Abstract: An embodiment is a traffic monitoring device configured to acquire traffic statistical information of a flow in the monitoring target network, determine whether the acquired traffic statistical information satisfies a predetermined reference for failure detection, capture packets of the flow determined to satisfy the predetermined reference as packets at the time of failure occurrence in the flow, and dynamically update the predetermined reference while the device is still acquiring traffic statistical information of the flow in the monitoring target network.

Abstract: A packet capturing device includes: a normal capturing function unit that accumulates packets that match conditions of a target flow registered in a flow table in response to an instruction to start capturing from outside and converts the accumulated packets into a captured file, from among packets flowing through a network that is a monitoring target; and a short-term capturing function unit that accumulates the packets received from the network during a period needed by the conditions of the target flow to be registered in the flow table from arrival of the instruction to start capturing and converts the accumulated packets into a captured file

Abstract: An embodiment packet capture method includes steps of imparting a flag for each data of a received and divided packet, a step of writing the data in a ring buffer, steps of issuing a failure detection trigger when a cumulative value of the number of bytes of the packet within a period of failure detection exceeds a failure detection threshold value, steps of stopping writing to the ring buffer when writing to the ring buffer reaches or exceeds a writing stop address determined on the basis of the failure detection trigger, a step of reading data sequentially from the writing stop address, and steps of outputting a packet capture depending on the result determined based on the flags of the read data.

Abstract: An embodiment is a data sequence correction method. The data sequence correction method including temporarily saving data with sequence information imparted thereto in a ring buffer, the ring buffer having a predetermined number of storage regions corresponding to the sequence information, and being provided with a monitoring section made up of one, or two or more consecutive sequence numbers, and an acceptance section in which a start or a second sequence number of the monitoring section is a start sequence number, and the sequence number ahead by a count of storage regions of the ring buffer including the start of the monitoring section is an end sequence number.

Abstract: A packet processing apparatus includes a packet processor that performs processing on a packet received from a communication line and outputs data that is a result of the processing, a data combiner that concatenates a plurality of pieces of data output from the packet processor to generate a data block, and a combination data transferor that DMA-transfers the data block generated by the data combiner to a data memory. The combination data transferor writes information on an address in the data memory of a beginning of an individual piece of data in the data block to a descriptor that is a data area on a predetermined memory.

Abstract: The packet processing apparatus includes a packet memory, a transmission processing unit that writes a plurality of packets to be transmitted to the packet memory to generate a combination packet into which the plurality of packets have been concatenated, a line handling unit that sends packets to a communication line, and a combination packet transfer unit that DMA-transfers the combination packet from the packet memory to the line handling unit. The transmission processing unit writes information on an address in the packet memory of beginning data of an individual packet in the combination packet to a descriptor. The line handling unit separates the DMA-transferred combination packet into a plurality of packets and sends the plurality of packets to the communication line.

Abstract: A traffic monitoring apparatus includes: a header analysis circuit configured to acquire one or more identifiers from a header of a received packet; a rule registration circuit configured to convert a rule table including rules in which one or more rule elements are registered for each of the rules into a predetermined format and register the rule table in a rule matching circuit; and the rule matching circuit configured to search for rules to be matched with the acquired identifiers.

Abstract: A data sequence correction method for temporarily saving data with sequence information in a ring buffer and performing sequence correction is provided. The ring buffer includes a number of storage regions, a monitoring section having one or more continuous sequence numbers, and an acceptance section having a first or second sequence number of the monitoring section as a start sequence number and a sequence number immediately preceding the start sequence number of the monitoring section as an end sequence number. The method includes, when a value determined based on a remainder obtained by dividing a sequence number of received data by the number of storage regions is inside the acceptance section, writing the received data in a position of the storage region corresponding to the determined value, and when data are written in the entire monitoring section, reading out all the data in the monitoring section.

Abstract: A state detection circuit compares a target connection with an immediate previous connection based on an identifier of an incoming packet and detects a post-transitional state of the target connection based on a control flag of the incoming packet and on a pre-transitional state of the target connection detected just before if the target connection is identical with the immediate previous connection; and a connection counting circuit increments or decrements the number of target connections only when the detected post-transitional state indicates a start or end of the target connection.

Abstract: A packet capture apparatus includes a hardware processing unit including a filter that filters packets input from a network and an NIC and a packet storage that stores packets input from the hardware processing unit. The filter includes a packet input that receives packets input from the network, a header analysis unit that analyzes a header structure of each packet input to the packet input unit and extracts a field value of a header of the packet, a rule table in which rules including a field value of a flow to be captured are recorded, a flow identification unit that identifies a flow in which the field value extracted by the header analysis unit matches a rule in the rule table and/or does not match the rule, and a packet output that outputs a packet of the flow identified by the flow identification unit to the NIC.

