Method of simulating network communications

• US 20030031181A1
• Filed: 07/09/2002
• Published: 02/13/2003
• Est. Priority Date: 07/17/2001
• Status: Active Grant

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Rowley, Bevan S., Huntington, Stephen G.
• Granted Patent: US 7,296,080 B2
• Time in Patent Office: Days
• US Class Current: 370/394
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method for simulating network communication sessions is disclosed. A control engine sequences the packets using a protocol stack or by putting the packets into a sorted list. A simulation engine acquires the packets until a request packet or other initiation packet is received. The simulation engine feeds the request packet to a display engine that has the ability to treat the request packet as though the display engine itself originated the request (or initiation) packet. The simulation engine then sends the response packets relating to the request to the display engine, and the display engine uses those packets to simulate the display of the network communication session substantially in the form of the original communication.

Claims

1. A method for simulating network communications traffic comprising the steps of:

capturing network packets by;

attaching a network capture device to a network;

using the network capture device to capture network packets as the packets are passed across the network;

storing the plurality of network packets on a mass storage device in chronological order;

selecting a portion of the captured network packets based on a first predetermined set of criteria;

sequencing the selected packets using a predetermined process;

simulating a network communication session by a process comprising the steps of;

acquiring sequenced packets that are associated with the network communication until a first request packet is detected;

feeding the first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, determining whether the packet is of a type that may be interpreted by the display engine and either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine and acquiring additional response packets until all of the packets responding to the first request packet have been sent to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, initiating the creation of a visualization of the information in the next sequenced packet and acquiring additional response packets until all of the packets responding to the first request packet have been incorporated into the visualization, and then sending the visualization to the display engine.

2. The method of claim 1 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected packets;

(b) if the first packet relates to a request or to a response, adding the packet to a sorted list corresponding to a second predetermined set of criteria that are satisfied by the packet; and

(c) repeating steps (a) and (b) on additional captured packets until all packets relating to the first predetermined set of criteria have been sequenced.

3. The method of claim 1 wherein the predetermined process comprises the steps of:

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the selected packet meets the second predetermined set of criteria, determining whether the packet is out of sequence;

if the packet is not out of sequence, sending the packet to the simulation engine;

if the packet is out of sequence, adding the packet to a temporary store;

repeating the steps of reading packets, determining whether the second set of criteria is met, and sending the packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as packets in the temporary store fall into proper sequence, sending the properly sequenced packets to the simulation engine; and

each time a packet is added to the temporary store, testing the temporary store for an overflow condition and, if an overflow condition is detected, generating an error message.

4. The method of claim 1 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring sequenced packets and sending the sequenced packets to the display engine until all of the packets responding to the additional request packets have been sent to the display engine.

5. The method of claim 1 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

6. The method of claim 1 further comprising the step of using the display engine to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

7. The method of claim 5 further comprising the step of providing a user with a means of controlling the display of the network communication.

8. The method of claim 5 further comprising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in chronological order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.

9. The method of claim 1 wherein the first predetermined set of criteria includes the address of at least one computer connected to the network.

10. The method of claim 1 wherein the first predetermined set of criteria includes specifying a predetermined time interval.

11. A method for simulating network communications traffic comprising the steps of:

sequencing selected packets from a network communication using a predetermined process;

simulating a network communication session by a process comprising the steps of;

acquiring sequenced packets that are associated with the network communication until a first request packet is detected;

feeding the first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, determining whether the packet is of a type that may be interpreted by the display engine and either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine and acquiring additional response packets until all of the packets responding to the first request packet have been sent to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, initiating the creation of a visualization of the information in the next sequenced packet and acquiring additional response packets until all of the packets responding to the first request packet have been incorporated into the visualization, and then sending the visualization to the display engine.

12. The method of claim 11 further comprising the steps of:

attaching a network capture device to a network;

using the network capture device to capture network packets as the packets are passed across the network;

storing the plurality of network packets on a mass storage device in chronological order; and

selecting a portion of the captured network packets based on a first predetermined set of criteria.

13. The method of claim 11 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected packets;

(b) if the first packet relates to a request or to a response, adding the packet to a sorted list corresponding to a second predetermined set of criteria that are satisfied by the packet; and

(c) repeating steps (a) and (b) on additional captured packets until all packets relating to the first predetermined set of criteria have been sequenced.

14. The method of claim 11 wherein the predetermined process comprises the steps of:

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the selected packet meets the second predetermined set of criteria, determining whether the packet is out of sequence;

if the packet is not out of sequence, sending the packet to the simulation engine;

if the packet is out of sequence, adding the packet to a temporary store;

repeating the steps of reading packets, determining whether the second set of criteria is met, and sending the packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as packets in the temporary store fall into proper sequence, sending the properly sequenced packets to the simulation engine; and

each time a packet is added to the temporary store, testing the temporary store for an overflow condition and, if an overflow condition is detected, generating an error message.

15. The method of claim 11 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring sequenced packets and sending the sequenced packets to the display engine until all of the packets responding to the additional request packets have been sent to the display engine.

16. The method of claim 11 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

17. The method of claim 11 further comprising the step of using the display engine to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

18. The method of claim 16 further comprising the step of providing a user with a means of controlling the display of the network communication.

19. The method of claim 16 further comprising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in chronological order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.

20. A method for simulating network communications traffic comprising the steps of:

acquiring sequenced packets that are associated with the network communication;

feeding a first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, creating a visualization of the information in the next sequenced packet and sending the visualization to the display engine.

21. The method of claim 20 further comprising the step of acquiring additional response packets until all of the packets responding to the first request packet have been acquired and sent to the display engine.

22. The method of claim 20 further comprising the steps of:

attaching a network capture device to a network;

using the network capture device to capture network packets as the packets are passed across the network;

storing the plurality of network packets on a mass storage device in chronological order; and

selecting a portion of the captured network packets based on a first predetermined set of criteria.

23. The method of claim 20 further comprising the step of sequencing selected packets from a network communication using a predetermined process.

24. The method of claim 23 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected packets;

(b) if the first packet relates to a request or to a response, adding the packet to a sorted list corresponding to a second predetermined set of criteria that are satisfied by the packet; and

(c) repeating steps (a) and (b) on additional captured packets until all packets relating to the first predetermined set of criteria have been sequenced.

25. The method of claim 23 wherein the predetermined process comprises the steps of:

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the selected packet meets the second predetermined set of criteria, determining whether the packet is out of sequence;

if the packet is not out of sequence, sending the packet to the simulation engine;

if the packet is out of sequence, adding the packet to a temporary store;

repeating the steps of reading packets, determining whether the second set of criteria is met, and sending the packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as packets in the temporary store fall into proper sequence, sending the properly sequenced packets to the simulation engine; and

each time a packet is added to the temporary store, testing the temporary store for an overflow condition and, if an overflow condition is detected, generating an error message.

26. The method of claim 20 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring sequenced packets and sending the sequenced packets to the display engine until all of the packets responding to the additional request packets have been sent to the display engine.

27. The method of claim 20 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

28. The method of claim 20 further comprising the step of using the display engine to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

29. The method of claim 27 further comprising the step of providing a user with a means of controlling the display of the network communication.

30. The method of claim 27 further comprising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in chronological order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.