DEDICATED NETWORK INTERFACE

• US 20090028144A1
• Filed: 01/17/2008
• Published: 01/29/2009
• Est. Priority Date: 07/23/2007
• Status: Active Grant

• Current Assignee: Verint Systems Incorporated
• Original Assignee: Verint Systems Incorporated
• Inventors: Blair, Christopher Douglas
• Granted Patent: US 9,455,896 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 69/326 in the transport layer [OSI layer 4] H04L69/16 takes precedence

Abstract

Computer communications that are to be recorded are visible to a network interface on a recording computer. The network interface receives the packets to be recorded. The network layer of the recording computer implements a subset of the normal IP module in the network layer. Instead of checking every IP packet, the IP module in the network layer assumes that most IP packets are correctly addressed, internally consistent and of the expected protocol type. The recording computer allocates the received packets to a recording session based upon the value of a field that is at a fixed position within the packet. Packets that are allocated to a session are recorded or associated with other packets that have been allocated to the same session.

Claims

1. A method of recording computer communications, comprising:

receiving a first IP packet directed to a recording network interface;

allocating the first IP packet to a first recording stream of packets based upon a first session identifier value specified at a first offset in the first IP packet; and

storing at least a portion of the first IP packet associated with the first recording stream of packets.

2. The method of claim 1, further comprising:

receiving a second IP packet directed to the recording network interface;

allocating the second IP packet to a second recording stream of packets based only upon a second session identifier value specified at the first offset in the second IP packet; and

storing at least a portion of the second IP packet associated with the second recording stream of packets.

3. The method of claim 1, further comprising:

receiving a second IP packet directed to the recording network interface;

checking the second IP packet for an indication that storing of the first recording stream of packets should be stopped; and

stopping storing the first recording stream of packets if the checking the second IP packet indicates that storing of the first recording stream of packets should be stopped.

4. The method of claim 1, further comprising:

pre-formatting a block of transmit packets; and

transmitting the block of transmit packets at predetermined intervals.

5. The method of claim 4, wherein the block of transmit packets correspond to silence.

6. The method of claim 4, wherein the block of transmit packets correspond to a beep tone.

21. The method of claim 1, wherein the first IP packet is also a UDP packet and the first session identifier is a UDP port number within the first IP packet.

7. A system of recording computer communications, comprising:

a network interface receiving a plurality of IP packets to be recorded;

a packet allocator that allocates the plurality of IP packets to a first recording stream based upon a value at a fixed first offset in each of the plurality of IP packets; and

packet storage that stores the first recording stream.

8. The system of claim 7, further comprising:

a packet checker that checks a subset of the plurality of IP packets for an indication that storing of the first recording stream should be stopped.

9. The system of claim 7, further comprising:

a packet pool of preformatted packets wherein the preformatted packets are transmitted to a network interface at predetermined intervals.

10. The system of claim 9, wherein the packet pools correspond to silent audio.

11. The system of claim 9, wherein the packet pools correspond to a beep tone.

12. A computer readable medium having instructions stored thereon for recording computer communications that, when executed by a computer, direct the computer to:

receive a first IP packet directed to a recording network interface;

allocate the first IP packet to a first recording stream of packets based only upon a first session identifier value specified at a first offset in the first IP packet; and

store at least a portion of the first IP packet associated with the first recording stream of packets.

13. The computer readable medium of claim 12 wherein the instructions, when executed by the computer system, further direct the computer system to:

receive a second IP packet directed to the recording network interface;

allocate the second IP packet to a second recording stream of packets based upon a second session identifier value specified at the first offset in the second IP packet; and

store at least a portion of the second IP packet associated with the second recording stream of packets.

14. The computer readable medium of claim 12 wherein the instructions, when executed by the computer system, further direct the computer system to:

receive a second IP packet directed to the recording network interface;

check the second IP packet for an indication that storing of the first recording stream of packets should be stopped; and

stop storing the first recording stream of packets if the checking the second IP packet indicates that storing of the first recording stream of packets should be stopped.

15. The program storage device of claim 12 wherein the instructions, when executed by the computer system, further direct the computer system to:

pre-format a block of transmit packets; and

transmit the block of transmit packets at predetermined intervals.

16. The computer readable medium of claim 15, wherein the block of transmit packets correspond to silence.

17. The computer readable medium of claim 15, wherein the block of transmit packets correspond to a tone.

18. The computer readable medium of claim 13, wherein the instructions, when executed by the computer system, further direct the computer system to:

receive a third IP packet directed to the recording network interface;

check the third IP packet for an indication that storing of the first recording stream of packets should be stopped; and

stop storing the first recording stream of packets if the checking the third IP packet indicates that storing of the first recording stream of packets should be stopped.

19. The computer readable medium of claim 18 wherein the instructions, when executed by the computer system, further direct the computer system to:

pre-format a block of transmit packets; and

transmit the block of transmit packets at predetermined intervals.

20. The computer readable medium of claim 19, wherein the block of transmit packets corresponds to silence.

22. The computer readable medium of claim 12 wherein the first IP packet is also a UDP packet and the first session identifier is a UDP port number within the first IP packet.