TRAFFIC ANALYSIS FOR A LAWFUL INTERCEPTION SYSTEM

• US 20090254650A1
• Filed: 04/03/2008
• Published: 10/08/2009
• Est. Priority Date: 04/03/2008
• Status: Active Grant

• Current Assignee: At&T Delaware Intellectual Property, Inc. (AT&T, Inc.)
• Original Assignee: At&T Delaware Intellectual Property, Inc. (AT&T, Inc.)
• Inventors: Sheppard, Scott
• Granted Patent: US 8,200,809 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

Methods, systems, and computer-readable media provide for analyzing data traffic captured by a lawful interception system. A first record, one or more intermediate records, and a second record are received. Each of the records contains a record of test traffic, such as a website, transmitted across a broadband network. The first record, the one or more intermediate records, and the second record are reassembled to form various versions of the website. The various versions of the website are displayed so that a visual comparison can be made to verify the operation of the lawful interception system.

Claims

1. A method for analyzing data traffic captured by a lawful interception system, comprising:

receiving a first record, the first record being created at a source computer, the first record comprising a record of original test traffic generated at the source computer and transmitted from the source computer across a broadband network, the original test traffic comprising an access to a website via a web browser;

receiving one or more intermediate records, each of the intermediate records comprising a record of intercepted test traffic transmitted from a router to a mediation system or from the mediation system to a law enforcement agency system;

receiving a second record, the second record being created at the law enforcement agency system, the second record comprising a record of the intercepted test traffic received at the law enforcement agency system from the second mediation system;

reassembling a first version of the website based on the first record;

reassembling one or more intermediate versions of the website based on the one or more intermediate records;

reassembling a second version of the website based on the second record; and

displaying the first version of the website and at least one of the one or more intermediate versions of the website and the second version of the website for enabling a visual comparison between the first record and at least one of the one or more intermediate records and the second record.

2. The method of claim 1, further comprising:

determining a first time at which the original test traffic is generated at the source computer;

determining a plurality of intermediate times at which the intercepted test traffic is received at the mediation system from the router or at the law enforcement agency system from the mediation system;

determining a second time at which the intercepted test traffic is received at the law enforcement agency system from the second mediation system; and

comparing a difference between the first time and at least one of the intermediate times and the second time with a given time requirement to determine whether the intercepted data traffic is timely received.

3. The method of claim 1, wherein the original test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

4. The method of claim 1, wherein the first record, the intermediate records, and the second record each comprise a packet capture (PCAP) file.

5. The method of claim 1, wherein the router intercepts the original test traffic to create the intercepted test traffic, the router identifying the original test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the first mediation system via user datagram protocol (UDP).

6. The method of claim 1, wherein the first record is created via a sniffer program executed at the source computer, wherein the each of the intermediate records is created via a TCPDUMP command executed at the mediation system, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.

7. A system for analyzing data traffic captured by a lawful interception system, comprising:

a memory for storing a program containing code for analyzing data traffic captured by a lawful interception system;

a processor functionally coupled to the memory, the processor being responsive to computer-executable instructions contained in the program and operative to;

receive a first record, the first record being created at a source computer, the first record comprising a record of original test traffic generated at the source computer and transmitted from the source computer across a broadband network, the original test traffic comprising an access to a website via a web browser,

receive one or more intermediate records, each of the intermediate records comprising a record of intercepted test traffic transmitted from a router to a mediation system or from the mediation system to a law enforcement agency system,

receive a second record, the second record being created at the law enforcement agency system, the second record comprising a record of the intercepted test traffic received at the law enforcement agency system from the second mediation system,

reassemble a first version of the website based on the first record,

reassemble one or more intermediate versions of the website based on the one or more intermediate records,

reassemble a second version of the website based on the second record, and

display the first version of the website and at least one of the one or more intermediate versions of the website and the second version of the website for enabling a visual comparison between the first record and at least one of the one or more intermediate records and the second record.

8. The system of claim 7, wherein the original test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

9. The system of claim 7, wherein the first record, the intermediate records, and the second record each comprise a packet capture (PCAP) file.

10. The system of claim 7, wherein the router identifies the original test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the first mediation system via user datagram protocol (UDP).

11. The system of claim 7, wherein the first record is created via a sniffer program executed at the source computer, wherein the each of the intermediate records is created via a TCPDUMP command executed at the mediation system, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.

12. A computer-readable medium having instructions stored thereon for execution by a processor to provide a method for analyzing data traffic captured by a lawful interception system, the method comprising:

receiving a first record, the first record being created at a source computer, the first record comprising a record of original test traffic generated at the source computer and transmitted from the source computer across a broadband network, the original test traffic comprising an access to a website via a web browser;

receiving one or more intermediate records, each of the intermediate records comprising a record of intercepted test traffic transmitted from a router to a mediation system or from the mediation system to a law enforcement agency system;

receiving a second record, the second record being created at the law enforcement agency system, the second record comprising a record of the intercepted test traffic received at the law enforcement agency system from the second mediation system;

reassembling a first version of the website based on the first record;

reassembling one or more intermediate versions of the website based on the one or more intermediate records;

reassembling a second version of the website based on the second record; and

displaying the first version of the website and at least one of the one or more intermediate versions of the website and the second version of the website for enabling a visual comparison between the first record and at least one of the one or more intermediate records and the second record.

13. The computer-readable medium of claim 12, wherein the original test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

14. The computer-readable medium of claim 12, wherein the first record, the intermediate records, and the second record each comprise a packet capture (PCAP) file.

15. The computer-readable medium of claim 12, wherein the router intercepts the original test traffic to create the intercepted test traffic, the router identifying the original test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the first mediation system via user datagram protocol (UDP).

16. The computer-readable medium of claim 12, wherein the first record is created via a sniffer program executed at the source computer, wherein the each of the intermediate records is created via a TCPDUMP command executed at the mediation system, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.