs the relay operation. For the layer 2 switch 40, for example, a commercially available product can be used. The layer 2 switch 40 has a control unit 41, a storage unit 42, and LAN ports 43 to 45.

The control unit 41 is a storage unit 42 and a functional unit that controls each of the LAN ports 43 to 45 (see FIG. 1). The control unit 41 inputs / outputs data to / from the storage unit 42, and writes / reads data to / from the storage unit 42. The control unit 41 performs a relay operation based on the information stored in the storage unit 42. The control unit 41 controls the first LAN port 43 to transmit / receive information to / from the LAN port (8th LAN port 31 in FIG. 1) of the corresponding layer 3 switch 20. The control unit 41 controls the second LAN port 44 to send and receive information to and from the corresponding terminal 52. The control unit 41 controls the third LAN port 45 to send and receive information to and from the corresponding terminal 53. The control unit 41 is controlled by a remote connection of the control unit 11 of the data acquisition device 10.

The storage unit 42 is a functional unit that stores information such as various data, programs, and files (see FIG. 1). The storage unit 42 stores setting information, ARP table information, MAC address table information, and NetFlow information. The setting information is information related to the setting for constructing the virtual network of each LAN port 43 to 45.

LAN ports 43 to 45 are interfaces for transmitting and receiving information using the Ethernet standard (see FIG. 1). The first LAN port 43 is detachably connected to the LAN cable 71, and is communicably connected to the eighth LAN port 31 of the layer 3 switch 20 via the LAN cable 71. The second LAN port 44 is detachably connected to the LAN cable 72, and is communicably connected to the terminal 52 via the LAN cable 72. The third LAN port 45 is detachably connected to the LAN cable 73, and is communicably connected to the terminal 53 via the LAN cable 73.

The measurement target server 50 is a measurement target server (see FIG. 1). As the measurement target server 50, for example, a commercially available server having a computer function capable of providing information and services in response to a request from terminals 51 to 56 can be used. The measurement target server 50 is detachably connected to the LAN cable 61, and is communicably connected to the first LAN port 24 of the layer 3 switch 20 via the LAN cable 61. The measurement target server 50 executes and operates the measurement target application. The IP address, MAC address, and port number used by the application to be measured (transport layer number of the Internet Protocol suite) are set in advance in the measurement target server 50.

Terminals 51 to 56 are information terminals serving as clients (see FIG. 1). For the terminals 51 to 56, a commercially available terminal having a computer function capable of receiving information and services from the measurement target server 50 by requesting the measurement target server 50 to provide information and services is used. Can be done. An IP address and a MAC address are set in advance in the terminals 51 to 56.

The terminal 51 is detachably connected to the LAN cable 62, and is communicably connected to the second LAN port 25 of the layer 3 switch 20 via the LAN cable 62. The terminal 52 is detachably connected to the LAN cable 72, and is communicably connected to the second LAN port 44 of the layer 2 switch 40 via the LAN cable 72. The terminal 53 is detachably connected to the LAN cable 73, and is communicably connected to the third LAN port 45 of the layer 2 switch 40 via the LAN cable 73. The terminal 54 is detachably connected to the LAN cable 66, and is communicably connected to the sixth LAN port 29 of the layer 3 switch 20 via the LAN cable 66. The terminal 55 is detachably connected to the LAN cable 65, and is communicably connected to the fifth LAN port 28 of the layer 3 switch 20 via the LAN cable 65. The terminal 56 is detachably connected to the LAN cable 64, and is communicably connected to the fourth LAN port 27 of the layer 3 switch 20 via the LAN cable 64.

Regarding terminals 51 to 56, in FIG. 1, among the top-talkers top 10 identified by the NetFlow function, the terminal 51 becomes the node of the top talker top 1, the terminal 52 becomes the node of the top talker top 2, and the terminal 53. Is a node of the top talker top 3, terminal 54 is a node of the top talker top 4, terminal 55 is a node of the top talker top 5, and terminal 56 is a node of the top talker top 6.

Next, the operation of the control unit of the data acquisition device in the client-server system according to the first embodiment will be described with reference to the drawings. FIG. 2 is a flowchart illustrating the operation of the control unit of the data acquisition device in the client-server system according to the first embodiment. Please refer to FIG. 1 for the components of the client-server system. Further, the operation of the control unit 11 of the data acquisition device 10 here is the operation of the control unit 11 when the switch control tool 19 is executed.

