Packet data recording method and system

• US 20050240656A1
• Filed: 02/11/2002
• Published: 10/27/2005
• Est. Priority Date: 02/12/2001
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Credit Suisse International (Credit Suisse)
• Inventors: Blair, Christopher Douglas
• Granted Patent: US 8,285,833 B2
• Time in Patent Office: Days
• US Class Current: 709/213
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/202 VoIP; Packet switched telephony

Abstract

The present invention provides for a data recording system including data recording means having a plurality of network interface cards in which a plurality of network interface cards can be employed within a single recording mean and each card can be provided with a plurality of network connecting ports then, for example, for each RTP packet stream being recorded, the system can advantageously note the sequence number for the most recently accepted packet and any packet received with a lower sequence number can be readily discarded.

Claims

1. A data recording system including data recording means having a plurality of network interface cards.

2. A system as claimed in claim 1 and including a plurality of network interface cards within a single recording means.

3. A system as claimed in claim 2, wherein each Network interface card has multiple network connection ports.

4. A system as claimed in claim 1, 2 or 3, wherein each individual recording means is arranged for mutual communication so as to advise each other of the presence of particular packet streams.

5. A system as claimed in any one of claims 1 to 4, and arranged such that each recorder is advised of the addresses to be monitored;

when a recorder identifies a packet with the required addresses it begins recording it and advises all other recorders to stand down; and

other recorders are arranged to note these addresses as being recorded elsewhere.

6. A system as claimed in claim 5 and further arranged such that the notification sent to other recorders include within it the sequence number of an RTP packet that was first received and the IP address of the receiving recorder;

that in the event that more than one recorder receives packets prior to hearing notification from another recorder that it has commenced recording, the recorder which received the earliest packet can maintain responsibility for recording and the other recorder shall cease recording;

that should more than one recorder receive the same packet and send notification of this, then the recorder with highest IP address can maintain its recording and the other(s) will stand down; and

that when recording begins, a recorder will not create a record in the database of recordings until a pre-defined time has elapsed in case it receives, during this period, a notification from another recorder that it too has started recording. Should it receive such notification and, according to the algorithms defined in (d) to (f) above, it is to stand down, it will abandon its recording without having altered the database of recordings.

7. A system as claimed in claim 6 and further arranged such that should a packet be lost an indication of the sequence number(s) of the lost packets can be maintained as part of the recording control structure for that IP address;

and that when packets are received that are determined to be earlier than the most recently accepted packet for that address, their sequence number can subsequently be compared against the list of recently missed packets and, if found, can be stored at the appropriate offset within the recording buffer overwriting the padding that was inserted when the later packet was received and loss of packet(s) identified.

8. A method of recording a data employing a plurality of network interface cards and including the steps carried out by the system of any one or more of claims 2 to 7.

21. A system as claimed in any one of the preceding claims, and arranged to compare the sequence number of the received packet with that of the previously received packet and to identify if a difference exists.

22. A data recording system as claimed in any one of the preceding claims and arranged such that recordings stored independently for each direction of transmission.

9. A data packet recording system arranged for determining an IP address of an application and including means for comparing at least a sample of received or transmitted packets with at least a set of pre-programmed signature packets.

10. A system as claimed in claim 9 and arranged for comparing all packets received from or sent to each destination against a set of pre-programmed signature packets.

11. A system as claimed in claim 9 and arranged such that the sustained absence of such packets is employed as an indicator of an error condition with the device that was previously active on that address.

12. A method of recording a data packet for determining an IP address of an application and including the step of comparing at least a sample of received or transmitted packets with at least a set of pre-programmed signature packets.

13. A data recording system arranged such that the data packets are arranged to be transmitted via a proxy server and further arranged such that the IP address of at least one party to the conversation is altered.

14. A system as claimed in claim 13, and arranged to determine the presence and IP address of the proxy servers, to allow for recorders passing their knowledge of current mappings to other recorders allowing them to refine their filtering algorithms;

and to pass examples of specific packets identified as having been mapped by the proxy server to other recorders.

15. A data packet recording system including packet filtering means arranged for filtering on the basis of an IP address.

16. A data packet recording system as claimed in claim 15, and arranged for filtering on the basis of an IP port number of both source and/or destination address(es).

17. A system as claimed in claim 15 or 16, and arranged to analyse the sequence number and timestamp to determine the next packet in the expected sequence based on whether one or more packets have been missed such that performance counters can be incremented appropriately;

inserting additional data in the recorded stream to pad-out the space that should have been taken up by the missing packet(s) and whether the payload of the RTP packet can be appended to a buffer and the remainder of the packet discarded.

18. A system as claimed in claim 15 or 16 and arranged such that a signature data pattern is appended to a data buffer collecting packets to/from the specific destination;

a timestamp indicating the time at which the packet was received to the buffer;

a length indicator specifying the number of bytes in the recorded packet is appended to the buffer; and

that the contents of the packet are appended to the buffer.

19. A data recording system for IP telephones controlled by an IP-PBX application and wherein the controlling application is arranged to request that each phone advise it of the port number for which it can receive incoming audio data.

20. A system as claimed in claim 19, and arranged for the identification and storage of only the payloads of successive RTP messages.