SELECTIVE PACKET CAPTURE
First Claim
1. A computer-implemented method executed by one or more processors, the method comprising:
- identifying a packet capture rule from a set of packet capture rules, the packet capture rule including a trigger condition and an action to perform when the trigger condition is detected;
monitoring a network flow to detect whether the network flow satisfies the packet capture rule'"'"'s trigger condition, wherein monitoring the network flow includes analyzing one or more packets included in the network flow to determine a set of protocol metadata associated with the network flow; and
selectively performing the action associated with the packet capture rule on the network flow based on a result of the monitoring.
4 Assignments
0 Petitions
Accused Products
Abstract
Methods and systems for providing selective packet capture are described. One example method includes identifying a packet capture rule from a set of packet capture rules, the packet capture rule including a trigger condition and an action to perform when the trigger condition is detected; monitoring a network flow to detect whether the network flow satisfies the packet capture rule'"'"'s trigger condition, wherein monitoring the network flow includes analyzing one or more packets included in the network flow to determine a set of protocol metadata associated with the network flow; and selectively performing the action associated with the packet capture rule on the network flow based on a result of the monitoring.
216 Citations
20 Claims
-
1. A computer-implemented method executed by one or more processors, the method comprising:
-
identifying a packet capture rule from a set of packet capture rules, the packet capture rule including a trigger condition and an action to perform when the trigger condition is detected; monitoring a network flow to detect whether the network flow satisfies the packet capture rule'"'"'s trigger condition, wherein monitoring the network flow includes analyzing one or more packets included in the network flow to determine a set of protocol metadata associated with the network flow; and selectively performing the action associated with the packet capture rule on the network flow based on a result of the monitoring. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A system comprising:
-
a processor configured to execute computer program instructions; and a computer storage medium encoded with computer program instructions that, when executed by the processor, cause the system to perform operations comprising; identifying a packet capture rule from a set of packet capture rules, the packet capture rule including a trigger condition and an action to perform when the trigger condition is detected; monitoring a network flow to detect whether the network flow satisfies the packet capture rule'"'"'s trigger condition, wherein monitoring the network flow includes analyzing one or more packets included in the network flow to determine a set of protocol metadata associated with the network flow; and selectively performing the action associated with the packet capture rule on the network flow based on a result of the monitoring. - View Dependent Claims (15, 16, 17, 18, 19)
-
-
20. A computer-implemented method executed by one or more processors, the method comprising:
-
identifying a packet capture rule from a set of packet capture rules, the packet capture rule including a trigger condition and an action to perform when the trigger condition is detected, the trigger condition including at least one of;
one or more protocol metadata values, or one or more content values, the action including at least one of;
enabling a full packet capture, or enabling content extraction;monitoring a network flow to detect whether the network flow satisfies the packet capture rule'"'"'s trigger condition, monitoring the network flow including analyzing one or more packets included in the network flow to determine a set of protocol metadata associated with the network flow; and selectively performing the action associated with the packet capture rule on the network flow based on a result of the monitoring, performing the action including at least one of; extracting at least part of the one or more packets included in the network flow;
orstoring the one or more packets associated with the network flow.
-
Specification