As a premise, the serial connection unit 14 of the data acquisition device 10 is communicably connected to the console port 23 of the layer 3 switch 20 via the serial cable 60, and the LAN connection unit 15 of the data acquisition device 10 is the LAN cable 63. It is assumed that the layer 3 switch 20 is communicably connected to the LAN port (third LAN port 26 in FIG. 1) via the above.

Further, as a premise, in the storage unit 16 of the data acquisition device 10, the IP address related to the measurement target server 50, the port number used by the measurement target application, and the layer 3 switch 20 and the layer 2 switch 40 are stored in advance. It is assumed that the user name and password required for login are registered.

First, the control unit 11 of the data acquisition device 10 connects (serially connects) the serial connection unit 14 to the console port 23 of the layer 3 switch 20 via the serial cable 60 (step A1 in FIG. 2).

Here, at the time of serial connection, the data acquisition device 10 logs in to the layer 3 switch 20 by using the user name and password for logging in to the layer 3 switch 20 registered in advance in the storage unit 16.

Next, the control unit 11 of the data acquisition device 10 acquires ARP table information from the storage unit 22 of the layer 3 switch 20 via the serial cable 60 (step A2 in FIG. 2).

Here, when acquiring the ARP table information, if the layer 3 switch 20 is a Cisco switch, the "show arp" command is executed.

Next, the control unit 11 of the data acquisition device 10 stores the ARP table information related to the layer 3 switch 20 acquired in step A2 in the layer 3 switch information 17a of the device information 17 in the storage unit 16 (FIG. 2). Step A3).

Next, the control unit 11 of the data acquisition device 10 is an IP address related to the measurement target server 50 registered in advance in the storage unit 16 of the data acquisition device 10, and is an ARP table related to the layer 3 switch 20 saved in step A3. The information is searched and the MAC address of the measurement target server 50 corresponding to the IP address of the measurement target server 50 is specified (step A4 in FIG. 2).

Next, the control unit 11 of the data acquisition device 10 acquires MAC address table information from the storage unit 22 of the layer 3 switch 20 via the serial cable 60 (step A5 in FIG. 2).

Here, when acquiring the MAC address table information, if the layer 3 switch 20 is a Cisco switch, the "show mac address-table" command is executed.

Next, the control unit 11 of the data acquisition device 10 stores the MAC address table information related to the layer 3 switch 20 acquired in step A5 in the layer 3 switch information 17a of the device information 17 in the storage unit 16 (FIG. 2). Step A6).

Next, the control unit 11 of the data acquisition device 10 connects (remotely connects) to the layer 2 switch 40 via the serial cable 60, the layer 3 switch 20, and the LAN cable 71 (step A7 in FIG. 2).

Next, the control unit 11 of the data acquisition device 10 acquires MAC address table information from the storage unit 42 of the layer 2 switch 40 via the serial cable 60, the layer 3 switch 20, and the LAN cable 71 (FIG. 2). Step A8).

Next, the control unit 11 of the data acquisition device 10 stores the MAC address table information related to the layer 2 switch 40 acquired in step A8 in the layer 2 switch information 17b of the device information 17 in the storage unit 16 (FIG. 2). Step A9).

Next, the control unit 11 of the data acquisition device 10 has the MAC address of the measurement target server 50 specified in step A4, the MAC address table information of the layer 3 switch 20 stored in step A6, and step A9. The MAC address table information related to the layer 2 switch 40 saved in is searched, and the LAN port of the switch to which the measurement target server 50 is connected (the first LAN port 24 of the layer 3 switch 20 in FIG. 1) is specified (automatically determined). ) (Step A10 in FIG. 3).

Next, the control unit 11 of the data acquisition device 10 sets NetFlow for the LAN port of the switch to which the measurement target server 50 is connected (the first LAN port 24 of the layer 3 switch 20 in FIG. 1) (in FIG. 1). Step A11 in FIG.

Here, when setting NetFlow to the GigabitEthernet 0/1 port (port related to the IP address 10.1.0.1 related to the server) of the Cisco switch, for example, execute the command enclosed in "" below.

