JP2010178299A - Frame capturing system and frame captureing method - Google Patents

Abstract

In a commercial product, it is difficult to capture all frames having a line capacity A.
A plurality of frame capture devices are prepared. A frame distribution device is provided at the preceding stage, and the frames are distributed using the service type in the frame as a key. The frame is stored in the capture device without being divided. A buffer usage threshold value is provided in the frame input buffer of each capture device, and when the threshold value is exceeded, an alarm is sent to the preceding frame distribution device. Upon receiving the notification, the frame distribution device temporarily changes the allocation destination and adjusts so that traffic exceeding the capture recording performance does not flow to the capture device.
[Selection] Figure 4

Description

  The present invention relates to a frame capture system and a frame capture method for recording a communication frame flowing in a communication line, with the main purpose of analyzing when a failure occurs.

  There are a wide variety of services provided by mobile terminals using broadband mobile networks. Therefore, there are a wide variety of frames flowing between the mobile terminal and the service providing network. Naturally, the capacity is large, and the number of frames that flow is large and extremely fast.

  Under such circumstances, it is required to quickly analyze the cause and recover from the failure when a failure such as a service execution failure in the mobile terminal or a deterioration in service quality occurs. For this reason, it is necessary to save all frames flowing between the mobile terminal and the service providing network for a certain period (about 3 days) to help identify the cause of the failure. Here, since the frame capture is used for failure analysis, one omission is not allowed, and a large amount of ultra-high speed frames must be securely stored.

  If all the frames of the line capacity A are to be captured, hardware for taking out the frames from the line with the line capacity A and recording them on the recording medium with the line capacity A is required. Since the line capacity is increased and recording speeds such as 40 Gbit / s and 100 Gbit / s are required, it is necessary to parallelize recording media due to the limitation of the writing speed of the HDD alone. A technique of dividing and recording a capture frame on this parallel storage medium is employed.

  A conventional frame capture system will be described with reference to FIGS. In FIG. 1, the frame capture system 900 includes a frame division circuit (parallelization) 902 and n capture devices 901. The frame division circuit (parallelization) 902 is connected to n capture devices 901. A frame transmitted from the frame copy apparatus is divided into n by a frame dividing circuit (parallelization) 902, and a part thereof is stored in n capture apparatuses 901.

  The data stored in the capture device 901 includes divided frames and additional information such as time information, identification information, and service type information. These additional information is information necessary for the search. However, the recording capacity required for one frame in the entire capture system requires an actual frame length and additional information × n. In other words, the more divided, the greater the proportion of overhead.

  A recording database held by the frame dividing circuit 902 will be described with reference to FIG. In FIG. 2, the recording database 910 includes a serial number 911, time information 912, a frame type 913, a storage medium 914, and a write address 915. The serial number 911 is a frame order number. The time information 912 is a frame reception time. The frame type 913 is a service type of the frame. The storage medium 914 is a storage medium for the frame. A write address 915 is a write address of the storage medium. As is clear from the recording database 910, one frame is divided into n and is divided into n capture devices 901 and stored. Note that the storage medium number m (m = 1 to n) described in the storage medium 914 corresponds to the capture device 901-m.

However, in a commercially available frame capture system, parallelization of recording media in the system is limited to a certain number, reducing costs and suppressing an increase in size. As a condition for the exchange, this frame capture system is in a state where it is difficult to capture all of the line capacity A.
Patent Document 1 discloses a packet capture device that includes a data filter and can sample or always capture data according to a measurement target.
The present invention provides a frame capture system that reliably stores a large number of ultra-high-speed frames and efficiently stores them for each service type.

