JP2013168771A - Network monitoring system and method for specifying duplicated mac address - Google Patents

Abstract

Provided is a network monitoring system for identifying a duplicate MAC address that detects duplicate MAC addresses that are distinguished from movement of a terminal having a MAC address including a VLAN network and a virtual machine without being affected by clearing table information of the network device. To do.
A network monitoring system includes a MAC address history information storing a history of MAC address related information to which a status indicating a state transition of a MAC address is added, and a MAC address table managed by the network device. Acquisition means for acquiring MAC address related information registered when a terminal is connected as current information, and using the MAC address in the current information as a query key, past MAC address related information from the MAC address history information Extraction means for extracting as history information, and duplicate detection determination processing means for comparing the current information with the history information and detecting MAC address duplication.
[Selection] Figure 1

Description

  The present invention relates to a network monitoring system and a monitoring method for monitoring a device having a MAC address connected to a network and identifying a duplicate MAC address.

  In a network environment consisting of virtual machines and network devices that are virtually built in a physical server, if the MAC (Media Access Control) address set when creating a virtual machine is duplicated, the MAC address is duplicated. In some cases, normal communication cannot be performed with a virtual machine that is running. Normally, the MAC address does not overlap because the number unique to each vendor is combined with the number that the vendor uniquely assigns to the Ethernet (registered trademark) card. However, when creating a virtual machine, the MAC address set by user operation is arbitrarily determined In some cases, a plurality of virtual machines having the same MAC address may exist on the network due to human error.

  Conventionally, the MAC address registered when a terminal is connected to a network device is stored as table information in association with the connected port information, and MAC address duplication is detected from the difference from the stored contents of the table information within a fixed time There is a technique (see, for example, Patent Document 1).

JP 2009-0665303

  According to Patent Document 1, in order to detect duplication of a MAC address, table information within a certain period of time is associated with table information in which information about a port connected to a MAC address registered when a terminal is connected to a network device is associated. The duplication of the MAC address is detected from the difference from the stored content. However, when the maintenance operator clears the table information for maintenance or the like in the network device, there is a problem that the information held in the table is lost.

  In addition, when the network is logically divided by VLAN in the layer 2 function, if MAC address duplication occurs in the same VLAN network, it affects communication, but if MAC address duplication occurs in different VLAN networks There is no problem. Thus, even if the MAC address is duplicated, there may be no problem in communication, and it is necessary to distinguish the VLAN network and detect the MAC address duplication.

  Therefore, the present invention solves the above problems, detects the MAC address duplication that is not affected by the clearing of the table information of the network device, and distinguishes the movement of the terminal having the MAC address including the VLAN network and the virtual machine. It is an object to provide a network monitoring system and a monitoring method for specifying a MAC address.

  In order to solve the above problems, a network monitoring system according to the present invention includes MAC address history information for storing a history of MAC address related information to which a status indicating MAC address state transition is added, and a MAC address table managed by the network device. From the MAC address history information, the acquisition means for acquiring the MAC address related information registered when the terminal is connected to the network device as current information, and the MAC address in the current information as a query key. Extraction means for extracting MAC address related information as history information, and duplicate detection determination processing means for comparing the current information with the history information and detecting duplicate MAC addresses.

  Further, it is preferable that the MAC address related information includes a VLAN, and the duplicate detection determination processing unit does not determine that the MAC address is duplicated when the MAC address is the same and the VLAN is different.

  Further, the duplicate detection determination processing means is performed a plurality of times, and in the first process, MAC address related information is added to the MAC address history information, and the status of the MAC address history information is changed. Thus, it is also preferable to detect duplicate MAC addresses.