"Interface GigabitEthernet 0/1
ip flow ingress
ip flow egress
ip flow-top-talkers
top10
sort-by bytes
match source address 10.1.0.1 255.255.255.255
cache-timeout 3000 ”

After step A11, or when there is no delay of a predetermined ratio or more (NO in step A14), the control unit 11 of the data acquisition device 10 sets the IP address of the measurement target server 50 at a predetermined time interval. A communication confirmation test (Ping command execution) is performed periodically (step A12 in FIG. 3).

Next, the control unit 11 of the data acquisition device 10 stores the result (response time) obtained in the communication confirmation test in step A12 in the communication confirmation test result 17c of the device information 17 in the storage unit 16 (FIG. 3). Step A13).

Next, the control unit 11 of the data acquisition device 10 compares the result of the current communication confirmation test (response time) with the result of the previous communication confirmation test (response time) each time the communication confirmation test is performed, and has a predetermined ratio or more. It is determined whether or not there is a delay (for example, 20% or more) (step A14 in FIG. 3). If there is no delay of the predetermined ratio or more (NO in step A14), the process returns to step A12.

When the delay is more than a predetermined ratio (YES in step A14), the control unit 11 of the data acquisition device 10 determines that the processing performance has deteriorated (step A15 in FIG. 3).

Next, the control unit 11 of the data acquisition device 10 transmits information related to the NetFlow top-talkers top 10 from the switch to which the measurement target server 50 is connected (layer 3 switch 20 in FIG. 1) via the serial cable 60. (Step A16 in FIG. 3).

Here, the information related to top-talkers top 10 is information (monitoring information) including IP addresses that are in the order of 10 nodes from the one with the largest amount of communication data among the IP addresses set by NetFlow. In other words, the information related to top-talkers top 10 has the largest amount of communication data (the largest amount of communication band usage) among the streams of unidirectional packets between the source and the destination connected to the network. Information including the IP address involved in the stream that falls in the order of 10 nodes from the largest) and the IP address corresponding to the source and destination port numbers of the transport layer. Specifically, it is connected to the network. It corresponds to the information that identifies the source and destination servers or personal computers that are ranked in the order of 10 nodes from the one with the largest amount of communication data (larger communication band usage). When the layer 3 switch 20 is a Cisco switch, the "show ip flow top-talkers" command is executed when acquiring the information related to the top-talkers top 10.

Next, the control unit 11 of the data acquisition device 10 assigns an IP address related to the terminal of the top talker top 5 (terminals 51 to 55 in FIG. 1) based on the information related to the top-talkers top 10 acquired in step A16. Specify (automatically extract) (step A17 in FIG. 3).

Next, the control unit 11 of the data acquisition device 10 has an IP address related to the terminal of the top talker top 5 (terminals 51 to 55 in FIG. 1) specified in step A17, and is the ARP of the layer 3 switch information 17a in the device information 17. The table information is searched, and the MAC address corresponding to the IP address (MAC address related to the terminal of the top talker top 5 (terminals 51 to 55 in FIG. 1)) is specified (step A18 in FIG. 4).

Next, the control unit 11 of the data acquisition device 10 has the MAC address related to the terminal of the top talker top 5 (terminals 51 to 55 in FIG. 1) specified in step A18, and the layer 3 switch information 17a saved in step A6. The MAC address table information of the above and the MAC address table information of the layer 2 switch information 17b saved in step A9 are searched, and the terminals of the top talker top 5 (terminals 51 to 55 in FIG. 1) are connected to the switch. Identify the LAN port (step A19 in FIG. 4).

Here, when specifying the LAN port of the switch, in the example of FIG. 1, the second LAN port 25 of the layer 3 switch 20, the second LAN port 44 of the layer 2 switch 40, the third LAN port 45 of the layer 2 switch 40, and the layer 3 The sixth LAN port 29 of the switch 20 and the fifth LAN port 28 of the layer 3 switch 20 are specified.

Next, the control unit 11 of the data acquisition device 10 has a LAN port of the switch to which the measurement target server 50 is connected (the first LAN port 24 of the layer 3 switch 20 in FIG. 1) and a terminal of the top talker top 5 (FIG. 1). For each LAN port of the switch to which the terminals 51 to 55) are connected in 1 (LAN ports 25, 28, 29 of the layer 3 switch 20 and LAN ports 44, 45 of the layer 2 switch 40 in FIG. 1). , Packet capture (including remote packet capture) is set (step A20 in FIG. 4).