JP 2001-103090 A

  If the recording media in the apparatus are parallelized and the frames are divided and recorded in parallel on a plurality of recording media, a capture system with an increased recording speed can be obtained. However, the larger the number of parallel, the larger and expensive. In addition, dividing a frame and recording it in parallel on a plurality of recording media needs to add additional information as to which frame is added to the divided information for each divided information. In FIG. 1, the sum of the hatched additional information is the number of divisions n × addition information, which consumes the area of the recording medium necessary for recording. The capacity of the recording medium necessary for recording per frame is (frame information + number of divisions × addition information), and the amount of attachment information increases as the amount of information for one frame increases as parallel processing is performed.

  In the parallel recording method described above, writing is performed on a parallel recording medium in one apparatus regardless of the type of frame. For this reason, the recorded frame data is distributed without regularity. At the time of recording, it is necessary to retain information corresponding to a division of the identification information of the recording medium in which the corresponding frame data is recorded, the storage address of each recording medium, and the identification information of the frame. When reading out the frame data, the target frame data is collected using these pieces of information. However, the number of accesses to the recording medium increases by the number of divisions, and the acquisition process becomes complicated. In addition, it is necessary to record the additional information that is expected to be necessary for the search such as time information, identification information, service type information, etc. in the recorded data, and information to be provided for organizing information is also inevitable Increase.

  In an actual line, the entire line capacity A is not always used. Nevertheless, it is necessary to prepare a recording apparatus with a recording speed A, which leads to wasteful increase in size and cost. The capture device not only captures and saves frames, but also reads data from an external device in order to analyze these data. At the time of reading, the recording speed is reduced, and frame missing is increased.

  In the frame capture system of the present invention, a plurality of capture devices are prepared, and the frames are stored in one capture device without being divided. However, the recording performance of the capture device is insufficient for bursty frames generated within the line capacity A. Therefore, a threshold is provided in the buffer at the frame input end of each capture device to incorporate a threshold monitoring function. When the threshold value is exceeded, a warning is sent to the preceding frame distribution device as an alarm.

  Upon receiving the notification, the frame distribution device changes the allocation destination and adjusts so that traffic exceeding the capture recording performance does not flow to the capture device. Further, the frame distribution device determines the allocation capture device based on the service type information in the frame. The frame distribution apparatus mainly records one type of service type frame in one capture apparatus. Accordingly, by preparing a capture device having a capture recording performance corresponding to the line capacity used by the service, it is not necessary to prepare a large-capacity capture device unnecessarily.

  Information on frames that have been distributed to other capture devices beyond the threshold is recorded when the distribution is changed. This recording makes it easier to collect frames when collecting them for analysis. For each frame capture device, each service type is stored to some extent and stored, and since the frames are not divided, there is no need to manage the identification information of the recording medium storing the frame data to be collected. However, since the number of record addresses to be managed is small, the process necessary for collection is simplified.

  On the recording medium in the capture device, capture data is written and read for analysis. For this reason, the frame writing performance (RW performance) changes depending on the situation. Due to this change in performance, the threshold value of the buffer is changed to cope with performance degradation of capture data recording (W performance) when data reading from the recording medium increases.

  The above-described problem includes a distribution device that distributes frames to a plurality of capture devices, a plurality of capture devices that record frames, and an analysis device that extracts and analyzes the recorded frames. A usage amount calculation unit, and a monitoring unit of the calculation unit, the monitoring unit sends out to the distribution device as a threshold abnormality alarm when the usage amount exceeds a predetermined buffer threshold, and the distribution device is a distribution destination of the frame The route setting unit, when receiving the threshold abnormality alarm, stops the frame distribution to the capture device that has transmitted the threshold abnormality alarm, and does not transmit the threshold abnormality alarm. This can be achieved by a frame capture system that changes the frame distribution.

  A step of allocating frames to a plurality of capture devices; a step of calculating a use amount of a frame input buffer; a step of sending a threshold abnormality alarm when the use amount exceeds a predetermined buffer threshold; and a threshold abnormality This can be achieved by a frame capture method comprising the steps of: stopping frame distribution to a capture device that has transmitted a threshold abnormality alarm when receiving an alarm, and changing frame distribution to a capture device that has not transmitted the threshold abnormality alarm.

