Network traffic system and method of operation thereof

• US 10,367,656 B2
• Filed: 02/22/2016
• Issued: 07/30/2019
• Est. Priority Date: 02/25/2015
• Status: Active Grant

• Current Assignee: Quantea Corporation
• Original Assignee: Quantea Corporation
• Inventors: Francisco, Michael B., Liu, Nan
• Primary Examiner(s): Mered, Habte
• Application Number:
  US15/049,436
• Publication Number:
  US 20160248655A1
• Time in Patent Office: 1,254 Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering

Abstract

A system and method of operation of a network traffic system includes: a first portion of network traffic gathered from an external network; a first network filter for selecting a first network packet from the first portion of the network traffic; a first capture file for storing the first network packet; a second network packet selected from a second network filter; a second capture file for storing the second network packet concurrently with the compression of the first capture file; and a display device for displaying the first compressed capture file using a search value.

Claims

1. A method of operation for a network traffic system comprising:

gathering a first portion of network traffic from a first network port, the first portion based on a first network filter executing on a first core of a multicore processor, the first portion including state parameters of the network traffic, the first portion stored to a first capture file having a block size of greater than or equal to 1 megabyte (MB);

compressing the first capture file using a second core of the multicore processor while concurrently storing a second portion of the network traffic in a second capture file, the second portion gathered from a second network port and based on a second network filter;

gathering a third portion of the network traffic from a third network port, the third portion based on a third network filter;

replaying time-shifted network traffic from the gathered network traffic in the first capture file, the second capture file, and a third capture file in parallel from the first network port, the second network port, and the third network port respectively;

concurrent with the replaying, gathering a targeted portion of the time-shifted network traffic from the first network port, the second network port, and the third network port, the targeted portion based on a target network filter executing on a selected core of the multicore processor, the selected core identified by a predefined core affinity value, the targeted portion stored to a target capture file having a block size great than or equal to one megabyte (MB); and

searching the target capture file using a search value to obtain search results for displaying on a display device.

2. The method as claimed in claim 1 wherein gathering the first portion includes configuring the first network filter to only allow GPRS tunneling protocol packets.

3. The method as claimed in claim 1 wherein gathering the first portion of the network traffic includes gathering the first portion of the network traffic using a network packet broker.

4. The method as claimed in claim 1 wherein storing the gathering a filtered portion of the network traffic includes storing the analysis capture file across a distributed storage system.

5. The method as claimed in claim 1 wherein gathering the first portion of the network traffic includes configuring the first network filter differently than the target network filter.

6. A method of operation for a network traffic system comprising:

gathering a first portion of network traffic from a first network port coupled to a network having a bandwidth greater than or equal to 20 gigabytes per second, the first portion based on a first network filter executing on a first core of a multicore processor, the first portion including state parameters of the network traffic, and the first portion stored to a first capture file having a block size of greater than or equal to one megabyte (MB);

compressing the first capture file using a second core of the multicore processor while concurrently storing a second portion of the network traffic in a second capture file, the second portion gathered from a second network port and based on a second network filter,

gathering a third portion of the network traffic from a third network port, the third portion based on a third network filter;

replaying time-shifted network traffic from the gathered network traffic in the first capture file, the second capture file, and another capture file in parallel from the first network port, the second network port, and another network port respectively, and the second capture file and the another capture file;

concurrent with the replaying, gathering a targeted portion of the time-shifted network traffic from the first network port, the second network port, and the another network port, the targeted portion based on a target network filter executing on a selected core of the multicore processor, the selected core identified by a predefined core affinity value, the targeted portion stored to a target capture file having a block size great than or equal to one megabyte (MB); and

searching the target capture file using a search value to obtain search results for displaying on a display device.

7. The method as claimed in claim 6 wherein gathering the first portion of the network traffic includes configuring the first network filter to only allow GPRS tunneling protocol packets.

8. The method as claimed in claim 6 wherein gathering the first portion of the network traffic includes gathering the first portion of the network traffic using a network packet broker.

9. The method as claimed in claim 6 wherein gathering the first portion of the network traffic includes storing the first capture file across a distributed storage system.

10. The method as claimed in claim 6 wherein gathering the first portion of the network traffic includes configuring the first network filter differently than the target network filter.

11. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause:

gathering a first portion of network traffic from a first network port, the first portion based on a first network filter executing on a first core of a multicore processor, the first portion including state parameters of the network traffic, the first portion stored to a first capture file having a block size of greater than or equal to 1 megabyte (MB);

compressing the first capture file using a second core of the multicore processor while concurrently storing a second portion of the network traffic in a second capture file, the second portion gathered from a second network port and based on a second network filter;

gathering a third portion of the network traffic from a third network port, the third portion based on a third network filter;

replaying time-shifted network traffic from the gathered network traffic in the first capture file, the second capture file, and a third capture file in parallel from the first network port, the second network port, and the third network port respectively;

concurrent with the replaying, gathering a targeted portion of the time-shifted network traffic from the first network port, the second network port, and the third network port, the targeted portion based on a target network filter executing on a selected core of the multicore processor, the selected core identified by a predefined core affinity value, the targeted portion stored to a target capture file having a block size great than or equal to one megabyte (MB); and

searching the target capture file using a search value to obtain search results for displaying on a display device.

12. The one or more non-transitory computer-readable media of claim 11 wherein gathering the first portion includes configuring the first network filter to only allow GPRS tunneling protocol packets.

13. The one or more non-transitory computer-readable media of claim 11 wherein gathering the first portion of the network traffic includes gathering the first portion of the network traffic using a network packet broker.

14. The one or more non-transitory computer-readable media of claim 11 wherein storing the gathering a filtered portion of the network traffic includes storing the analysis capture file across a distributed storage system.

15. The one or more non-transitory computer-readable media of claim 11 wherein gathering the first portion of the network traffic includes configuring the first network filter differently than the target network filter.

16. The one or more non-transitory computer-readable media of claim 11 wherein the first network port is coupled to a network having a bandwidth greater than or equal to 20 gigabytes per second.

17. The one or more non-transitory computer-readable media of claim 16 wherein gathering the first portion of the network traffic includes configuring the first network filter to only allow GPRS tunneling protocol packets.

18. The one or more non-transitory computer-readable media of claim 16 wherein gathering the first portion of the network traffic includes gathering the first portion of the network traffic using a network packet broker.

19. The one or more non-transitory computer-readable media of claim 16 wherein gathering the first portion of the network traffic includes storing the first capture file across a distributed storage system.

20. The one or more non-transitory computer-readable media of claim 16 wherein gathering the first portion of the network traffic includes configuring the first network filter differently than the target network filter.