Packet capture device and method

1 . A packet capturing device comprising:

a memory storage comprising instructions; and

one or more processors in communication with the memory storage, wherein the one or more processors execute the instructions to:

receive an instruction to start capturing from outside the packet capturing device;

accumulate, from among packets flowing through a network that is a monitoring target, first packets that match conditions of a target flow registered in a first flow table in response to the instruction to start capturing, wherein the conditions of the target flow designated by the instruction to start capturing are registered in the first flow table, and wherein the instructions to accumulate the first packets include specific instructions to:

allow only the first packets that match the conditions registered in the first flow table to pass through a first filter from among the packets received from the network;

accumulate, by a first buffer, the first packets that have passed through the first filter; and

convert the first packets accumulated in the first buffer into a first captured file;

accumulate second packets received from the network in a second buffer with a ring buffer structure during a period based on the conditions of the target flow to be registered in the first flow table after arrival of the instruction to start capturing; and

convert the second packets into a second captured file;

wherein an instruction to stop accumulation of the second packets to the second buffer is performed when registration in the first flow table is completed, and

wherein an instruction to restart accumulation of packets to the second buffer is performed when an output of the second captured file generated from the second packets accumulated in the second buffer is completed.

2 . The packet capturing device according to claim 1 ,

wherein the instructions to convert the second packets into the second captured file include specific instructions to selectively convert only the second packets that match the conditions of the target flow into the second captured file from among the second packets.

3 . The packet capturing device according to claim 2 wherein the conditions of the target flow are stored in a second flow table, wherein the conditions of the target flow designated by the instruction to start capturing are registered in the second flow table, and wherein the instructions to accumulate the second packets and convert the second packets into the second captured file include specific instructions to:

accumulate the second packets received from the network in the second buffer with the ring buffer structure; and

selectively convert only the second packets that match the conditions registered in the second flow table into the second captured file from among the second packets accumulated in the second buffer.

4 . The packet capturing device according to claim 1 , the instructions include further instructions to:

perform matching between the conditions registered in the first flow table and packets received from the network to obtain a matching result, wherein the instructions to accumulate the second packets comprises specific instructions to:

accumulate only the second packets from which the matching result indicates do not match the conditions registered in the first flow table from among the packets received from the network during the period.

5 . The packet capturing device according to claim 4 , wherein the conditions of the target flow are stored in the first flow table, wherein the conditions of the target flow designated by the instruction to start capturing are registered in the first flow table, and wherein the instructions to accumulate the first packets and convert the first packets into the first captured file include specific instructions to:

allow only the first packets that match the conditions registered in the first flow table to pass through the first filter from among the packets received from the network and output the matching result;

accumulate, by the first buffer, the first packets that have passed through the first filter; and

convert the first packets accumulated in the first buffer into the first captured file.

6 . The packet capturing device according to claim 5 , wherein the conditions of the target flow are stored in a second flow table, wherein the conditions of the target flow designated by the instruction to start capturing is registered in the second flow table, and wherein the instructions to accumulate the second packets and convert the second packets into the second captured file include specific instructions to:

allow only the second packets from which the matching result indicating that the packets do not match the conditions registered in the first flow table has been obtained to pass through a second filter from among the packets received from the network;

accumulate the second packets that have passed through the second filter in the second buffer with the ring buffer structure; and

convert the second packets accumulated in the second buffer into the second captured file.

7 . The packet capturing device according to claim 1 , wherein the one or more processors execute instructions to store the first captured file and the second captured file in the memory storage, and wherein the instructions include further instructions to:

perform control to place priority on writing of the first captured file when the first captured file is written in the memory storage.

8 . A packet capturing method comprising:

a first step of registering conditions of a target flow designated by an instruction to start capturing in a flow table;

a second step of accumulating, in a first buffer, first packets that match the conditions of the target flow registered in the flow table from among packets flowing through a network that is a monitoring target, and allowing only the first packets that match the conditions registered in the flow table to pass through a first filter from among the packets received from the network;

a third step of converting the first packets accumulated in the first buffer into a first captured file;

a fourth step of accumulating, in a second buffer with a ring buffer structure, second packets received from the network during a period based on the conditions of the target flow to be registered in the flow table after arrival of the instruction to start capturing;

a fifth step of converting the second packets accumulated in the second buffer into a second captured file;

a sixth step of stopping accumulation of the second packets to the second buffer when registration in the flow table is completed; and

a seventh step of restarting accumulation of packets to the second buffer when an output of the second captured file generated from the second packets accumulated in the second buffer is completed.

9 . The packet capturing device according to claim 1 , wherein the first buffer is a first-in first-out (FIFO) buffer.

10 . The packet capturing device according to claim 1 , wherein the one or more processors execute the instructions to convert the first packets accumulated in the first buffer into the first captured file when an amount of packets accumulated in the first buffer reaches a predetermined amount or a predetermined time elapses.

11 . The packet capturing device according to claim 1 , wherein the packets flowing through the network are mirroring packets generated by a mirroring function of a device on the network.

12 . The packet capturing method according to claim 8 , wherein the fifth step includes selectively converting only the second packets that match the conditions of the target flow registered in the flow table into the second captured file from among the second packets accumulated in the second buffer.

13 . The packet capturing method according to claim 8 , further comprising performing matching between the conditions registered in the flow table and packets received from the network to obtain a matching result every time a packet is received from the network, and wherein the fourth step comprises accumulating only second packets from which the matching result indicates the packets do not match the conditions registered in the flow table from among the packets received from the network during the period.

14 . The packet capturing method according to claim 8 , further comprising storing the first captured file and the second captured file in a storage unit, and placing priority on writing of the first captured file to the storage unit over the second captured file.

15 . The packet capturing method according to claim 8 , wherein the second buffer has a capacity capable of accumulating packets corresponding to a time that is longer than the period based on the conditions of the target flow to be registered in the flow table after arrival of the instruction to start capturing.

16 . A non-transitory computer-readable medium storing a program that causes a computer to execute:

receiving an instruction to start capturing of a target flow from outside;

registering conditions of the target flow designated by the instruction to start capturing in a first flow table and a second flow table;

accumulating, in a ring buffer, packets received from a network that is a monitoring target;

stopping accumulation of packets in the ring buffer when registration in the first flow table and the second flow table is completed;

selectively converting only packets that match conditions registered in the second flow table into a second captured file from among packets accumulated in the ring buffer;

restarting accumulation of packets in the ring buffer when an output of the second captured file generated from the packets accumulated in the ring buffer is completed;

allowing only packets that match conditions registered in the first flow table to pass through a filter from among packets received from the network;

accumulating, by a buffer, the packets that have passed through the filter; and

converting the packets accumulated in the buffer into a first captured file.

17 . The non-transitory computer-readable medium according to claim 16 , wherein the ring buffer overwrites an oldest accumulated packet with a latest packet when the ring buffer becomes full.

18 . The non-transitory computer-readable medium according to claim 16 , the program further causing the computer to execute storing the first captured file and the second captured file in a storage unit, and placing priority on writing of the first captured file to the storage unit over writing of the second captured file to the storage unit.

19 . The non-transitory computer-readable medium according to claim 16 , wherein the conditions of the target flow include a transmission source MAC address, a destination MAC address, and an IP address.

20 . The non-transitory computer-readable medium according to claim 16 , wherein the packets received from the network are mirroring packets generated by a mirroring function of a device on the network.