  According to the present invention, a frame capture system that does not miss a frame can be configured with a relatively inexpensive capture device that does not have high performance.

It is a block diagram of a frame capture system. It is a figure explaining the recording database which a frame division | segmentation circuit hold | maintains. It is a block diagram of a network. It is a block diagram of a frame capture system. It is a block diagram of a frame distribution apparatus. It is a figure explaining the structure of a flame | frame. It is a figure explaining the distribution condition initial value. It is a figure explaining distribution condition change recording. It is a block diagram of a capture device. It is a figure explaining a recording database. It is a flowchart of distribution condition change. It is a figure explaining the distribution condition change record which recorded the change of distribution conditions. It is a flowchart of information collection of a flake capture system. It is a figure explaining a capture device specific result. It is a flowchart of a recording medium writing performance calculation process. It is a block diagram of a frame capture system.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings using examples. The same reference numerals are assigned to substantially the same parts, and the description will not be repeated.

  With reference to FIG. 3, an application network of the frame capture system will be described. The network 700 includes a mobile access network 600, a frame copy device 2, a service providing network 3, a frame capture system 100, and a plurality of portable terminals 200. The mobile access network 600 includes a base station termination device 1, a plurality of base station accommodation devices 400, and a plurality of base stations 300. The service providing network 3 includes a plurality of services including an A service and a B service.

  Base station 300 communicates with a plurality of mobile terminals 200 by radio. Base station accommodation apparatus 400 relays communication data of a plurality of base stations 300 together. The base station termination device 1 controls the base station 300. The base station termination device 1 is connected to the service providing network 3 via the frame copy device 2. The frame copy device copies a communication frame between the base station termination device 1 and the service providing network 3 and transmits it to the frame capture system 100. The frame capture system 100 stores all frames exchanged between each mobile terminal 200 and various service providing servers in the service providing network 3 within a certain period. The stored frame is used to quickly analyze the cause and perform failure recovery when a failure such as a service execution failure or a deterioration in service quality occurs in the mobile terminal 200.

  The configuration of the frame capture system will be described with reference to FIG. In FIG. 4, the frame capture system 100 includes a frame distribution device 4, N capture devices 50, and a frame analysis device 6. The frame distribution device 4 includes a frame distribution unit 410, a buffer threshold value alarm reception unit 402, a distribution condition initial value 403, and a distribution condition change record 404. The capture device 50 includes a capture buffer 510, a recording medium 520, a buffer threshold value monitoring unit 530, and an RW (read / write) performance monitoring unit 550.

  A communication frame between the base station termination device 1 and the service providing network 3 is copied by the frame copy device 2 and input to the frame distribution device 4. The frame distribution device 4 distributes the output to N outputs by the frame distribution unit 410. At this time, it is distributed to each capture device 50 according to the service type information in the frame. As a result, the service type frames in charge are generally concentrated and recorded in each capture device 50.

  The capture device 50 once stores the frames in the capture buffer 510 and then sequentially records the frames on the recording medium 520.

  The buffer threshold value monitoring unit 530 monitors the buffer usage of the capture buffer 510. Specifically, the buffer threshold value monitoring unit 530 monitors whether a predetermined buffer usage amount is exceeded. The buffer threshold monitoring unit 530 sends a threshold abnormality alarm to the buffer threshold alarm receiving unit 402 of the frame distribution device 4 when the prescribed buffer usage is exceeded.

  Upon receiving the warning, the alarm receiving unit 402 instructs the frame distribution unit 410 to change the distribution condition that has been distributed based on the distribution condition initial value 403. The frame distribution unit 410 changes the distribution condition based on the instruction. The change contents are recorded in the distribution condition change record 404.