  Further, the status is new, updated, changed, and lost, the MAC address related information is a network device name, a port, a VLAN, and a MAC address. For the MAC address that exists only in the current information, the MAC address related information is registered as new in the MAC address history information, and the MAC address related information of the MAC address that exists in both the current information and the history information. MAC address related information with different VLANs and the same MAC address is registered as a new status in the MAC address history information, and the MAC address corresponding to the MAC address related information with the same network device, port, VLAN, and MAC address MAC address of history information The status of the link information is updated, the status of the MAC address related information of the MAC address history information corresponding to the MAC address related information with the same VLAN and the same MAC address and different port or network device is lost, and the current information It is also preferable to register the MAC address related information in the MAC address history information as a status change.

  In addition, the process after the first time of the duplicate detection determination processing means is that all the network device, port, VLAN, and MAC address for the MAC address related information of the MAC address existing in both the current information and the history information. When the status of the MAC address history information corresponding to the same MAC address related information is lost, it is also preferable to determine that the MAC address is duplicated.

  Further, the first and subsequent processes of the duplicate detection determination processing means are the same for the MAC address related information of the MAC address existing in both the current information and the history information, and the VLAN and the MAC address are the same, and the port or network When the status of the MAC address history information corresponding to different MAC address related information is lost, it is also preferable to determine that the device is moving and delete the approximate MAC address related information from the MAC address history information.

  Moreover, it is also preferable that the terminal is a virtual machine virtually built in the physical server and the approximate physical server.

  In order to solve the above problems, the network monitoring method of the present invention obtains MAC address related information registered when a terminal is connected to a network device as current information from a MAC address table managed by the network device. History of past MAC address related information from the MAC address history information storing the history of the MAC address related information to which the status indicating the MAC address state transition is added using the MAC address in the current information as a query key An extraction step for extracting as information, and a duplicate detection determination processing step for comparing the current information and the history information to detect duplicate MAC addresses.

  According to the history information in the network monitoring system of the present invention, since the state history of the MAC address table is maintained and the state is managed, the network device is affected even when the table information is cleared for maintenance or other reasons. You can get the effect of not.

  Moreover, according to the duplication detection of the apparatus having the MAC address connected to the network, it is possible to perform the MAC address duplication monitoring by distinguishing the movement of the terminal having the MAC address including the VLAN network and the virtual machine.

2 shows a normal network configuration and a network monitoring system for monitoring them in the present embodiment. FIG. 1 shows a network configuration when MAC address duplication machines are connected and a network monitoring system for monitoring them. The state transition of the MAC address table in the NW device 1-1 will be described. The state transition of the MAC address history information in the network management system will be described. 6 shows a processing flow for detecting MAC address duplication in a network management system. 6 shows a processing flow for detecting MAC address duplication in a network management system. (Continued) 6 shows a processing flow for detecting MAC address duplication in a network management system. (Continued)

  The best mode for carrying out the present invention will be described in detail below with reference to the drawings. FIG. 1 shows a network monitoring system in this embodiment and a normal network configuration.

  The network of this embodiment includes an NW device 1-1, a physical server X, a virtual machine 10-1, a virtual machine 20-1, a virtual machine 30-1, a physical server Y, and a physical server Y built in the physical server X. Virtual machine 10-2, virtual machine 20-2, virtual machine 30-2, physical server Z, virtual machine 20-3, virtual machine 30-3, and network monitoring built in physical server Z It consists of system 2.

  The NW device 1-1 is a switch having a layer 2 function, logically separates networks by VLAN, and transfers communication to each port according to information in the MAC address table.

  The physical server X is a server having a virtualization function, and includes a plurality of virtual machines and a virtual switch having a layer 2 function, and is connected to the NW device 1-1. The same applies to the physical server Y and the physical server Z.

  The network monitoring system 2 includes a MAC address duplication detection function 21 and MAC address history information 22.

  The MAC address duplication detection function 21 monitors the state of the MAC address table of the NW device 1-1 and periodically acquires table information. The acquired MAC address table information is the MAC address, port, and VLAN registered in the NW device 1-1. Among these, the past MAC address table information is extracted from the MAC address history information 22 using the MAC address as an inquiry key. The MAC address table information at the time of acquisition and the MAC address history information 22 are matched to detect duplication of the MAC address. A detailed processing flow will be described with reference to FIGS.

