Abstract: A non-transitory computer-readable storage medium storing therein a packet analysis program for causing a computer to execute a process comprising detecting, from a plurality of received ACK packets, a successive ACK packet group including a plurality of ACK packets for which each reception interval is smaller than a first reference value and in which a round-trip time of each ACK packet becomes shorter in order of reception, and estimating wireless quality based on the number of ACK packets constituting the successive ACK packet group.

Abstract: A disclosed information processing apparatus includes a memory and a processor. And the processor is coupled to the memory and configured to: detect a first virtual node that is a bottleneck from among plural virtual nodes included in a virtual system; and identify a second virtual node that is a bottleneck based on a first number of cache misses that occurred when a first program for realizing the first virtual node was executed and a second number of cache misses that occurred when a second program for realizing a second virtual node that is other than the first virtual node was executed.

Abstract: A method for analyzing communication qualities between virtual machines serving as transmission sources and virtual machines serving as transmission destinations on a virtual network includes identifying, by a computer, based on the temporal sequence of the input queue information and the temporal sequence of the output queue information, a first pair and a second pair as mirroring targets, wherein the input queue information indicates a first queue length indicating a number of pieces of data addressed from one of the transmission sources to one of the transmission destinations, wherein the output queue information indicates a second queue length indicating a number of pieces of data included in an output queue of the one of the transmission destinations.

Abstract: A computer obtains a first packet group transmitted wirelessly by a first wireless communication apparatus and a second packet group transmitted wirelessly by a second wireless communication apparatus. The computer then detects a first non-communication period, during which there are no packets transmitted by the first wireless communication apparatus for a prescribed time or longer, and also detects a second non-communication period, during which there are no packets transmitted by the second wireless communication apparatus for the prescribed time or longer. The computer then determines based on an overlap between the first and second non-communication periods whether the first and second wireless communication apparatuses are connected to the same wireless base station.

Abstract: A non-transitory computer-readable storage medium storing therein a packet analysis program for causing a computer to execute a process comprising detecting, from a plurality of received ACK packets, a successive ACK packet group including a plurality of ACK packets for which each reception interval is smaller than a first reference value and in which a round-trip time of each ACK packet becomes shorter in order of reception, and estimating wireless quality based on the number of ACK packets constituting the successive ACK packet group.

Abstract: A method includes: recording information on a transmission source and a transmission destination in a received packet into first information; generating a copied packet by copying the received packet, the information of which is recorded in the first information, the first information being to be referred to when whether to generate a copied packet is determined based on a received packet; transmitting the generated copied packet to an analyzer device; receiving the copied packet; when it is determined that a predetermined condition is satisfied for the copied packet, transmitting instruction information for the copied packet to a first relay device among relay devices being a transmission source of the copied packet; and in response to reception of the instruction information, deleting, from the first information, the information on the transmission source and the transmission destination of the received packet used in the copying.

Abstract: A disclosed information processing apparatus includes a memory and a processor. And the processor is coupled to the memory and configured to: detect a first virtual node that is a bottleneck from among plural virtual nodes included in a virtual system; and identify a second virtual node that is a bottleneck based on a first number of cache misses that occurred when a first program for realizing the first virtual node was executed and a second number of cache misses that occurred when a second program for realizing a second virtual node that is other than the first virtual node was executed.

Abstract: A computer obtains a first packet group transmitted wirelessly by a first wireless communication apparatus and a second packet group transmitted wirelessly by a second wireless communication apparatus. The computer then detects a first non-communication period, during which there are no packets transmitted by the first wireless communication apparatus for a prescribed time or longer, and also detects a second non-communication period, during which there are no packets transmitted by the second wireless communication apparatus for the prescribed time or longer. The computer then determines based on an overlap between the first and second non-communication periods whether the first and second wireless communication apparatuses are connected to the same wireless base station.

Abstract: A method includes: extracting a partial character string including a reserved word and a character string immediately previous or subsequent to the reserved word from each of a plurality of pieces of target data, the plurality of pieces of target data conforming to a first pattern character string including the reserved word defined by a protocol; detecting target data including the partial character string among the plurality of pieces of target data; specifying a first partial character string from the extracted partial character string based on the detected target data; and creating, by a processor, a second pattern character string for classifying the plurality of pieces of target data based on the first pattern character string and the first partial character string.

Abstract: An apparatus acquires time-series information that stores information on a packet transmitted and received between a first apparatus and a second apparatus in association with a time at which the packet is transmitted or received. The apparatus estimates a window size indicating an amount of data that a receiver of the data is able to accept without acknowledging a sender of the data, based on the acquired time-series information, and, based on temporal change in the estimated window size, determines a type of congestion control being executed by the first apparatus, from among a plurality of candidate types of congestion control.

Abstract: A method for analyzing communication qualities between virtual machines serving as transmission sources and virtual machines serving as transmission destinations on a virtual network includes identifying, by a computer, based on the temporal sequence of the input queue information and the temporal sequence of the output queue information, a first pair and a second pair as mirroring targets, wherein the input queue information indicates a first queue length indicating a number of pieces of data addressed from one of the transmission sources to one of the transmission destinations, wherein the output queue information indicates a second queue length indicating a number of pieces of data included in an output queue of the one of the transmission destinations.