  The threshold value of the usage amount of the capture buffer 510 is changed according to the operation state of the capture device 50. The capture device 50 writes the captured frame data to the recording medium 520. In addition to recording, the capture device 50 also reads out the frame data for analysis. For this reason, the recording performance of the capture device 50 changes from time to time. Therefore, the RW performance monitoring unit 550 monitors the writing / reading state of the recording medium 520 and monitors the recording performance at that time. Based on this performance value, the capture device 50 changes the threshold of the buffer usage amount.

  The frame analysis device 6 that acquires and analyzes the data recorded in the recording medium 520 obtains information about which capture device 50 has the acquisition target frame data from the distribution condition change record 404, and Acquire.

  In addition, as a method of distributing frames, not only a method of distributing by service type, but also a method of distributing by service area and dividing the sharing of capture devices by time according to the traffic situation of the service area may be used.

  With reference to FIG. 5, the configuration of the frame distribution device will be described. 5, the frame distribution unit 410 of the frame distribution device 4 includes a header extraction circuit 411, a service type information extraction circuit 412, a route setting circuit 413, a route installation register 414, a route circuit 415, and a distribution. The table includes a condition table 416 and a distribution condition changing unit 417.

  The header extraction circuit 411 extracts frame header information. Further, the service type information extraction circuit 412 extracts service information and sends it to the route setting register 414. The route setting register 414 outputs “1” only for the signal of the corresponding service type. This signal opens the gate corresponding to the service type in the route circuit 415 and distributes the frame to the corresponding capture device 50. A frame is transmitted to each gate of the route circuit.

  The route setting circuit 413 rewrites the contents of the route setting register 414 based on the information in the distribution condition table 416 to change the frame route. The information in the distribution condition table 416 defaults to the distribution condition initial value 403.

  The buffer threshold alarm receiving unit 402 receives a threshold abnormality alarm from the capture device 50. The buffer threshold alarm receiving unit 402 transfers the threshold abnormality alarm to the distribution condition changing unit 417. The distribution condition changing unit 417 changes the route setting to the alarm sending capture device to another capture. The distribution condition changing unit 417 reflects the contents in the distribution condition table 416. The change of the distribution condition table 416 is left as the distribution condition change record 404 together with the changed time information.

The configuration of the frame will be described with reference to FIG. In FIG. 6, a frame 800 includes a header 810 and data 820. The header 810 includes a service type 811.
In FIG. 5, the header extraction circuit 411 extracts a header 810 from the frame 800. The service type information extraction circuit 412 extracts the service type 811 from the header 810.

  With reference to FIG. 7, the initial value of the distribution condition will be described. In FIG. 7, the distribution condition initial value 403 includes a service type 4031 and a distribution destination 4032. The capture device i (i = 1 to n) described in the assignment destination 4032 means the capture device 50-i. Specifically, in the initial stage, the service type information extraction circuit 412 distributes the A service to the capture device 50-1.

  The distribution condition change record will be described with reference to FIG. In FIG. 8, the distribution condition change record 404 includes a service type 4041, an allocation destination 4042, and an execution time 4043 of the distribution condition. The service type 4041 and the assignment destination 4042 are the same as the service type 4031 and the assignment destination 4032. The distribution condition execution time 4043 includes an execution start time and an end time of the distribution condition.

  The configuration of the capture device will be described with reference to FIG. In FIG. 9, the capture buffer 510 includes a frame reception detection circuit 511, a write control circuit 512, a write address control circuit 513, a read control circuit 514, a read address control circuit 515, a buffer 516, and an empty address management circuit. 517 and a buffer usage calculation circuit 518.

The storage medium 520 includes a recording area 521, a writing control circuit 522, a reading control circuit 523, a time information adding circuit 524, and a recording database 525.
The buffer threshold value monitoring unit 530 includes a buffer threshold value comparison circuit 531, a buffer threshold value 532, and a threshold value alarm generation circuit 533. The RW performance monitoring unit 550 includes a write number / read number count circuit 551 and a storage medium write performance value calculation circuit 552.