Next, the control unit 11 of the data acquisition device 10 captures the LAN port of the switch connected to the LAN connection unit 15 of the data acquisition device 10 (in FIG. 1, the third LAN port 26 of the layer 3 switch 20). Set the monitor output LAN port so as to output the communication data of each (packet captured) LAN port (LAN ports 25, 28, 29 of the layer 3 switch 20 and LAN ports 44, 45 of the layer 2 switch 40). Step A21 in FIG. 4).

Here, when the layer 3 switch 20 is a Cisco switch, when capturing the packet of the GigabitEthernet 0/1 port and outputting it to the GigabitEthernet 0/3 port, it is enclosed in a predetermined command (for example, the following ""). Command) is executed.

"Monitor session 1 source interface GigabitEthernet 0/1
Monitor session 1 destination interface GigabitEthernet 0/3 ”

When the layer 3 switch 20 is a Cisco switch, when capturing the packet of the GigabitEthernet 0/1 port of SW1 and outputting it to the GigabitEthernet 0/3 port of SW2, it is enclosed in a predetermined command (enclosed in "" below). Execute the command). It is assumed that vlan999 (LAN for monitor session 1) has already been set between SW1 and SW2.

[SW1 setting]
"Vlan999
remote-span
monitor session 1 source interface GigabitEthernet 0/1
monitor session 1 destination remote vlan999 ”

[SW2 setting]
"Vlan999
remote-span
monitor session 1 source remote vlan999
monitor session 1 destination interface GigabitEthernet 0/3 ”

Next, the control unit 11 of the data acquisition device 10 acquires communication data in the captured data (transmission / reception data of the measurement target server 50, transmission / reception data of terminals 51 to 55 of the top talker top 5) input from the LAN connection unit 15. As information, the data acquisition start date and time are simultaneously assigned and stored in the communication data acquisition information 18 in the storage unit 16 (step A22 in FIG. 4).

Finally, the control unit 11 of the data acquisition device 10 outputs a message of "capture data acquisition completed" from the output unit 13 (step A23 in FIG. 4), and then ends.

According to the first embodiment, the client server system by registering and using the IP address related to the measurement target server 50 and the port number used by the application in which the failure occurs in the data acquisition device 10 in advance. In No. 1, even if an intermittent failure occurs such that the processing performance is intermittently deteriorated, the communication data for specifying the intermittent failure can be acquired.

Further, according to the first embodiment, even in the case of a failure in which the client cannot be identified due to a failure in the client-server system 1 in which the processing performance sometimes deteriorates due to the data acquisition device 10. , It is possible to acquire each transmission / reception data of the measurement target server 50 and the terminals 51 to 55 of the top talker top 5 for determining the deterioration of the processing performance and identifying the cause of the failure when the processing performance is lowered. As a result, it is not necessary to set the LAN port for packet capture after the failure, no specialized skill is required, and even if the failure location is far away from the data acquisition device, data can be acquired immediately.

[Embodiment 2]
The data acquisition device according to the second embodiment will be described with reference to the drawings. FIG. 5 is a block diagram schematically showing the configuration of the data acquisition device according to the second embodiment.

The data acquisition device 110 is a device that acquires data from a client-server system 201 that communicably connects a plurality of clients 151, ..., 156 and the server 150 via at least one network device 120. The data acquisition device 110 has a connection unit 114 that is communicably connected to any one of at least one network device 120. The data acquisition device 110 has a storage unit 116 that stores the IP address of the server 150. The data acquisition device 110 has a control unit 111 that controls the connection unit 114 and the storage unit 116 and performs predetermined information processing.