  The MAC address history information 22 stores information on the MAC address table to which the NW device information to be monitored and the status information indicating the state transition of the MAC address are added by the MAC address duplication detection function 21. The stored MAC address table information includes the NW device, port, VLAN, MAC address, and status. The NW device has a host name or an IP address as information. The status includes new, updated, changed, and lost information.

  FIG. 2 shows a state in which a virtual machine 10-3 having the same MAC address as that of the virtual machine 10-1 is connected to the same VLAN in the normal network configuration of FIG. The MAC address duplication detection function of the network monitoring system performs duplication check along the flow of FIGS.

  FIG. 3 shows a state transition of the MAC address table when a terminal having a duplicate MAC address is connected to the NW device 1-1. T1 is a MAC address table in the network configuration of FIG. Terminals with duplicate MAC addresses are not connected. T2 is a MAC address table in the network configuration of FIG. The virtual machine 10-3 having the duplicate MAC address is connected, and the connection state of the virtual machine 10-3 is stored in the MAC address table of the NW device 1-1. T3 is the MAC address table in the network configuration of FIG. 2, but the connection state of the virtual machine 10-1 is stored in the MAC address table of the NW device 1-1.

  FIG. 4 shows the state transition of the MAC address history information. R1 is MAC address history information at the time of network configuration in FIG. 1, and is in a state where there is no change in the network configuration. R2 is MAC address history information at the time of network configuration to which the virtual machine 10-3 having the duplicate MAC address in FIG. 2 is connected. The MAC address status is changed by the MAC address duplication detection function. In the first detection, since the movement of the terminal or the virtual machine can be considered, only the status change. R3 is the MAC address history information in a state where the MAC address table of the NW device 1-1 is stored when the virtual machine 10-1 is connected, at the time of the network configuration of FIG. The MAC address status is changed by the MAC address duplication detection function. In the detection after the first time, it is determined that the MAC address is duplicated, and the higher-order monitoring system is notified.

FIG. 5 to FIG. 7 show flowcharts for identifying terminals with duplicate MAC addresses by the MAC address duplication detection function.
(F1) The MAC address duplication detection function starts the MAC address duplication detection process for the network device to be monitored.
(F2) The registered MAC address, VLAN, and port information are obtained by referring to the MAC address table of the network device.
(F3) The acquired network device name (host name or IP address), MAC address, VLAN, and port are held as current information.
(F4) The past MAC address table information is extracted from the MAC address history information using the MAC address of the current information as an inquiry key.
(F5) The history information is stored as a set of network device name (host name or IP address), port, VLAN, MAC address, and status. If not extracted, the history information is held as NULL (no information).
(F6) The MAC address duplication is determined using the current information and history information held.
(F7) It is confirmed whether or not the MAC address in the current information is in the history information. If not, the process proceeds to F8, and if present, the process proceeds to F9. After F7, it is executed for each MAC address in the current information.
(F8) It is determined that the terminal is newly connected to the network device, and the network device name, port, VLAN, and MAC address of the current information are registered in the history information. The history information status is registered as new.

(F9) Extract history information having a set of network device name (host name or IP address), MAC address, VLAN, port, and status equal to the MAC address in the current information. Check whether the extracted history information is single or multiple. If the number is single, the process proceeds to F10. If the number is single, the process proceeds to F16.
(F10) Check whether the VLAN of the history information and the VLAN of the current information are the same or different. If they are different, the process proceeds to F11, and if they are the same, the process proceeds to F12.
(F11) It is determined that the terminal is newly connected to the network device, and the network device name, port, VLAN, and MAC address of the current information are registered in the history information. The history information status is registered as new.
(F12) Check whether the network device name of the current information and the network device name of the history information are the same or different. If they are the same, proceed to F13, and if they are different, proceed to F15.
(F13) Check whether the current information port and the history information port are the same or different. If they are the same, proceed to F14; otherwise, proceed to F15.
(F14) Since the network device name, port, VLAN, and MAC address are all equal, it is determined that the terminal is continuously connected to the network device, and the status of the history information is registered as an update.
(F15) The network device is the same MAC address and the same VLAN but is connected to a different network device or a different port, and the status of the compared history information is registered as erasure. Also, the network device name, MAC address, VLAN, port and status of the current information are registered as changes.