  The frame reception detection circuit 511 detects reception of a frame. The write control circuit 512 acquires a write address from the write address control circuit 513. The write control circuit 512 writes the frame in the buffer 516 at the acquired write address. The write address control circuit 513 obtains information on the vacant addresses in the buffer 516 from the vacant address management circuit 517, and determines the address to be written from among the information. The empty address management circuit 517 acquires the address information written from the write control circuit 512, the address information read from the read control circuit 514, and manages the empty address. The read control circuit 514 reads frame data from the buffer 516 based on the read address determined by the read address control circuit 515 and sends it to the recording medium 520.

  For the frame data input to the recording medium 520, the time information adding circuit 524 adds time information. The write control circuit 522 records the frame data provided with time information in the recording area 521 determined for each service type. The write control circuit 522 writes time information, service type, and write address in the recording database 525.

  In reading from the frame analysis device 6, the write address of the frame data to be collected is specified based on the recording database 525, the read control circuit 523 reads the data from the recording area 521, and sends it to the frame analysis device 6.

  For the write operation in the write control circuit 522 and the read operation in the read control circuit 523, the write number / read number count circuit 551 of the RW performance monitoring unit 550 counts as the number of written frames and the number of read frames. The recording medium write performance value calculation circuit 552 calculates a write performance value based on the count number, and changes the buffer threshold value 532 in the buffer threshold value monitoring unit 530.

  Based on the information from the free address management circuit 517 in the capture buffer 510, the buffer usage calculation circuit 518 calculates the buffer usage. The buffer usage amount and the buffer threshold value 532 are compared by the buffer threshold value comparison circuit 533, and if the buffer usage amount exceeds the threshold value, the threshold value alarm generation circuit 533 sends a threshold abnormality alarm.

  The recording database will be described with reference to FIG. In FIG. 10, the recording database 525 includes a serial number 5251, time information 5252, a service type 5253, and a write address 5254. The write control circuit 522 adds a record to the recording database 525 every time frame data is written to the recording area 521.

  With reference to FIG. 11, the distribution condition change process in the frame distribution apparatus will be described. In FIG. 11, the frame distribution device 4 distributes the initial state based on the condition of the distribution condition initial value 403. The frame distribution device 4 determines whether a threshold abnormality alarm has been received (S402). In the case of YES, the frame distribution device 4 determines the alarm transmission capture device in the distribution condition changing unit 417 (S403). The frame distribution device 4 randomly selects a capture device to which the service type frame in charge of the alarm transmission capture device is transferred (S404). The frame distribution device 4 reflects the selected change destination information in the distribution condition table 416 (S406). The frame distribution device 4 keeps the distribution condition change record 404 together with the time information for the change contents of the distribution condition table 416 (S407).

  In the frame distribution device 4, the route setting circuit 413 rewrites the content of the route setting register 414 based on the contents changed in the distribution condition table 416 (S 408). For example, when the frame to the capture device in charge of service type A is stopped and the distribution change is made to the capture device in charge of B, A = 1 is set to A = 0, and B = 1 is set to AorB = 1. After the change, the frame distribution device 4 determines whether or not the threshold abnormality alarm 540 has been received (S409). If YES, the frame distribution device 4 transitions to step 403. If NO in step 408, the frame distribution device 4 returns the distribution condition table 416 to the distribution condition initial value 403 (S411). In response to this, the frame distribution device 4 returns the content of the route setting register 414 of the route setting circuit 413 to the initial value (S412). The frame distribution device 4 also keeps the change contents at this time as the distribution condition change record 404 together with the changed time information (S413).

  The distribution condition change record here will be described with reference to FIG. The distribution condition change record 404 records three records. In the first record, the A service is recorded on the recording medium 520 of the capture device 50-1. In the next record from 17:54:50, the A service is recorded in the recording medium 520 of the capture device 50-3. Furthermore, in the record from 18:30:50, the A service is again recorded on the recording medium 520 of the capture device 50-1.

