Sliding window packet management systems

• US 20030135525A1
• Filed: 07/17/2002
• Published: 07/17/2003
• Est. Priority Date: 07/17/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Major, John Darren, Covington, Stanley P., Rowley, Bevan S., Huntington, Stephen Glen
• Granted Patent: US 7,162,698 B2
• Time in Patent Office: Days
• US Class Current: 715/501.1
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: Y10S 715/963 Calendar or scheduling

Abstract

Included in the invention are systems and methods of full time recording network traffic to a hierarchical data storage. Also included in the invention are systems and methods of retrieval of recorded network traffic from a hierarchically organized network data repository. Additionally included in the invention are systems and methods of efficiently filtering data in a hierarchically organized network data repository. Systems and methods of displaying recorded network data utilizing the retrieval systems are also included in the invention. Further included in the invention are systems and methods of providing sliding time window selection user interfaces. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A computer system for specifying captured network packets, comprising:

a processor system having memory;

a display operable by said processor;

at least one input device whereby a user may provide input to said processor system;

a storage device readable by said processor;

media contained in said storage device;

computer instructions stored to said media device, said instructions being executable by said processor system to achieve the functions of;

(i) accessing a hierarchically organized network data repository,

(ii) displaying a graphical timeline on said display,

(iii) displaying on the display data start and end features in association with the timeline,

(iv) displaying on the display selection start and end features in association with the timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times,

(v) accepting a selection of a new selection start position from a user,

and (vi) accepting a selection of a new selection end position from a user.

2. The computer system of claim 1, wherein the computer instructions are further executable to achieve the functions of:

(i) determining a size value for the selected data of the data repository,

and (ii) displaying the size value on the display.

3. The computer system of claim 1, wherein the computer instructions are further executable to achieve the function of textually displaying the selection start and selection end times.

4. The computer system of claim 1, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting time textual input from a user,

(ii) modifying a selection start or a selection end time according to the time textual input,

and (iii) displaying the selection start and end features at the new relative position.

5. The computer system of claim 1, wherein the computer instructions are further executable to achieve the function of distinguishing a portion of the timeline for which network data is unavailable in the network data repository.

6. The computer system of claim 1, wherein the computer instructions are further executable to achieve the function of displaying, using at least one calendar, the selection start and end times.

7. The computer system of claim 1, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting a selection of a day in a displayed calendar from a user,

(ii) modifying a selection start or a selection end time according to the selection day input,

and (iii) displaying the selection start and end features at the new relative position.

8. The computer system of claim 1, wherein the computer instructions are further executable to achieve the function of displaying the selection start and end times in at least one clock having at least an hour and a minute hand.

9. The computer system of claim 8, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting a selection of a time of day in a displayed clock from a user,

(ii) modifying a selection start or a selection end time according to the selection day input,

and (iii) displaying the selection start and end features at the new relative position.

10. A computer media product, comprising:

media;

computer instructions stored to said media, said instructions being executable by a computer system to achieve the functions of;

(i) accessing a hierarchically organized network data repository,

(ii) displaying a graphical timeline on said display,

(iii) displaying on the display data start and end features in association with the timeline,

(iv) displaying on the display selection start and end features in association with the timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times,

(v) accepting a selection of a new selection start position from a user,

and (vi) accepting a selection of a new selection end position from a user.

11. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the functions of:

(i) determining a size value for the selected data of the data repository,

and (ii) displaying the size value on the display.

12. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the function of textually displaying the selection start and selection end times.

13. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting time textual input from a user,

(ii) modifying a selection start or a selection end time according to the time textual input,

and (iii) displaying the selection start and end features at the new relative position.

14. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the function of distinguishing a portion of the timeline for which network data is unavailable in the network data repository.

15. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the function of displaying, using at least one calendar, the selection start and end times.

16. The computer media product of claim 15, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting a selection of a day in a displayed calendar from a user,

(ii) modifying a selection start or a selection end time according to the selection day input,

and (iii) displaying the selection start and end features at the new relative position.

17. The computer media product of claim 10, wherein the computer instructions are further executable to achieve the function of displaying the selection start and end times in at least one clock having at least an hour and a minute hand.

18. The computer media product of claim 17, wherein the computer instructions are further executable to achieve the functions of:

(i) accepting a selection of a time of day in a displayed clock from a user,

(ii) modifying a selection start or a selection end time according to the selection day input,

and (iii) displaying the selection start and end features at the new relative position.

19. A system for specifying captured network packets, comprising:

means of accessing a hierarchically organized network data repository;

means of displaying a graphical timeline;

means of displaying data start and end features in association with the timeline;

means of displaying selection start and end features in association with the timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the representative times;

means of accepting a selection of a new selection start position from a user;

and means of accepting a selection of a new selection end position from a user.

20. The system of claim 19, further comprising:

means of inserting a selection start and end position into a filter expression, the filter expression composed of matching expressions linked by logical operators;

means of computing efficiency ratings for the matching expressions and logical operators of the filter expression;

means of applying the matching expressions to a network traffic data repository in preferential order of efficiency;

means of receiving filtered network traffic data from applying means;

means of parsing the filtered network traffic data according to request and response packets;

means of passing the parsed network traffic data to a multi-packet recompiler.