|
(11) | EP 1 401 160 A8 |
(12) | CORRECTED EUROPEAN PATENT APPLICATION |
published in accordance with Art. 158(3) EPC |
|
|
|
|
|||||||||||||||||||
(54) | PACKET TRACING SYSTEM |
(57) The purpose of the present invention is supplying a packet tracing system which can
trace a route of a packet using existing network components. Packet printing devices
1a, 1b, and 1c generate packet identifying information for each packet which transmits
through the communication line and write the packet identifying information to a storage
part. An IDS 3 detects suspicious packets in a network under surveillance. A management
system which receives a suspicious packet in a network generates a hash value for
the suspicious packet and sends a request for examination which contains the hash
value to the packet printing devices 1a, 1b and 1c. The packet printing devices 1a,
1b and 1c examine an internal storage part and send a result of examination to the
management system 2. The management system 2 obtains a transmission route of the suspicious
packet to be traced and by the result of examination and information of network construction. |