  With reference to FIG. 13, information acquisition processing in the frame analysis device and the capture device will be described. In FIG. 13, the frame analysis device 6 acquires information on the distribution condition change record 404 when data collection is started (S601). The frame analysis device 6 confirms the service type of the information acquisition target (S602), and the frame analysis device 6 narrows down the information of the service type of the information acquisition target from the distribution condition change record 404 (S603). Next, the frame analysis device 6 confirms the time range of the information acquisition target (S604), and further narrows down the information acquisition target information from the distribution condition change record narrowed down in S603 (S606). The frame analysis device 6 determines the capture device 50 that should collect data from the narrowed distribution condition change record (S607). Based on this result, the frame analysis device 6 accesses the information collection target capture device (S608).

  The capture device 50 confirms the service type of the information collection target (S609). The capture device 50 specifies the address where the frame of the information collection target time is stored from the recording database 525 created at the time of frame recording (S611). The capture device 50 can identify the address to be read from the service type and the time information to be collected. The capture device 50 reads data at the specified address (S612). The capture device 50 transfers the read data to the frame analysis device 6 (S613).

  The frame analysis device 6 records the data transferred from the capture device 50 on an internal recording medium (S614). The frame analysis device 6 sorts the recorded data based on the time information in the data, rearranges them in the order of time (S616), and ends.

  The capture device identification result will be described with reference to FIG. In FIG. 14, the capture device identification result 620 includes a service type 621, a search target time 622, and a data extraction target device 623. The search target time 622 includes a start time and an end time. The capture device i in the data extraction target device 623 column is the capture device 500-i. Further, the capture device identification result 620 in FIG. 14 corresponds to the distribution condition change record 404 in FIG. That is, the A service is the first record and is recorded in the capture device 50-1. The next record from 17:54:50 is recorded in the capture device 50-3. Further, the records from 18:30:50 are recorded again in the capture device 50-1.

With reference to FIG. 15, processing of recording medium write performance value calculation and buffer threshold value change will be described. In FIG. 15, the capture device 50 confirms the number of frames written by the write control circuit 522 and the number of frames read by the read control circuit 523 in the read number / write number count circuit 551 (S801, S802). The capture device 50 uses the recording medium writing performance value calculation circuit 552 to calculate the number of writing and the number of reading for a total of 100 writing and reading of frames (S803). The capture device 50 calculates the number of read frames / 100 = “buffer threshold reduction rate” (S804). Specifically, if the number of read frames is 25,
25/100 = 0.25
Therefore, the buffer threshold reduction rate is 0.25. (1−buffer threshold reduction ratio) is multiplied by the current buffer threshold 532, the buffer threshold is changed (S806), the process returns to step S801, and the buffer threshold 532 is changed in real time based on the recording medium writing performance value.

  With reference to FIG. 16, the effectiveness of reducing the amount of management information in the frame capture system will be described. In FIG. 16, the frame capture system 100 includes a frame distribution device 410 and n capture devices 50. Each capture device 50 holds a recording medium 520. In the capture device 50, the service type mainly responsible for each is determined in advance. Specifically, the capture device 50-1 captures the service type A, and the capture device 50-2 captures the service type B. The frame distribution device 410 transmits the frame to any of the capture devices 50 without dividing the frame. As a result, the recording capacity required to record one frame is (frame information + addition information) even in the entire system.

  In the embodiment described above, the frame capture system 100 distributes the frame by the frame distribution apparatus 410 without dividing the frame. The capture device 50 stores capture data in the recording medium 520 for each frame.