Abstract: An embodiment packet capture device comprises: a packet receiver configured to receive a packet from a network; a packet retainer configured to store the received packet in a memory to temporarily retain the received packet; a failure detector configured to determine a communication failure is present in the network; a capture controller configured to determine an operation stop address such that retention of packets from the network in time periods before and after a detection time point of the communication failure is ensured when the communication failure is detected by the failure detector; and a capture data generator configured to output the packet stored in the memory as capture data when a storage destination address of the packet stored in the memory has reached the operation stop address or when at least a predetermined waiting time period has elapsed from the detection time point of the communication failure.

Abstract: An embodiment is a data sequence correction method. The data sequence correction method including temporarily saving data with sequence information imparted thereto in a ring buffer, the ring buffer having a predetermined number of storage regions corresponding to the sequence information, and being provided with a monitoring section made up of one, or two or more consecutive sequence numbers, and an acceptance section in which a start or a second sequence number of the monitoring section is a start sequence number, and the sequence number ahead by a count of storage regions of the ring buffer including the start of the monitoring section is an end sequence number.

Abstract: In a recording device, a data memory including a DRAM having a write pointer for each of banks, and a queue control memory that stores an active flag is provided. When frame data is written into a write-target queue, a bank for which an active flag indicates an activated state is selected as a write-target bank among the banks to write the frame data, and if there is no bank for which an active flag indicates an activated state, a bank for which an active flag indicates a deactivated state is selected as a write-target bank, a row address of a write pointer of the bank is activated, and thereafter the frame data is written.

Abstract: A traffic monitoring apparatus includes: a header analysis circuit configured to acquire one or more identifiers from a header of a received packet; a rule registration circuit configured to convert a rule table including rules in which one or more rule elements are registered for each of the rules into a predetermined format and register the rule table in a rule matching circuit; and the rule matching circuit configured to search for rules to be matched with the acquired identifiers.

Abstract: A state detection circuit compares a target connection with an immediate previous connection based on an identifier of an incoming packet and detects a post-transitional state of the target connection based on a control flag of the incoming packet and on a pre-transitional state of the target connection detected just before if the target connection is identical with the immediate previous connection; and a connection counting circuit increments or decrements the number of target connections only when the detected post-transitional state indicates a start or end of the target connection.

Abstract: A network load balancing apparatus has a data buffer for each communication path of a received packet's transfer destinations, calculates a first hash value using a field value contained in the packet, determines, based on the field value of the packet or the first hash value, a communication path of a transfer destination of the packet subject to external transfer control for transmission to a predetermined external server, determines, based on the first hash value, a communication path of a transfer destination of the packet to be subject to priority control, determines, based on a second hash value based on the first hash value, a communication path of a transfer destination of the packet to be subject to load balancing control, to match a preset load balancing situation of the data buffer, and transmits the packet to a data buffer corresponding to the communication path of the transfer destination.

Abstract: A network load balancing apparatus has a data buffer provided to each communication path of transfer destinations of a received packet and being associated with a virtual function, determines a destination virtual function based on a field value of the received packet, determines a communication path of a transfer destination of a packet to be subject to priority control based on a first hash value calculated using the field value, determines a communication path of a transfer destination of a packet to be subject to load balancing control, to match a preset load balancing situation of the data buffer, based on a second hash value based on the first hash value, and transmits the packet to a data buffer corresponding to the destination virtual function and the communication path of the transfer destination.

Abstract: A burst traffic detection device includes a packet receiver configured to receive packets from a network, a flow specification device configured to specify, in accordance with header information of the packets, flow rules, a flow information storage device configured to store flow information of the specified flow rules, a statistical information storage device configured to store statistical information including the total number of packets for each flow rule and/or the total number of bytes for each flow rule, a burst detection device configured to detect the occurrence of burst traffic in accordance with the statistical information, and a detection count storage device configured to store the number of times of the occurrence of burst traffic.

Abstract: A data sequence correction method for temporarily saving data with sequence information in a ring buffer and performing sequence correction is provided. The ring buffer includes a number of storage regions, a monitoring section having one or more continuous sequence numbers, and an acceptance section having a first or second sequence number of the monitoring section as a start sequence number and a sequence number immediately preceding the start sequence number of the monitoring section as an end sequence number. The method includes, when a value determined based on a remainder obtained by dividing a sequence number of received data by the number of storage regions is inside the acceptance section, writing the received data in a position of the storage region corresponding to the determined value, and when data are written in the entire monitoring section, reading out all the data in the monitoring section.

Abstract: An embodiment packet capture device comprises: a packet receiver configured to receive a packet from a network; a packet retainer configured to store the received packet in a memory to temporarily retain the received packet; a failure detector configured to determine a communication failure is present in the network; a capture controller configured to determine an operation stop address such that retention of packets from the network in time periods before and after a detection time point of the communication failure is ensured when the communication failure is detected by the failure detector; and a capture data generator configured to output the packet stored in the memory as capture data when a storage destination address of the packet stored in the memory has reached the operation stop address or when at least a predetermined waiting time period has elapsed from the detection time point of the communication failure.