(F16) The determination process is repeatedly performed for the number of pieces of history information including a network device name (host name or IP address), MAC address, VLAN, port, and status as a set.
(F17) Check whether the VLAN of history information and the VLAN of current information are the same or different. If they are different, the process proceeds to F18, and if they are the same, the process proceeds to F20.
(F18) If the history information does not include the same network device name, port, VLAN, and MAC address information as the current information, the process proceeds to F19. If there is, the process returns to the top F17 of the loop.
(F19) It is determined that the terminal is newly connected to the network device, and the network device name, port, VLAN, and MAC address of the current information are registered in the history information. The history information status is registered as new. Return to the top F17 of the loop.
(F20) Check whether the network device name in the current information and the network device name in the history information are the same or different. If they are the same, the process proceeds to F21, and if they are different, the process proceeds to F26.
(F21) Check whether the current information port and the history information port are the same or different. If they are the same, proceed to F22; otherwise, proceed to F26.

(F22) It is confirmed whether the status of the history information is new, updated, changed, or lost. If new, updated, or changed, the process proceeds to F23, and if lost, the process proceeds to F24.
(F23) It is determined that the terminal is continuously connected to the network device, and the status of the history information is registered as an update. Return to the top F17 of the loop
(F24) It is determined that the MAC address is duplicated, the higher-level monitoring system is notified, and the process proceeds to F25.
(F25) The history information status is registered as a change. Return to the top F17 of the loop
(F26) It is confirmed whether the status of the history information is new or updated, changed or lost. If it is new or updated, the process proceeds to F27, and if it is changed or lost, the process proceeds to F30.
(F27) The network device has the same MAC address and the same VLAN but is connected to a different network device or a different port, and the status of the compared history information is registered as erasure.
(F28) If the history information does not include the same network device name, port, VLAN, and MAC address information as the current information, the process proceeds to F29, and if present, the process proceeds to F34.
(F29) The network device name, port, VLAN, MAC address and status of the current information are registered as changes. Return to the top F17 of the loop.
(F30) It is confirmed whether the status of the history information is changed or lost. When it is a change, it progresses to F31, and when it is disappearance, it progresses to F32.
(F31) The history information status is registered as lost. Return to the top F17 of the loop.
(F32) It is confirmed whether the disappearance exists in the status of the history information for F seconds or more (default is 10 seconds). When it exists, it progresses to F33, and when it does not exist, it progresses to F34.
(F33) The corresponding information is deleted from the history information. Return to the top F17 of the loop.
(F34) The MAC address duplication detection process is terminated for the network device to be monitored.

  By repeating this process periodically, it is possible to detect duplicate MAC addresses.

（Ｆ４）現在情報のＭＡＣアドレス（ＡからＧ）を用いて、ＭＡＣアドレス履歴情報（図４のＲ１）から過去のＭＡＣアドレステーブル情報を抽出する。履歴情報として、下記表２が抽出される。

3 shows an example in which the MAC address duplication detection function identifies duplication of MAC addresses in the network configuration of FIG. Assume that the MAC address history information in the network configuration of FIG. 1 has already been registered.
(1) First operation of MAC address duplication detection function (F3) The following Table 1 is extracted as current information.

(F4) The past MAC address table information is extracted from the MAC address history information (R1 in FIG. 4) using the MAC address (A to G) of the current information. Table 2 below is extracted as history information.