The control unit 111 includes the IP address of the server 150 stored in the storage unit 116, the ARP table information of the network device 120 directly connected to the data acquisition device 110, and all the MACs of at least one network device 120. Based on the address table information, the process of identifying the port of the network device 120 to which the server 150 is connected is performed. The control unit 111 performs a process of setting monitoring for the port of the network device 120 to which the server 150 is connected. The control unit 111 assigns an IP address corresponding to the port corresponding to the first predetermined number of ports from the network device 120 to which the server 150 is connected, which has the largest amount of communication data among the ports for which monitoring is set. Performs processing to acquire monitoring information including. Based on the acquired monitoring information, ARP table information, and MAC address table information, the control unit 111 has the first predetermined number from the port for which monitoring is set, which has the largest amount of communication data. Performs a process of identifying a port that falls within the second predetermined number of ranks that is less than. The control unit 111 performs a process of setting a capture for a port that enters the second predetermined number of ranks. The control unit 111 performs a process of setting the network device 120 to which the data acquisition device 110 is connected to output the communication data of the port for which the capture is set.

According to the second embodiment, by registering and using the IP address related to the server 150 in the data acquisition device 110 in advance, the client-server system 201 has an intermittent failure in which the processing performance is intermittently deteriorated. Even if the above occurs, communication data that identifies the intermittent failure can be acquired.

The data acquisition device according to the first and second embodiments can be configured by so-called hardware resources (information processing device, computer), and one having the configuration illustrated in FIG. 6 can be used. For example, the hardware resource 100 includes a processor 101, a memory 102, a network interface 103, and the like, which are connected to each other by an internal bus 104.

The configuration shown in FIG. 6 is not intended to limit the hardware configuration of the hardware resource 100. The hardware resource 100 may include hardware (for example, an input / output interface) (not shown). Alternatively, the number of units such as the processor 101 included in the device is not limited to the example of FIG. 6, and for example, a plurality of processors 101 may be included in the hardware resource 100. For the processor 101, for example, a CPU (Central Processing Unit), an MPU (Micro Processor Unit), a GPU (Graphics Processing Unit), or the like can be used.

For the memory 102, for example, a RAM (Random Access Memory), a ROM (Read Only Memory), an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like can be used.

For the network interface 103, for example, a LAN (Local Area Network) card, a network adapter, a network interface card, or the like can be used.

The function of the hardware resource 100 is realized by the above-mentioned processing module. The processing module is realized, for example, by the processor 101 executing a program stored in the memory 102. In addition, the program can be downloaded via a network or updated using a storage medium in which the program is stored. Further, the processing module may be realized by a semiconductor chip. That is, the function performed by the processing module may be realized by executing software on some hardware.

Some or all of the above embodiments may also be described, but not limited to:

[Appendix 1]
In the present invention, the form of the data acquisition device according to the first viewpoint is possible.

[Appendix 2]
The connection part
A first connection unit that is communicably connected to any one of the at least one network device using the first communication standard.
A second connection unit that is communicably connected to any one of the at least one network device using a second communication standard different from the first communication standard.
Have,
The control unit
A process for identifying a port of the network device to which the server is connected, a process for setting the monitoring, a process for acquiring the monitoring information, a process for identifying the port in the second predetermined number of orders, and a process for specifying the port. , The process of setting the capture is performed through the first connection portion.
The process of setting to output the communication data of the port of the network device for which the capture is set is performed through the second connection unit.
To control,
The data acquisition device according to Appendix 1.

[Appendix 3]
The first connection unit is an interface for transmitting and receiving information using the interface standard of the serial port.
The second connection unit is an interface for transmitting and receiving information using the interface standard of the LAN port.
The data acquisition device according to Appendix 2.

[Appendix 4]
In the process of identifying the port of the network device to which the server is connected,
A process of acquiring the ARP table information associated with an IP address and a MAC address from the network device directly connected to the data acquisition device, and
Using the acquired ARP table information, a process of specifying the MAC address corresponding to the IP address of the server stored in the storage unit, and
The process of acquiring MAC address table information from all of the at least one network device, and
Using the acquired MAC address table information, the process of identifying the port of the network device to which the server is connected based on the MAC address of the identified server, and
I do,
The data acquisition device according to any one of Supplementary note 1 to 3.

[Appendix 5]
In the process of acquiring the MAC address table information, when the MAC address table information is acquired from a network device other than the network device directly connected to the data acquisition device, the other network device is subjected to the process. Connect remotely,
The data acquisition device according to Appendix 4.

