Network communications analysis
View Patent ↗Network protocol communications used by an application are captured and analyzed. Routines corresponding to particular calls that an application invokes in implementing a targeted network communication protocol are hooked. A stub is called, which retains a current state of the application in a memory location that will not be compromised, and calls second stage code that makes the call on behalf of the application. Information corresponding to the performance of the call is captured and may be variously analyzed. Upon a completion of call, control is returned to the stub, which restores and adjusts the application state to reflect the actual performance of the particular call. The stub can also restore the application and allow the call to proceed transparently to the application, should the monitoring process be terminated prior to completion of the call. In one embodiment, TCP/IP protocol communications are monitored by hooking socket calls made by an application.
1. A method for analyzing communications made by a mainframe application operating at a node on a computer network, the method comprising:
identifying, responsive to a communications analysis module beginning execution, a plurality of routines corresponding to socket calls within the application to select locations to hook the application in response to the application lacking predetermined locations to hook;
hooking the application at the selected locations by modifying routine entry points so as to additionally execute communications analysis code;
receiving a user request, the user request comprising an Internet Protocol (IP) port number and an IP address of a client system or a server system;
responsive to the received user request corresponding to a hooked location, executing the corresponding communications analysis code, the actions of the code comprising:
retaining a current set of state data of the application, wherein the state data if not retained would otherwise be modified by the communications analysis code;
making a communications call on behalf of the application, the communications call transparent to the application; and
storing in a file a set of information communicated in response to making the communications call.
2. The method of claim 1 , wherein hooking the application comprises executing an alternate routine in place of a routine that is normally executed when the communications call is made by the application.
3. The method of claim 1 , further comprising:
after making the communications call on behalf of the application, determining a completion of the communications call; and
returning information to provide a revised state of the application that reflects the completion of the communications call.
4. The method of claim 1 , further comprising:
determining a termination of communications monitoring prior to a completion of the communications call; and
providing a revised state of the application notwithstanding the termination of communications monitoring.
5. The method of claim 1 , wherein the communications call is a TCP/IP socket call.
6. The method of claim 2 , wherein the communications call is a TCP/IP socket call.
7. The method of claim 6 , wherein the set of information includes at least one of (a) data sent by the application and (b) data received by the application with the TCP/IP socket call.
8. The method of claim 6 , wherein the set of information includes an IP address for a partner in a communication corresponding to the TCP/IP socket call.
9. The method of claim 5 , wherein the communications call on behalf of the application is made responsive to a data length corresponding to the socket call being under a maximum data length.
10. The method of claim 5 , further comprising:
modifying a parameter list of the socket call to return peer information prior to hooking the application; and
restoring the parameter list after hooking the application.
11. The method of claim 1 , wherein the communications call is a secure sockets call.
12. The method of claim 11 , wherein the set of information includes data sent through a secure socket, and the data is in unencrypted form.
13. The method of claim 12 , wherein the set of information includes data received through a secure socket, and the data is in unencrypted form.
14. The method of claim 1 , wherein a stub retains the current state, determines a termination of communications monitoring prior to a completion of the call, and provides a revised state of the application notwithstanding the termination of communications monitoring.
15. The method of claim 1 , wherein the socket call for a TCP/IP communications protocol as implemented by an operating system of the client system or of the server system and the communications call is another socket call.
16. The method of claim 1 , wherein the communications are message queuing application communications and a program request handler program located in an Extended Common Storage Area (ECSA) is hooked.
17. A computer readable storage medium that stores a set of software instructions, which are executable to analyze communications made by a mainframe application operating at a node on a computer network, the instructions comprising:
identifying, responsive to a communications analysis module beginning execution, a plurality of routines corresponding to socket calls within the application to select locations to hook the application in response to the application lacking predetermined locations to hook;
hooking the application at the selected locations by modifying routine entry points so as to additionally execute communications analysis code;
receiving a user request, the user request comprising an Internet Protocol (IP) port number and an IP address of a client system or a server system;
responsive to the received user request corresponding to a hooked location, executing the corresponding communications analysis code, the actions of the code comprising:
retaining a current set of state data of the application, where the state data if not retained would otherwise be modified by the communications analysis code;
making a communications call on behalf of the application, wherein the communications call is transparent to the application; and
storing in a file a set of information communicated in response to making the call.
18. The computer readable storage medium of claim 17 , wherein the communications are message queuing application communications and a program request handler program located in an Extended Common Storage Area (ECSA) is hooked.
19. The storage medium of claim 17 , wherein the step of hooking the application comprises executing an alternate routine in place of a routine that is normally executed when the communications call is made by the application.
20. The storage medium of claim 17 , further comprising:
after making the communications call on behalf of the application, determining a completion of the communications call; and
returning information to provide a revised state of the application that reflects the completion of the communications call.
21. The storage medium of claim 17 , further comprising:
determining a termination of communications monitoring prior to a completion of the communications call; and
providing a revised state of the application notwithstanding the termination of communications monitoring.
22. The storage medium of claim 17 , wherein selected location is where the application utilizes a TCP/IP protocol and the call is a TCP/IP socket call.
23. The storage medium of claim 19 , wherein the selected location is where the application utilizes a TCP/IP protocol and the communications call is a TCP/IP socket call.
24. The storage medium of claim 23 , wherein the set of information includes at least one of (a) data sent by the application and (b) data received by the application with the TCP/IP socket call.
25. The storage medium of claim 23 , wherein the set of information includes an IP address for a partner in a communication corresponding to the TCP/IP socket call.
