Patent ID: 8605617

Claim:
A packet capture system comprising: a plurality of measuring devices that are connected to a same network and are each configured to capture a packet flowing on the network; a sharing control processing unit that controls sharing of capture of packets flowing on the network among the plurality of measuring devices; and an aggregating unit that collects the packets captured by the plurality of measuring devices, wherein: each individual measuring device in the plurality of measuring devices includes: a capture control unit that controls a start and a stop of the capture by the individual measuring device; and a capture state notification unit that notifies the sharing control processing unit of a state about the capture performed under control by the capture control unit; the sharing control processing unit includes: a sharing control unit that determines which of the plurality of measuring devices is to start the capture, wherein determination by the sharing control unit is made according to a predetermined sharing control rule and the state notified from the capture state notification unit; and a sharing instruction unit that instructs the plurality of measuring devices to start or stop the capture, wherein instruction by the sharing instruction unit is made according to the determination by the sharing control unit; when the sharing control unit determines that the capture is to be switched from a first measuring device to a second measuring device, the sharing instruction unit instructs the second measuring device to start the capture; when the second measuring device has actually captured one or more packets satisfying a duplicate packet condition that specifies one or more duplicate packets to be double captured by two of the plurality of measuring devices, the capture state notification unit in the second measuring device notifies the sharing control processing unit of a first state that the one or more packets satisfying the duplicate packet condition have been actually captured by the second measuring device; after the capture state notification unit in the second measuring device notifies the sharing control processing unit of the first state-, the sharing instruction unit instructs the first measuring device to stop the capture; the aggregating unit identifies the one or more duplicate packets satisfying the duplicate packet condition by checking whether an IP address of a reference packet is a same as that of a captured one of the packets, wherein the one or more duplicate packets have been double captured by the first and the second measuring devices and double collected from the first and the second measuring devices; and according to the identified one or more duplicate packets, the aggregating unit reconstructs without duplication the packets flowing on the network.