[Appendix 6]
In the process of identifying the port that falls in the second predetermined number of ranks,
Using the acquired monitoring information, a process of identifying an IP address corresponding to the port in the second predetermined number of ranks, and
Using the acquired ARP table information, a process of specifying a MAC address corresponding to the IP address corresponding to the port corresponding to the specified second predetermined number of ranks, and
Using the acquired MAC address table information, processing to specify the port that falls in the order of the specified MAC address, and
I do,
The data acquisition device according to any one of Appendix 1 to 5.

[Appendix 7]
In the process of acquiring the monitoring information,
A process of performing a communication confirmation test on the IP address of the server, and
A process of comparing the current response time by the communication confirmation test with the previous response time and determining whether or not the delay is more than a predetermined ratio.
A process of acquiring the monitoring information at the port for which the monitoring is set from the network device to which the server is connected when the delay is made by the predetermined ratio or more.
I do,
The data acquisition device according to any one of Supplementary notes 1 to 6.

[Appendix 8]
In the present invention, the form of the client-server system according to the second viewpoint is possible.

[Appendix 9]
In the present invention, the form of the data acquisition method according to the third viewpoint is possible.

[Appendix 10]
In the present invention, the form of the program according to the fourth viewpoint is possible.

The disclosure of the above patent documents shall be incorporated into this document by citation. Within the framework of the entire disclosure of the present invention (including the scope of claims and drawings), it is possible to change or adjust the embodiments or examples based on the basic technical idea thereof. Further, various combinations or selections (necessary) of various disclosure elements (including each element of each claim, each element of each embodiment or embodiment, each element of each drawing, etc.) within the framework of all disclosure of the present invention. (Not selected) is possible. That is, it goes without saying that the present invention includes all disclosures including claims and drawings, and various modifications and modifications that can be made by those skilled in the art in accordance with technical ideas. In addition, regarding the numerical values and numerical ranges described in the present application, it is considered that arbitrary intermediate values, lower numerical values, and small ranges are described even if not specified.

1,201 Client-server system 10,110 Data acquisition device 11,111 Control unit 12 Input unit 13 Output unit 14 Serial connection unit (first connection unit)
15 LAN connection (second connection)
16, 116 Storage unit 17 Device information 17a Layer 3 switch information 17b Layer 2 switch information 17c Communication confirmation test result 18 Communication data acquisition information 19 Switch control tool 20 Layer 3 switch 21 Control unit 22 Storage unit 23 Console port 24-31 LAN port 40 Layer 2 switch 41 Control unit 42 Storage unit 43 to 45 LAN port 50 Measurement target server 51 to 56 Terminal 60 Serial cable 61 to 66, 71 to 73 LAN cable 100 Hardware resource 101 Processor 102 Memory 103 Network interface 104 Internal bus 114 Connection 120 Network equipment 150 Server 151, 156 Client

Claims (10)

