Computer system, controller and network monitoring method

A controller comprising:

• a flow controlling section configured to set a flow entry to a switch;
• a virtual server database in which an IP (Internet Protocol) address and a DPID (Data Path ID) of a legal virtual server are correlated and recorded;
• wherein the switch performs, on a received packet complying with a set flow entry, a relay operation regulated by the flow entry, and notifies the flow controlling section of a received packet not complying with a flow entry set to itself together with its DPID;
• and
• an address spoofing detecting section configured to obtain an IP address from the virtual server database by using a DPID notified to the flow controlling section as a retrieval key, and obtain, from a virtual server accessed by using the IP address, a MAC (Media Access Control) address assigned to an interface used by a virtual machine installed in the virtual server, and when the obtained MAC address does not coincide with the transmission source MAC address, judge that a transmission source address of the received packet is spoofed.

A non-transitory computer-readable recording medium which records a network monitoring program realizing a controller when it is executed by a computer, to perform the following:

• a flow controlling section setting a flow entry to a switch;
• wherein the switch performs, on a received packet complying with a set flow entry, a relay operation regulated by the flow entry, and notifies the flow controlling section of a received packet not complying with a flow entry set to itself together with its DPID (Data Path ID);
• an address spoofing detecting section obtaining an IP address from a virtual server database, in which an IP (Internet Protocol) address and a DPID of a legal virtual server are correlated and recorded, by using a DPID notified to the flow controlling section as a retrieval key;
• the address spoofing detecting section obtaining, from a virtual server accessed by using the IP address, a MAC (Media Access Control) address assigned to an interface used by a virtual machine installed in the virtual server;
• and
• when the obtained MAC address does not coincide with the transmission source MAC address, the address spoofing detecting section judging that a transmission source address of the received packet is spoofed.

A network monitoring method executed by a computer system, which includes a switch configured to perform, on a received packet complying with a flow entry set by a controller, a relay operation regulated by the flow entry,

• the monitoring method comprising:
• wherein the controller includes a virtual server database in which an IP address (Internet Protocol) and a DPID (Data Path ID) of a legal virtual server are correlated and recorded;
• the switch notifying the controller of a received packet not complying with a flow entry set to itself together with its DPID;
• the controller obtaining an IP address from the virtual server database by using a DPID notified from the switch as a retrieval key;
• the controller obtaining, from a virtual server accessed by using the IP address, a MAC (Media Access Control) address assigned to an interface used by a virtual machine installed in the virtual server;
• and
• when the obtained MAC address does not coincide with the transmission source MAC address, the controller judging that a transmission source address of the received packet is spoofed.