ON DEMAND NETWORK ACTIVITY REPORTING THROUGH A DYNAMIC FILE SYSTEM AND METHOD

• US 20090292736A1
• Filed: 05/23/2008
• Published: 11/26/2009
• Est. Priority Date: 05/23/2008
• Status: Abandoned Application

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Brown, James, Tveit, Paal, Edginton, Brian, Wood, Matthew Scott, Shillingford, Steve
• Application Number:
  US12/126,619
• Publication Number:
  US 20090292736A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering

Abstract

A method, apparatus and a system of on demand network activity reporting through a dynamic file system and method are disclosed. In one embodiment, a method includes forming a root level selection guide based on a set of criteria associated with an activity through a network that is captured and stored on a storage device associated with a network appliance, refreshing listings of a sub-directory of the root level selection guide dynamically based on the activity through the network stored on the storage device when an option is selected in the root level selection guide, and creating a packet capture file based on a current state of the activity through the network when one of the listings of the sub-directory of the root level selection guide is selected. The method may include automatically referencing a database having the activity through the network when creating the packet capture file.

Claims

1. A method comprising:

forming a root level selection guide based on a set of criteria associated with an activity through a network that is captured and stored on a storage device associated with a network appliance;

refreshing listings of a sub-directory of the root level selection guide dynamically based on the activity through the network stored on the storage device when an option is selected in the root level selection guide; and

creating a packet capture file based on a current state of the activity through the network when one of the listings of the sub-directory of the root level selection guide is selected.

2. The method of claim 1 further comprising:

automatically referencing a database having the activity through the network when creating the packet capture file.

3. The method of claim 1 wherein the criteria defines parameters that indicate network activity and which include at least one of an Ethernet source address, an Ethernet destination address, an Ethernet protocol from Ethernet header, a source IP address, a destination IP address, an IP flag, a header length, an IP protocol, an IP options (e.g., out of bound messages, may depend on application), a payload length, a next header, a source port, a destination port, a sequence number, an acknowledgement number, a TCP flag, and a TCP option from a TCP header, and a broadcast data.

4. The method of claim 1 wherein the root level selection guide and the sub-directory of the root level selection guide are arranged in a file system format in which selections of the set of criteria defining the packet capture file are selected in a hierarchical fashion.

5. The method of claim 1 wherein the packet capture file includes packet data associated with criteria based on selected ones of the root level selection guide and the sub-directory of the root level selection guide, and wherein the method is performed on at least one of the network appliance and a data processing system communicatively coupled with the network appliance.

6. The method of claim 1 wherein the network appliance continuously monitors activities of a plurality of users of the network and places in the storage device relevant meta-data (e.g., header information such as source IP address, MAC address, destination IP address, etc.) and payload data (e.g., artifacts such as files, video clips, audio files, etc.) based on the monitoring of the activity through the network.

7. The method of claim 1 further comprising removing certain ones of the listings when a sliding window of last recently used packets of the activity through the network are discarded from the storage device.

8. The method of claim 1 in a form of a machine-readable medium embodying a set of instructions that, when executed by a machine, causes the machine to perform the method of claim 1.

9. A file system comprising:

a root level selection guide formed based on a set of criteria associated with an activity through a network that is captured and stored on a storage device associated with a network appliance;

a sub-directory of the root level selection guide having listings that are dynamically refreshed based on the activity through the network stored on the storage device when an option is selected in the root level selection guide; and

a packet capture file created based on a current state of the activity through the network when one of the listings of the sub-directory of the root level selection guide is selected.

10. The file system of claim 9 further comprising:

a database that is automatically referenced having the activity through the network when creating the packet capture file.

11. The file system of claim 9 wherein the criteria defines parameters that indicate network activity and which include at least one of an Ethernet source address, an Ethernet destination address, an Ethernet protocol from Ethernet header, a source IP address, a destination IP address, an IP flag, a header length, an IP protocol, an IP options (e.g., out of bound messages, may depend on application), a payload length, a next header, a source port, a destination port, a sequence number, an acknowledgement number, a TCP flag, and a TCP option from a TCP header, and a broadcast data.

12. The file system of claim 9 wherein the root level selection guide and the sub-directory of the root level selection guide are arranged in a file system format in which selections of the set of criteria defining the packet capture file are selected in a hierarchical fashion.

13. The file system of claim 9 wherein the packet capture file includes packet data associated with criteria based on selected ones of the root level selection guide and the sub-directory of the root level selection guide, and wherein a method is performed on at least one of the network appliance and a data processing system communicatively coupled with the network appliance.

14. The file system of claim 9 wherein the network appliance continuously monitors activities of a plurality of users of the network and places in the storage device relevant meta-data (e.g., header information such as source IP address, MAC address, destination IP address, etc.) and payload data (e.g., artifacts such as files, video clips, audio files, etc.) based on the monitoring of the activity through the network.

15. The file system of claim 9 wherein certain ones of the listings are removed when a sliding window of last recently used packets of the activity through the network are discarded from the storage device.

16. A method comprising:

creating a packet capture file that is customized based on responses to a navigation of a file system by a user;

forming directories of the file system based on information stored in a storage device having current and historical activity information of a plurality of users traversing a network;

periodically refreshing the formed directories based on changes in the information stored in the storage device.

17. The method of claim 16 further comprising

forming a root level selection guide of the directories based on a set of criteria associated with the current and historical activity through the network that is captured and stored on the storage device;

and

refreshing listings of a sub-directory of the directories dynamically based on the activity through the network stored on the storage device when an option is selected in the root level selection guide.

18. The method of claim 17 further comprising:

automatically referencing a database having the activity through the network when creating the packet capture file.

19. The method of claim 17 wherein the criteria defines parameters that indicate network activity and which include at least one of an Ethernet source address, an Ethernet destination address, an Ethernet protocol from Ethernet header, a source IP address, a destination IP address, an IP flag, a header length, an IP protocol, an IP options (e.g., out of bound messages, may depend on application), a payload length, a next header, a source port, a destination port, a sequence number, an acknowledgement number, a TCP flag, and a TCP option from a TCP header, and a broadcast data.

20. The method of claim 16 further comprising removing certain ones of the formed directories when a sliding window of last recently used packets of the current and historical activity through the network are discarded from the storage device.