A data acquisition device that acquires data from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device.
A connection unit that is communicably connected to any one of the at least one network device,
A storage unit that stores the IP address related to the server,
A control unit that controls the connection unit and the storage unit and performs predetermined information processing,
With
The control unit
The IP address of the server stored in the storage unit, ARP table information of the network device directly connected to the data acquisition device, and all MAC address table information of the at least one network device. The process of identifying the port of the network device to which the server is connected based on
A process of setting monitoring for the port of the network device to which the server is connected, and
Monitoring information including the IP address corresponding to the port corresponding to the first predetermined number of ports from the network device to which the server is connected to the port to which the monitoring is set and which has the largest amount of communication data. And the process of getting
Based on the acquired monitoring information, the ARP table information, and the MAC address table information, the first predetermined number from the port having the largest amount of communication data among the ports for which the monitoring is set. The process of identifying ports that fall into the second predetermined number of ranks, which is less than
The process of setting capture for the port that falls into the second predetermined number of ranks,
A process of setting the network device to which the data acquisition device is connected to output communication data of the port for which the capture is set, and a process of setting the communication data to be output.
I do,
Data acquisition device. The connection part
A first connection unit that is communicably connected to any one of the at least one network device using the first communication standard.
A second connection unit that is communicably connected to any one of the at least one network device using a second communication standard different from the first communication standard.
Have,
The control unit
A process for identifying a port of the network device to which the server is connected, a process for setting the monitoring, a process for acquiring the monitoring information, a process for identifying the port in the second predetermined number of orders, and a process for specifying the port. , The process of setting the capture is performed through the first connection portion.
The process of setting to output the communication data of the port of the network device for which the capture is set is performed through the second connection unit.
To control,
The data acquisition device according to claim 1. The first connection unit is an interface for transmitting and receiving information using the interface standard of the serial port.
The second connection unit is an interface for transmitting and receiving information using the interface standard of the LAN port.
The data acquisition device according to claim 2. In the process of identifying the port of the network device to which the server is connected,
A process of acquiring the ARP table information associated with an IP address and a MAC address from the network device directly connected to the data acquisition device, and
Using the acquired ARP table information, a process of specifying the MAC address corresponding to the IP address of the server stored in the storage unit, and
The process of acquiring MAC address table information from all of the at least one network device, and
Using the acquired MAC address table information, the process of identifying the port of the network device to which the server is connected based on the MAC address of the identified server, and
I do,
The data acquisition device according to any one of claims 1 to 3. In the process of acquiring the MAC address table information, when the MAC address table information is acquired from a network device other than the network device directly connected to the data acquisition device, the other network device is subjected to the process. Connect remotely,
The data acquisition device according to claim 4. In the process of identifying the port that falls in the second predetermined number of ranks,
Using the acquired monitoring information, a process of identifying an IP address corresponding to the port in the second predetermined number of ranks, and
Using the acquired ARP table information, a process of specifying a MAC address corresponding to the IP address corresponding to the port corresponding to the specified second predetermined number of ranks, and
Using the acquired MAC address table information, processing to specify the port that falls in the order of the specified MAC address, and
I do,
The data acquisition device according to any one of claims 1 to 5. In the process of acquiring the monitoring information,
A process of performing a communication confirmation test on the IP address of the server, and
A process of comparing the current response time by the communication confirmation test with the previous response time and determining whether or not the delay is more than a predetermined ratio.
A process of acquiring the monitoring information at the port for which the monitoring is set from the network device to which the server is connected when the delay is made by the predetermined ratio or more.
I do,
The data acquisition device according to any one of claims 1 to 6. With multiple clients
With the server
At least one network device that communicably connects the plurality of clients and the server,
The data acquisition device according to any one of claims 1 to 7.
To prepare
Client-server system. A data acquisition method that uses a data acquisition device to acquire data from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device.
Based on the IP address of the server stored in advance, the ARP table information of the network device directly connected to the data acquisition device, and all the MAC address table information of the at least one network device. The step of identifying the port of the network device to which the server is connected, and
A step of setting monitoring for the port of the network device to which the server is connected, and
Monitoring information including the IP address corresponding to the port corresponding to the first predetermined number of ports from the network device to which the server is connected to the port to which the monitoring is set and which has the largest amount of communication data. And the steps to get
Based on the acquired monitoring information, the ARP table information, and the MAC address table information, the first predetermined number from the port having the largest amount of communication data among the ports for which the monitoring is set. The step of identifying ports that fall into the second predetermined number of ranks, which is less than
The step of setting the capture for the port that enters the second predetermined number of ranks,
A step of setting the network device to which the data acquisition device is connected to output the communication data of the port for which the capture is set, and
I do,
Data acquisition method. A program that causes a data acquisition device to acquire data from a client-server system that connects a plurality of clients and servers in a communicable manner via at least one network device.
Based on the IP address of the server stored in advance, the ARP table information of the network device directly connected to the data acquisition device, and all the MAC address table information of the at least one network device. The process of identifying the port of the network device to which the server is connected, and
A process of setting monitoring for the port of the network device to which the server is connected, and
Monitoring information including the IP address corresponding to the port corresponding to the first predetermined number of ports from the network device to which the server is connected to the port to which the monitoring is set and which has the largest amount of communication data. And the process of getting
Based on the acquired monitoring information, the ARP table information, and the MAC address table information, the first predetermined number from the port having the largest amount of communication data among the ports for which the monitoring is set. The process of identifying ports that fall into the second predetermined number of ranks, which is less than
The process of setting capture for the port that falls into the second predetermined number of ranks,
A process of setting the network device to which the data acquisition device is connected to output communication data of the port for which the capture is set, and a process of setting the communication data to be output.
To execute,
program.

Images