Attributes of captured objects in a capture system

• US 20070271371A1
• Filed: 05/22/2006
• Published: 11/22/2007
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Reconnex Corporation
• Inventors: Deninger, William, Lowe, Rick, Iglesia, Erik de la, Singh Ahuja, Ratinder Paul
• Granted Patent: US 7,958,227 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones

Abstract

A system and method for capturing objects and balancing systems resources in a capture system are described. An object is captured, metadata associated with the objected generated, and the object and metadata stored.

Claims

1. A method comprising:

capturing an object being transmitted over a network;

determining the protocol associated with the object;

classifying the object based at least in part on the protocol, wherein the classifying includes generating metadata associated with the object;

storing the metadata and object; and

balancing the resources of the capture system.

2. The method of claim 1, wherein the capturing further comprises:

capturing at least one packet; and

reconstructing an object from the at least one packet.

3. The method of claim 1, further comprising:

decompressing the object.

4. The method of claim 1, wherein the balancing comprises:

determining an amount memory of the capture system is needed to reassemble a flow; and

determining a flow rate for the capture system from the amount of memory.

5. The method of claim 4, wherein the flow rate is the number of concurrent sessions that are supported at a time by the capture system.

6. The method of claim 4, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.

7. An article of manufacture including program code which, when executed by a machine, causes the machine to perform a method, the method comprising:

capturing an object being transmitted over a network;

determining the protocol associated with the object;

classifying the object based at least in part on the protocol, wherein the classifying includes generating metadata associated with the object;

storing the metadata and object; and

balancing the resources of the capture system.

8. The article of manufacture of claim 7, wherein the capturing further comprises:

capturing at least one packet; and

reconstructing an object from the at least one packet.

9. The article of manufacture of claim 7, further comprising:

decompressing the object.

10. The article of manufacture of claim 7, wherein the balancing comprises:

determining an amount memory of the capture system is needed to reassemble a flow; and

determining a flow rate for the capture system from the amount of memory.

11. The method of article of manufacture 10, wherein the flow rate is the number of concurrent sessions that are supported at a time by the capture system.

12. The method of article of manufacture 10, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.

13. A capture system comprising:

a network interface module to receive a packet;

a packet capture module to capture to the packet received by the network interface module;

an object assembly module to reassemble an object associated from the captured packet;

an object classification module to generate a tag for the object and balance memory resources of the capture system; and

an object store module to store the object and the tag.

14. The capture system of claim 13, wherein the memory resources are balanced by:

determining an amount memory of the capture system is needed to reassemble a flow; and

determining a flow rate for the capture system from the amount of memory.

15. The capture system of claim 14, wherein the flow rate is the number of concurrent sessions that are supported at a time by the capture system.

16. The capture system of claim 14, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.