（Ｆ１６）から（Ｆ２３）現在情報の最初の行と抽出された最初の一組では、ネットワーク装置名、ポート、ＶＬＡＮ、ＭＡＣアドレスすべてが等しいため、履歴情報のステータスを更新として登録する。現在情報の最初の行と抽出された次の一組では、ネットワーク装置名が等しく、ＶＬＡＮが異なるため、ここでは特に何もしない。ここの一組は、表２の最後の行のＭＡＣアドレスＢが処理されるときに更新される。 (F7) Since the MAC address B in the first line of the current information exists in the history information, the process proceeds to F9.
(F9) A set of NW device name, MAC address, VLAN, port, and status that is equal to the MAC address B in the first line of the current information is extracted. Table 3 below is extracted. Since the extracted history information is plural, the process proceeds to F16.

(F16) to (F23) In the first set of current information and the extracted first set, the network device name, port, VLAN, and MAC address are all equal, so the status of the history information is registered as updated. In the first set of current information and the next set extracted, the network device names are the same and the VLANs are different, so nothing is done here. This set is updated when MAC address B in the last row of Table 2 is processed.

（Ｆ１０）から（Ｆ１４）現在情報の６番目の行と抽出された組では、ネットワーク装置名、ＶＬＡＮ、ＭＡＣアドレスが等しく、ポートが異なるため、Ｆ１５に進む。
（Ｆ１５）比較された履歴情報のステータスを消失として登録する。また、現在情報の６番目の行のネットワーク装置名、ポート、ＶＬＡＮ、ＭＡＣアドレスとステータスを変更として登録する。履歴情報として、下記表５になる。

(F7) From the MAC address C in the second row of the current information to the MAC address F in the fifth row, the extracted history information is single, and the processing from (F10) to (F14) is performed. Register the status of history information as update. That is, the history information status does not change.
(F7) Since the MAC address A of the sixth line of the current information exists in the history information, the process proceeds to F9.
(F9) A set of NW device name, MAC address, VLAN, port, and status that is equal to the MAC address A in the sixth row of the current information is extracted. Table 4 below is extracted. Since the extracted history information is single, the process proceeds to F10.

In (F10) to (F14), the sixth row of the current information and the extracted set have the same network device name, VLAN, and MAC address, but different ports.
(F15) The status of the compared history information is registered as erasure. Also, the network device name, port, VLAN, MAC address and status in the sixth line of the current information are registered as changes. The history information is shown in Table 5 below.

(F7) From the MAC address G in the seventh row of the current information to the MAC address B in the eighth row is the same as the first row of the current information, and the status of the history information is registered as an update. That is, the status of the history information remains unchanged from Table 5.

  As described above, the MAC address history information is updated from R1 in FIG. 4 to R2 in FIG. 4 by the first MAC address duplication detection function. Thus, in the first detection, since the movement of the terminal or the virtual machine can be considered, only the status change.

（Ｆ４）履歴情報として、今回は表５になる。
（Ｆ７）現在情報の最初の行のＭＡＣアドレスＡは、履歴情報に存在するため、Ｆ９に進む。
（Ｆ９）現在情報の最初の行のＭＡＣアドレスＡと等しい、ＮＷ装置名、ＭＡＣアドレス、ＶＬＡＮ、ポート、ステータスの組を抽出する。下記表７が抽出される。抽出した履歴情報が複数であるため、Ｆ１６に進む。

