Method, apparatus, and packet analyzing system

An apparatus comprising:

• a memory including a first set of memory regions, the first set of memory regions including a first memory region and a second memory region, the first memory region including a plurality of areas configured to store a plurality of packet identifiers, and the second memory region including a plurality of areas configured to store a plurality of EDCs;
• and
• a processor coupled to the memory and configured to
• receive a first packet, the first packet being transmitted from a first packet capture point in a network and the first packet being including a first packet identifier and a first error detection code,
• store first information indicating the first packet identifier into the first memory region and second information indicating the first error detection code into the second memory region,
• receive a second packet, the second packet being transmitted from a second capturing point in the network and the second packet being including a second packet identifier and a second error detection code,
• compare the second packet identifier and the second error detection code with the first information stored in the first memory region and the second information stored in the first memory region, respectively, and
• in response to a determination that the second packet identifier corresponds to the first information and the second error detection code corresponds to the second information, discard the second packet, and in response to a determination that at least one the second packet identifier and the second error detection code does not correspond to the first information and the second information, provide the first packet and the second packet for a packet analysis,
• wherein
• the determination according to the comparing determines that the second packet identifier corresponds to the first information, when the first information is stored in a first area of the first memory region which corresponds to the second packet identifier, and
• the determination according to the comparing determines that the second EDC corresponds to the second information, when the second information is stored in a second area of the second memory region which corresponds to the second EDC.

A packet analyzing system which analyzes a plurality of packets, the system comprising:

• a packet analyzing device;
• a duplicate packet detection device;
• a first switching device;
• and
• a second switch device,
• wherein
• the first switching device is configured to
• perform a first relay processing of a first packet, and
• transmit a first copied packet including a first packet identifier and a first error detection code obtained by copying the first packet to the duplicate packet detection apparatus,
• the second switching device is configured to
• perform a second relay processing of the first packet, and
• transmit a second copied packet including a second packet identifier and a second error detection code obtained by copying the first packet to the duplicate packet detection apparatus,
• the duplicate packet detection device is configured to
• allocate a first set of memory regions in a storage unit, the first set of memory regions including a first memory region and a second memory region, the first memory region including a plurality of areas configured to store a plurality of packet identifiers, and the second memory region including a plurality of areas configured to store a plurality of EDCs,
• receive the first copied packet,
• store first information indicating the first packet identifier into the first memory region and second information indicating the first error detection code into the second memory region,
• receive the second copied packet,
• compare the second packet identifier and the second error detection code with the first information stored in the first memory region and the second information stored in the second memory region, respectively,
• in response to a determination that the second packet identifier corresponds to the first information and the second error detection code corresponds to the second information, discard the second copied packet, and in response to a determination that at least one the second packet identifier and the second error detection code does not correspond to the first information and the second information, transmit the first copied packet to the packet analyzing device, and
• the packet analyzing device is configured to
• perform a packet analyzing using the first copied packet,
• wherein
• the determination according to the comparing determines that the second packet identifier corresponds to the first information, when the first information is stored in a first area of the first memory region which corresponds to the second packet identifier, and
• the determination according to the comparing determines that the second EDC corresponds to the second information, when the second information is stored in a second area of the second memory region which corresponds to the second EDC.