  Further, the frame capture system 100 divides the capture device 50 that is in charge of each service type. Since the frames are not divided, when recording on the recording medium 520, the capacity of the recording medium required per frame is (frame information + addition information), and the capacity of the recording medium can be reduced. In addition, the information necessary to acquire data from the recording medium and to be held in the recording database for managing the recorded data is reduced. The recording medium identification information is not required, and the writing address may be managed for one unit. Accordingly, the reading process when data is acquired from the recording medium 520 can be reduced.

  Further, since the capture device to be stored is divided for each service type, it is sufficient to prepare a capture device having a recording performance suitable for each service type having different traffic. As a result, there is no need to prepare a capture device having a high-performance recording performance unnecessarily.

  DESCRIPTION OF SYMBOLS 1 ... Base station termination | terminus apparatus, 2 ... Frame copy apparatus, 3 ... Service provision network, 4 ... Frame distribution apparatus, 6 ... Frame analysis apparatus, 50 ... Capture apparatus, 100 ... Frame capture system, 200 ... Mobile terminal, 300 ... Base 400, base station accommodating apparatus, 402 ... buffer threshold alarm receiving unit, 403 ... distribution condition initial value, 404 ... distribution condition change record, 410 ... frame distribution unit, 411 ... header extraction circuit, 412 ... service type information extraction circuit 413 ... Route setting circuit, 414 ... Route setting register, 415 ... Route circuit, 416 ... Distribution condition table, 417 ... Distribution condition change unit, 510 ... Capture buffer, 511 ... Frame reception detection circuit, 512 ... Write control Circuit, 513 ... Write address control circuit, 514 ... Read control circuit, 515 ... Read number Control circuit, 516 ... Buffer, 517 ... Empty address management circuit, 518 ... Buffer usage amount calculation circuit, 520 ... Recording medium, 521 ... Recording area classified by service type, 522 ... Write control circuit, 523 ... Read control circuit, 524 ... Time Information giving circuit, 525... Record database, 530... Buffer threshold value monitoring unit, 531... Buffer threshold value comparison circuit, 532... Buffer threshold value, 533. Write number read number count circuit, 552... Recording medium write performance calculation circuit, 600... Mobile access network, 700... Network, 900 .. ultra-high-speed frame capture device, 800 ... frame, 901 ... recording medium, 902.

Claims (7)

A distribution device that distributes frames to a plurality of capture devices, a plurality of capture devices that record the frames, and an analysis device that takes out and analyzes the recorded frames,
The capture device includes a frame input buffer usage calculation unit and a calculation unit monitoring unit, and the monitoring unit is configured as the threshold abnormality alarm when the usage exceeds a predetermined buffer threshold. To the device,
The distribution device includes a route setting unit that sets a frame distribution destination, and the route setting unit stops frame distribution to the capture device that has transmitted the threshold abnormality alarm when the threshold abnormality alarm is received. A frame capture system characterized by: The frame capture system according to claim 1,
The distribution apparatus determines a transmission destination capture apparatus of this frame based on service type information in the frame. The frame capture system according to claim 1,
When the distribution device receives the threshold abnormality alarm, the distribution device changes the frame to the capture device that has transmitted the threshold abnormality alarm to another capture device, and transmits the change. The frame capture system according to claim 2,
The distribution apparatus changes to a default capture apparatus determined for each service type when reception of the threshold abnormality alarm is stopped. The frame capture system according to claim 3,
The distribution apparatus records a frame output destination when the frame output destination is changed by the threshold abnormality alarm. The frame capture system according to claim 5,
The frame analysis system is characterized in that the frame analysis device identifies a capture device for collecting frame data based on the recording of the distribution device. Distributing the frame to multiple capture devices;
Calculating the frame input buffer usage;
Sending a threshold abnormality alarm when the usage exceeds a defined buffer threshold;
A frame capturing method comprising: stopping frame distribution to a capture device that has transmitted the threshold abnormality alarm and changing frame distribution to a capture device that has not transmitted the threshold abnormality alarm when the threshold abnormality alarm is received.

Images