Access chain tracing system, network system, and storage medium

A network system comprising:

• a first collection device for collecting first packet data comprising packet size, data length and a detection time, and for transmitting said first packet data;
• a second collection device for collecting second packet data comprising packet size, data length and a detection time;
• and
• a calculation system for comparing said first packet data with said second packet data to determine what change there was in the data length in said packet at the time of a first connection and in the data length in said packet at the time of a second connection, and for employing the comparison result to determine whether the packet at the first connection and the packet at the second connection are the same packet and whether said first connection and said second connection are included in the same access chain.

An access chain tracing method comprising the steps of:

• recording first packet data that include at least packet size and data length extracted from a packet at a first connection and a detection time for said packet;
• recording second packet data that include at least packet size and data length extracted from said packet at a second connection and a detection time for said packet;
• transmitting said first packet data that are recorded;
• receiving said first packet data;
• comparing said first packet data with said second packet data to determine what change there was in the data length in said packet at the time of said first connection and in the data length in said packet at the time of said second connection;
• employing the comparison result obtained at said comparison step to determine whether the packet at the first connection and the packet at the second connection are the same packet and whether said first connection and said second connection are included in the same access chain;
• and
• transmitting the determination result obtained at said determination step.