Abstract: A determination method executed by a processor included in a device configured to receive a plurality of copied packets, the determination method includes receiving a first copied packet that is a copy of a first packet including an identifier and session information; determining that the first copied packet is a duplicate packet when information of the identifier is stored in a memory; storing the information of the identifier in the memory when the information of the identifier is not stored in the memory; and deleting the information of the identifier stored in the memory when a second copied packet that is a copy of a second packet that includes session information indicating a session that is the same as a session indicated by the session information included in the first packet, a communication direction of the second packet being opposite to a communication direction of the first packet, is received.

Abstract: A method includes: recording information on a transmission source and a transmission destination in a received packet into first information; generating a copied packet by copying the received packet, the information of which is recorded in the first information, the first information being to be referred to when whether to generate a copied packet is determined based on a received packet; transmitting the generated copied packet to an analyzer device; receiving the copied packet; when it is determined that a predetermined condition is satisfied for the copied packet, transmitting instruction information for the copied packet to a first relay device among relay devices being a transmission source of the copied packet; and in response to reception of the instruction information, deleting, from the first information, the information on the transmission source and the transmission destination of the received packet used in the copying.

Abstract: A port switching method performed by a processor included in an analysis device coupled to a first port and a second port which are included in at least one of a plurality of switches, the port switching method includes receiving a first copy packet from the first port; determining whether the first copy packet succeeded a second copy packet based on sequence information of the first copy packet, and based on sequence information of a second copy packet received before the receiving; specifying a target port outputted the first copy packet to the first port, the target port being included in a target switch among the plurality of switches when it is determined that the first copy packet did not succeed the second copy packet; and causing the target switch to transmit, from the target port, a third copy packet generated at the target switch to the second port.

Abstract: A group of packets are extracted based on data captured from packets transmitted between communication apparatuses, where each packet has an identical transmission source address or an identical transmission destination address, and is transmitted in an identical connection. First and second beginning-packet candidates, which are transmitted within the identical connection, are identified based on a time difference of capturing individual packets included in the group of packets. A message length is calculated from lengths of packets including the first beginning packet candidate, captured before capturing the second beginning-packet candidate and after capturing the first beginning-packet candidate.

Abstract: A determination method executed by a processor included in a device configured to receive a plurality of copied packets, the determination method includes receiving a first copied packet that is a copy of a first packet including an identifier and session information; determining that the first copied packet is a duplicate packet when information of the identifier is stored in a memory; storing the information of the identifier in the memory when the information of the identifier is not stored in the memory; and deleting the information of the identifier stored in the memory when a second copied packet that is a copy of a second packet that includes session information indicating a session that is the same as a session indicated by the session information included in the first packet, a communication direction of the second packet being opposite to a communication direction of the first packet, is received.

Abstract: A method includes: extracting a partial character string including a reserved word and a character string immediately previous or subsequent to the reserved word from each of a plurality of pieces of target data, the plurality of pieces of target data conforming to a first pattern character string including the reserved word defined by a protocol; detecting target data including the partial character string among the plurality of pieces of target data; specifying a first partial character string from the extracted partial character string based on the detected target data; and creating, by a processor, a second pattern character string for classifying the plurality of pieces of target data based on the first pattern character string and the first partial character string.

Abstract: A port switching method performed by a processor included in an analysis device coupled to a first port and a second port which are included in at least one of a plurality of switches, the port switching method includes receiving a first copy packet from the first port; determining whether the first copy packet succeeded a second copy packet based on sequence information of the first copy packet, and based on sequence information of a second copy packet received before the receiving; specifying a target port outputted the first copy packet to the first port, the target port being included in a target switch among the plurality of switches when it is determined that the first copy packet did not succeed the second copy packet; and causing the target switch to transmit, from the target port, a third copy packet generated at the target switch to the second port.

Abstract: An analyzing apparatus including includes a memory and a processor that executes a procedure, the procedure including controlling the memory to store logs of communication between a first apparatus and a second apparatus, and logs of communication between the second apparatus and a third apparatus, and extracting logs indicating a pair of a first request and a first response corresponding to the first request, communicated between the second apparatus and the third apparatus within a time range from transmission of a second request, transmitted from the first apparatus to the second apparatus, to transmission of a second response corresponding to the second request, transmitted from the second apparatus to the first apparatus, from among the logs stored in the memory.

Abstract: A system analysis apparatus includes a message reconstruction module which reconstructs observed data and data of which the observation has failed, into messages regarding a request and a response which are communicated on a system. The apparatus includes a message candidate extraction module which compares message rules with the reconstructed messages, and extracts messages in the message rules which are identical to the reconstructed messages, from the messages defined in the message rules, as message candidates. The apparatus includes a call relationship extraction module which extracts a call relationship between the message candidates. The apparatus includes a matching module which compares transaction models in which processes in units of transactions on the system have been modeled on the basis of call relationships among the processes on the system, with the extracted call relationship, and selects and determines a transaction model identical to the call relationship.