26. The storage medium of claim 17 , wherein the call is a secure socket call.
27. The storage medium of claim 26 , wherein the set of information includes data sent through a secure socket, and the data is in unencrypted from.
28. The storage medium of claim 26 , wherein the set of information includes data received through a secure socket, and the data is in unencrypted form.
29. The storage medium of claim 17 , wherein a stub retains the current state, determines a termination of communications monitoring prior to a completion of the call, and provides a revised state of the application notwithstanding the termination of communications monitoring.
30. An apparatus for analyzing communications made by a mainframe application operating at a node on a computer network, the apparatus comprising:
a call reception module, configured to receive a user request, the user request comprising an Internet Protocol (IP) port number and an IP address of a client system or a server system;
a call identification module, configured to identify responsive to a communications analysis module beginning execution a plurality of routines corresponding to socket calls within the application to select locations to hook the application in response to the application lacking predetermined locations to hook and configured to hook the application at the selected locations by modifying routine entry points so as to additionally execute communications analysis code;
an access control module, in communication with the call identification module, configured to retain a current set of state data of the application and make a communications call on behalf of the application, wherein the communications call is transparent to the application, and wherein the state data if not retained would otherwise be modified by the communications analysis code; and
an information recording module, in communication with the access control module, configured to store in a file a set of information communicated in response to making the call.
31. The apparatus of claim 30 , wherein the communications are message queuing application communications and a program request handler program located in an Extended Common Storage Area (ECSA) is hooked.
32. The apparatus of claim 30 , wherein the call identification module is configured to execute an alternate routine in place of a routine that is normally executed when the communications call is made by the application.
33. The apparatus of claim 30 , wherein the access control module is configured to determine a completion of the communications call after making the communications call on behalf of the application, and returns information to provide a revised state of the application that reflects the completion of the communications call.
34. The apparatus of claim 30 , wherein the access control module is configured to determine a termination of communications monitoring prior to a completion of the communications call, and provides a revised state of the application notwithstanding the termination of communications monitoring.
35. The apparatus of claim 30 , wherein the selected location is where the application utilizes a TCP/IP protocol and the call is a TCP/IP socket call.
36. The apparatus of claim 32 , wherein the selected location is where the application utilizes a TCP/IP protocol and the communications call is a TCP/IP socket call.
37. The apparatus of claim 36 , wherein the set of information includes at least one of (a) data sent by the application and (b) data received by the application with the TCP/IP socket call.
38. The apparatus of claim 36 , wherein the set of information includes an IP address for a partner in a communication corresponding to the TCP/IP socket call.
39. The apparatus of claim 30 , wherein the communications call is a secure socket call.
40. The apparatus of claim 39 , wherein the set of information includes data sent through a secure socket, and the data is in unencrypted form.
41. The apparatus of claim 39 , wherein the set of information includes data received through a secure socket, and the data is in unencrypted form.
42. The apparatus of claim 30 , wherein a stub retains the current state, determines a termination of communications monitoring prior to a completion of the call, and provides a revised state of the application notwithstanding the termination of communications monitoring.
43. An apparatus for analyzing communications made by a mainframe application operating at a node on a computer network, the apparatus comprising:
means for identifying, responsive to a communications analysis module beginning execution, a plurality of routines corresponding to socket calls within the application to select locations to hook the application in response to the application lacking predetermined locations to hook;
means for hooking the application at the selected locations by modifying routine entry points so as to additionally execute communications analysis code;
means for receiving a user request, the user request comprising an Internet Protocol (IP) port number and an IP address of a client system or a server system;
means for, responsive to the received user request corresponding to a hooked location, executing the corresponding communications analysis code, the actions of the code comprising:
retaining a current set of state data of the application, wherein the state data if not retained would otherwise be modified by the communications analysis code, and making a communications call on behalf of the application, wherein the communications call is transparent to the application; and
means for-storing in a file a set of information communicated in response to making the call.
44. The apparatus of claim 43 , wherein the communications are message queuing application communications and a program request handler program located in an Extended Common Storage Area (ECSA) is hooked.
45. The apparatus of claim 43 , wherein the application is hooked by executing an alternate routine in place of a routine that is normally executed when the communications call is made by the application.
46. The apparatus of claim 43 , further comprising:
means for determining a completion of the communications call after making the communications call on behalf of the application, and returning information to provide a revised state of the application that reflects the completion of the communications call.
47. The apparatus of claim 43 , further comprising:
means for determining a termination of communications monitoring prior to a completion of the communications call, and providing a revised state of the application notwithstanding the termination of communications monitoring.
48. The apparatus of claim 43 , wherein the selected location is where the application utilizes a TCP/IP protocol and the call is a TCP/IP socket call.
49. The apparatus of claim 45 , wherein the selected location is where the application utilizes a TCP/IP protocol and the communications call is a TCP/IP socket call.
50. The apparatus of claim 49 , wherein the set of information includes at least one of (a) data sent by the application and (b) data received by the application with the TCP/IP socket call.
51. The apparatus of claim 49 , wherein the set of information includes an IP address for a partner in a communication corresponding to the TCP/IP socket call.
52. The apparatus of claim 43 , wherein the communications call is a secure socket call.
53. The apparatus of claim 52 , wherein the set of information includes data sent through a secure socket, and the data is in unencrypted form.
54. The apparatus of claim 52 , wherein the set of information includes data received through a secure socket, and the data is in unencrypted form.
55. The apparatus of claim 43 , wherein a stub retains the current state, determines a termination of communications monitoring prior to a completion of the call, and provides a revised state of the application notwithstanding the termination of communications monitoring.