（Ｆ１６）ＮＷ装置、ＭＡＣアドレス、ＶＬＡＮ、ポート、ステータスが２組あるため、２回繰り返し判定処理を行う。
・１回目の判定
（Ｆ１７）抽出した履歴情報の最初の行と現在情報の最初の行とを比較する。ＶＬＡＮが同じため、Ｆ２０に進む。
（Ｆ２０）ネットワーク装置名が同じため、Ｆ２１に進む。
（Ｆ２１）ポートが同じため、Ｆ２２に進む。
（Ｆ２２）履歴情報のステータスが消失であるため、Ｆ２４に進む。
（Ｆ２４）ＭＡＣアドレスが重複したと判定し、上位の監視システムに通知する。
（Ｆ２５）履歴情報のステータスを変更として登録する。
・２回目の判定
（Ｆ１７）抽出した履歴情報の第２の行と現在情報の最初の行とを比較する。ＶＬＡＮが同じため、Ｆ２０に進む。
（Ｆ２０）ネットワーク装置名が同じため、Ｆ２１に進む。
（Ｆ２１）ポートが異なるため、Ｆ２６に進む。
（Ｆ２６）履歴情報のステータスが変更であるため、Ｆ３０に進む。
（Ｆ３０）履歴情報のステータスが変更であるため、Ｆ３１に進む。
（Ｆ３１）履歴情報のステータスを消失として登録する。 (2) The second operation of the MAC address duplication detection function, when the MAC address duplication detection function is performed again, is as follows.
(F3) The following Table 6 is extracted as current information.

(F4) The history information is as shown in Table 5 this time.
(F7) Since the MAC address A in the first line of the current information exists in the history information, the process proceeds to F9.
(F9) A set of NW device name, MAC address, VLAN, port, and status that is equal to the MAC address A in the first line of the current information is extracted. Table 7 below is extracted. Since the extracted history information is plural, the process proceeds to F16.

(F16) Since there are two sets of NW device, MAC address, VLAN, port, and status, the determination process is repeated twice.
First determination (F17) The first line of the extracted history information is compared with the first line of the current information. Since the VLAN is the same, the process proceeds to F20.
(F20) Since the network device names are the same, the process proceeds to F21.
(F21) Since the ports are the same, the process proceeds to F22.
(F22) Since the status of the history information is lost, the process proceeds to F24.
(F24) It is determined that the MAC address is duplicated, and a higher-order monitoring system is notified.
(F25) The history information status is registered as a change.
Second determination (F17) The second line of the extracted history information is compared with the first line of the current information. Since the VLAN is the same, the process proceeds to F20.
(F20) Since the network device names are the same, the process proceeds to F21.
(F21) Since the ports are different, the process proceeds to F26.
(F26) Since the status of the history information is changed, the process proceeds to F30.
(F30) Since the status of the history information is changed, the process proceeds to F31.
(F31) The history information status is registered as lost.

  As described above, by the second MAC address duplication detection function, the MAC address history information is updated from R2 in FIG. 4 to R3 in FIG. 4, and the MAC address duplication is notified to the upper monitoring system in F24.

（Ｆ４）現在情報のＭＡＣアドレス（ＡからＧ）を用いて、ＭＡＣアドレス履歴情報（図４のＲ１）から過去のＭＡＣアドレステーブル情報を抽出する。履歴情報として、下記表９が抽出される。

Next, an operation example of the MAC address duplication detection function in the network excluding the virtual machine 10-1 from the network configuration in FIG. 2 (that is, when the virtual machine has moved from the physical server X to the physical server Z) will be described.
(1) First operation of MAC address duplication detection function (F3) Table 8 below is extracted as current information.

(F4) The past MAC address table information is extracted from the MAC address history information (R1 in FIG. 4) using the MAC address (A to G) of the current information. The following Table 9 is extracted as history information.

（Ｆ１０）から（Ｆ１４）現在情報の６番目の行と抽出された組では、ネットワーク装置名、ＶＬＡＮ、ＭＡＣアドレスが等しく、ポートが異なるため、Ｆ１５に進む。
（Ｆ１５）比較された履歴情報のステータスを消失として登録する。また、現在情報の６番目の行のネットワーク装置名、ポート、ＶＬＡＮ、ＭＡＣアドレスとステータスを変更として登録する。履歴情報として、下記表１１になる。

(F7) Since the MAC address A of the sixth line of the current information exists in the history information, the process proceeds to F9.
(F9) A set of NW device name, MAC address, VLAN, port, and status that is equal to the MAC address A in the sixth row of the current information is extracted. Table 10 below is extracted. Since the extracted history information is single, the process proceeds to F10.

