1. Field of the Invention
The present invention relates to a network monitoring apparatus that monitors packets flowing on a path, a network monitoring program executed on a computer that functions as the network monitoring apparatus, and a network monitoring method implemented in the network monitoring apparatus.
2. Description of the Related Art
Conventionally, packets flowing on a network are analyzed for detecting illegal content transmission and for blocking the spread of damage due to computer virus infection.
Specifically, a network monitoring apparatus, which performs a packet analysis, is connected to a distribution line branching from a main line to be monitored. The network monitoring apparatus retrieves the same packets as the packets flowing on the main line. The packet analysis is sometimes performed by a relay device such as a router, which is connected to the main line.
In such a network monitoring apparatus, a sampling rate, which is the rate of packets to be analyzed among the packets flowing on the main line, is set.
For example, if the sampling rate is set to 100%, the network monitoring apparatus performs the packet analysis for all the packets flowing on the main line.
For example, if the sampling rate is set to a value less than 100%, for example, to 80%, the network monitoring apparatus performs the packet analysis for 80% of the packets flowing on the main line.
In a method disclosed in Japanese Patent Application Laid-open No. 2007-74385, a table is already prepared in which a delivery data related to packet transmission and reception and the sampling rates corresponding to the delivery data are maintained in an associated form, and the sampling rates are dynamically switched over based on the packet delivery data.
However, in the conditions mentioned above, resources inside the network monitoring apparatus are not maximally utilized within a usable range.
In other words, if the sampling rate is set to 100%, the network monitoring apparatus further retrieves the packets even when the resources are exhausted due to a packet analysis process. Consequently, the resources are overused, thus delaying the packet analysis process.
Further, if the sampling rate is set to a value less than 100%, even though the packet analysis is performed for all the packets flowing on the main line and the resources are still available, the network monitoring apparatus retrieves some of the packets only. Consequently, the resources are underused, thus reducing an accuracy of packet analysis results.
Based on the method disclosed earlier, even though the sampling rates are dynamically switched over, the problems as mentioned earlier are likely to occur.