Monitoring Module

• US 20100223425A1
• Filed: 02/27/2009
• Published: 09/02/2010
• Est. Priority Date: 02/27/2009
• Status: Active Grant

• Current Assignee: Leidos, Inc. (Leidos Holdings, Inc.)
• Original Assignee: Science Applications International Corporation
• Inventors: MEAGHER, John Lippincott, NIRENBERG, Sergio
• Granted Patent: US 8,566,930 B2
• Time in Patent Office: Days
• US Class Current: 711/104
• CPC Class Codes: G06F 11/348 Circuit details, i.e. tracer hardware
• CPC Class Codes: G06F 11/349 for interfaces, buses

Abstract

A system and associated method for monitoring the execution of software on one or more computers by receiving traffic from within the monitored computer(s). The monitoring may take place passively, such that the operation of the monitored computer or computers is completely unaffected by the monitoring. More intensive monitoring, such as maintenance of a shadow copy of the RAM of the monitored computer, may be initiated upon recognition of a pattern in the data received from the monitored computer. The execution of software on the monitored computer may be halted by the monitoring module. The monitoring module may also read from or write to the memories of the monitored computer.

Claims

1. A circuit board comprising:

a host module controlled by a host module processor; and

a monitoring module configured to passively monitor traffic of a front side bus of the host module via a first plurality of traces connecting the front side bus of the host module to the monitoring module.

2. The circuit board of claim 1, further comprising:

a second plurality of traces connecting the host module to the monitoring module;

wherein the host module also includes a northbridge connected to the front side bus and to a peripheral bus;

wherein the second plurality of traces connects said peripheral bus of the host module to the monitoring module; and

wherein the monitoring module is configured to passively monitor traffic of said peripheral bus of the host module.

3. The circuit board of claim 2, further comprising:

a third plurality of traces connecting the host module to the monitoring module;

wherein the host module also includes a network interface; and

wherein the third plurality of traces connects said network interface of the host module to the monitoring module; and

wherein the monitoring module is configured to passively monitor traffic of said network interface of the host module.

4. The circuit board of claim 1, wherein the monitoring module is configured to begin at least one of saving or transmitting at least some of the monitored traffic upon recognition of a pattern in the traffic.

5. The circuit board of claim 4, wherein the pattern represents reading from or writing to a region of a random access memory of the host module.

6. The circuit board of claim 1, further comprising a plurality of host modules.

7. The circuit board of claim 6, wherein the monitoring module monitors one host module at a time.

8. The circuit board of claim 1, wherein the monitoring module is configured to halt the execution of software on the host module.

9. The circuit board of claim 1, wherein the monitoring module is configured to create a shadow copy of a random access memory of the host module.

10. The circuit board of claim 2, wherein the monitoring module is configured to transmit information via said peripheral bus of the host module.

32. The one or more computer-readable media of claim 31, wherein the received traffic is selected by sending a signal to a gate.

11. A monitoring module comprising:

an input for receiving front side bus traffic of a monitored computer without affecting the operation of said monitored computer; and

a network interface;

wherein the monitoring module is configured to send instructions or data to the monitored computer via the front side bus of the monitored computer; and

wherein the monitoring module is configured to receive configuration data via the network interface.

12. The monitoring module of claim 11, wherein the configuration data determines, at least in part, what traffic received from the front side bus of the monitored computer will be saved.

13. The monitoring module of claim 11, wherein the monitoring module is configured to create a shadow copy of a random access memory of said monitored computer.

14. The monitoring module of claim 11, wherein the monitoring module is configured to read the contents of a random access memory of the monitored computer.

15. The monitoring module of claim 14, wherein the monitoring module is configured to transmit at least some of the contents of the random access memory of the monitored computer via the network interface of the monitoring module.

16. The monitoring module of claim 11, wherein the monitoring module is configured to write to a random access memory of the monitored computer.

17. The monitoring module of claim 11, wherein the monitoring module is configured to halt the execution of software on the monitored computer.

18. The monitoring module of claim 17, wherein the monitoring module is configured to halt the execution of software on the monitored computer upon recognition of a pattern.

19. The monitoring module of claim 11, further comprising:

an input for receiving peripheral bus traffic of the monitored computer without affecting the operation of said monitored computer.

20. The monitoring module of claim 19, wherein the monitoring module is configured to connect to a second processor socket of the monitored computer in order to receive the front side bus traffic of a first processor located in a first processor socket of the monitored computer, the first processor socket different than the second processor socket.

21. A method of monitoring the execution of software on a host computer comprising the steps of:

receiving traffic from a first bus of a host computer without altering the operation of said host computer;

selectively storing at least some of the traffic;

transmitting at least some of the selectively stored traffic via a network interface; and

halting a processor connected to the first bus of the host computer.

22. The method of claim 21, wherein the step of selectively storing at least some of the traffic is performed by creating a shadow copy of a random access memory of the host computer.

23. The method of claim 22, wherein the contents of the shadow copy is initialized to zero prior to the selectively storing step.

24. The method of claim 22, wherein the contents of the shadow copy is initialized to substantially mirror the contents of the random access memory of the host computer.

25. The method of claim 21, wherein the step of selectively storing at least some of the traffic is initiated upon recognition of a pattern that is described in instructions received via said network interface.

26. The method of claim 25, wherein the selective storage of at least some of the traffic is stopped upon recognition of a second pattern described in the instructions received via said network interface.

27. The method of claim 21, further comprising the step of reading a random access memory of the host computer and transmitting its contents via said network interface.

28. The method of claim 21, further comprising the step of receiving traffic from a second bus of the host computer without altering the operation of said host computer.

29. One or more computer-readable media having stored thereon executable instructions that, when executed by a first computer, perform:

receiving configuration data from a second computer;

receiving traffic from a first bus of a third computer;

storing in the first computer at least some of the traffic;

sending at least some of the stored traffic to the second computer; and

writing to a random access memory of the third computer.

30. The one or more computer-readable media of claim 29, wherein the instructions, when executed by the first computer, also perform:

receiving traffic from a second bus of the third computer.

31. The one or more computer-readable media of claim 29, wherein the instructions, when executed by the first computer, also perform:

receiving traffic from the first bus of a fourth computer.

33. The one or more computer-readable media of claim 29, wherein the instructions, when executed by the first computer, also perform:

halting a processor of the third computer.

34. The one or more computer readable media of claim 33, wherein halting the processor of the third computer is performed upon recognition of a pattern in traffic received from the third computer.