In (F10) to (F14), the sixth row of the current information and the extracted set have the same network device name, VLAN, and MAC address, but different ports.
(F15) The status of the compared history information is registered as erasure. Also, the network device name, port, VLAN, MAC address and status in the sixth line of the current information are registered as changes. The history information is shown in Table 11 below.

  As described above, the MAC address history information is updated from Table 9 to Table 11 by the first MAC address duplication detection function. Thus, in the first detection, since the movement of the terminal or the virtual machine can be considered, only the status change.

（Ｆ１６）ＮＷ装置、ＭＡＣアドレス、ＶＬＡＮ、ポート、ステータスが２組あるため、２回繰り返し判定処理を行う。
・１回目の判定
（Ｆ１７）抽出した履歴情報の最初の行と現在情報の６番目の行とを比較する。ＶＬＡＮが同じため、Ｆ２０に進む。
（Ｆ２０）ネットワーク装置名が同じため、Ｆ２１に進む。
（Ｆ２１）ポートが異なるため、Ｆ２６に進む。
（Ｆ２６）履歴情報のステータスが消失であるため、Ｆ３０に進む。
（Ｆ３０）履歴情報のステータスが消失であるため、Ｆ３２に進む。
（Ｆ３２）ここで、Ｆ秒以上（デフォルトは１０秒）、消失が存在する場合、Ｆ３３に進む。
（Ｆ３３）履歴情報から該当の情報を削除する。
・２回目の判定
（Ｆ２０）ネットワーク装置名が同じため、Ｆ２１に進む。
（Ｆ２１）ポートが同じため、Ｆ２２に進む。
（Ｆ２２）履歴情報のステータスが、更新であるため、Ｆ２３に進む。
（Ｆ２３）ネットワーク装置に対して継続して接続している端末と判定し、履歴情報のステータスを更新として登録する。 (2) The second operation of the MAC address duplication detection function, when the MAC address duplication detection function is performed again, is as follows.
(F3) As the current information, the same table 8 as above is extracted.
(F4) The history information is as shown in Table 11 above.
(F7) Since the MAC address A of the sixth line of the current information exists in the history information, the process proceeds to F9.
(F9) A set of NW device name, MAC address, VLAN, port, and status that is equal to the MAC address A in the first line of the current information is extracted. Table 12 is extracted. Since the extracted history information is plural, the process proceeds to F16.

(F16) Since there are two sets of NW device, MAC address, VLAN, port, and status, the determination process is repeated twice.
First determination (F17) The first line of the extracted history information is compared with the sixth line of the current information. Since the VLAN is the same, the process proceeds to F20.
(F20) Since the network device names are the same, the process proceeds to F21.
(F21) Since the ports are different, the process proceeds to F26.
(F26) Since the status of the history information is lost, the process proceeds to F30.
(F30) Since the status of the history information is lost, the process proceeds to F32.
(F32) Here, if there is a loss for F seconds or more (default is 10 seconds), the process proceeds to F33.
(F33) The corresponding information is deleted from the history information.
Second determination (F20) Since the network device names are the same, the process proceeds to F21.
(F21) Since the ports are the same, the process proceeds to F22.
(F22) Since the status of the history information is update, the process proceeds to F23.
(F23) It is determined that the terminal is continuously connected to the network device, and the status of the history information is registered as an update.

  As described above, the second MAC address duplication detection function deletes the item related to the virtual machine 10-1 of the physical server X from the MAC address history information without duplicating the MAC address. Movement of a terminal having a MAC address can be distinguished from duplication of MAC addresses.

  Further, by confirming whether or not the MAC address in the current information exists in the history information in F7, the NW device with the new MAC address in F8, the NW device with the same MAC address but different VLANs in F11 and F19 Is registered as new in the history information. Thus, it is possible to detect a device having a duplicate MAC address without being affected by the clearing of the table information of the network device.

  Moreover, all the embodiments described above are illustrative of the present invention and are not intended to limit the present invention, and the present invention can be implemented in other various modifications and changes. Therefore, the scope of the present invention is defined only by the claims and their equivalents.

1-1 NW device X, Y, Z Physical server 10-1, 20-1, 30-1, 10-2, 20-2, 30-2, 10-3, 20-3, 30-3 Virtual machine 2 Network monitoring system 21 MAC address duplication detection function 22 MAC address history information

Claims (8)

MAC address history information for storing a history of MAC address related information to which a status indicating a MAC address state transition is added;
An acquisition means for acquiring, as current information, MAC address related information registered when a terminal is connected to a general network device from a MAC address table managed by the network device;
An extraction means for extracting past MAC address related information as history information from the MAC address history information, using the MAC address in the current information as a query key;
Duplicate detection determination processing means for comparing the current information with the history information and detecting duplicate MAC addresses;
A network monitoring system comprising: The MAC address related information includes VLAN,
The network monitoring system according to claim 1, wherein the duplicate detection determination processing unit does not determine that the MAC address is duplicated when the MAC address is the same and the VLAN is different.   The duplicate detection determination processing means is performed a plurality of times, and in the first process, adds MAC address related information to the MAC address history information, and changes the status of the MAC address history information, The network monitoring system according to claim 1, wherein duplication detection of a MAC address is performed. The status is new, updated, changed and lost,
The MAC address related information is a network device name, a port, a VLAN, and a MAC address,
The initial processing of the duplicate detection determination processing means is:
For the MAC address that exists only in the current information, register the MAC address related information as new in the MAC address history information,
For MAC address related information of MAC addresses that exist in both the current information and the history information,
Register the MAC address related information with the same MAC address as the VLAN, but register the status as new in the MAC address history information,
Updating the status of the MAC address related information of the MAC address history information corresponding to the MAC address related information with the same network device, port, VLAN, and MAC address;
The status of the MAC address related information of the MAC address history information corresponding to the MAC address related information corresponding to the same MAC address and different MAC address related to the VLAN and the MAC device is lost, and the MAC address related information of the current information is set to the MAC address The network monitoring system according to claim 3, wherein the status is registered as a change in the history information. The first and subsequent processes of the duplicate detection determination processing means are:
For MAC address related information of MAC addresses that exist in both the current information and the history information,
4. The MAC address duplication detection is determined when the status of the MAC address history information corresponding to the MAC address related information all having the same network device, port, VLAN, and MAC address is lost. Or the network monitoring system according to 4. The first and subsequent processes of the duplicate detection determination processing means are:
For MAC address related information of MAC addresses that exist in both the current information and the history information,
When the status of the MAC address history information corresponding to the MAC address related information with the same VLAN and the same MAC address and different port or network device is lost, it is determined that the MAC address related information is moved and the approximate MAC address related information is changed to the MAC address. 6. The network monitoring system according to claim 3, wherein the network monitoring system is deleted from the history information.   The network monitoring system according to any one of claims 1 to 6, wherein the terminal is a virtual machine virtually built in a physical server and an almost physical server. An acquisition step of acquiring, as current information, MAC address related information registered when a terminal is connected to the network device from a MAC address table managed by the network device;
Using the MAC address in the current information as an inquiry key, the past MAC address related information is extracted as history information from the MAC address history information storing the history of the MAC address related information to which the status indicating the MAC address state transition is added. An extraction step to
A duplicate detection determination processing step of comparing the current information and the history information and performing duplicate detection of a MAC address;
A network monitoring method characterized by comprising:

Images