Method of simulating network communications

• US 7,296,080 B2
• Filed: 07/09/2002
• Issued: 11/13/2007
• Est. Priority Date: 07/17/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Rowley, Bevan S., Huntington, Stephen G.
• Primary Examiner(s): Dalencourt; Yves
• Application Number:
  US10/191,908
• Publication Number:
  US 20030031181A1
• Time in Patent Office: 1,953 Days
• Field of Search: None
• US Class Current: 709/231
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method for simulating network communication sessions is disclosed. A control engine sequences the packets using a protocol stack or by putting the packets into a sorted list. A simulation engine acquires the packets until a request packet or other initiation packet is received. The simulation engine feeds the request packet to a display engine that has the ability to treat the request packet as though the display engine itself originated the request (or initiation) packet. The simulation engine then sends the response packets relating to the request to the display engine, and the display engine uses those packets to simulate the display of the network communication session substantially in the form of the original communication.

Claims

1. A method for simulating network communications traffic comprising the steps of:

capturing network packets by;

attaching a network capture device to a network;

using the network capture device to capture network packets as the network packets are passed across the network;

storing the network packets on a mass storage device in chronological order;

selecting a portion of the captured network packets based on a first predetermined set of criteria;

sequencing the selected network packets using a predetermined process;

simulating a network communication session by a process comprising the steps of;

acquiring sequenced packets that are associated with the network communication session until a first request packet is detected;

feeding the first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, determining whether the next sequenced packet is of a type that may be interpreted by the display engine and either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine and acquiring additional response packets until all of the additional response packets responding to the first request packet have been sent to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, initiating the creation of a visualization of the information in the next sequenced packet and acquiring additional response packets until all of the additional response packets responding to the first request packet have been incorporated into the visualization, and then sending the visualization to the display engine.

2. The method of claim 1 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected packets;

(b) if the first packet relates to a request or to a response, adding the packet to a sorted list corresponding to a second predetermined set of criteria that are satisfied by the packet; and

(c) repeating steps (a) and (b) on additional captured packets until all packets relating to the first predetermined set of criteria have been sequenced.

3. The method of claim 1 wherein the predetermined process comprises the steps of:

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the first selected packet meets the second predetermined set of criteria, determining whether the packet is out of sequence;

if the first selected packet is not out of sequence, sending the first selected packet to the simulation engine;

if the first selected packet is out of sequence, adding the packet to a temporary store;

repeating the steps of reading packets, determining whether the second set of criteria is met, and sending the packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as packets in the temporary store fall into proper sequence, sending properly sequenced packets to the simulation engine; and

each time a packet is added to the temporary store, testing the temporary store for an overflow condition and, if overflow condition is detected, generating an error message.

4. The method of claim 1 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring sequenced packets and sending the sequenced packets to the display engine until all of the packets responding to the additional request packets have been sent to the display engine.

5. The method of claim 1 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

6. The method of claim 1 further comprising the step of using the display engine to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with the network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

7. The method of claim 5 further comprising the step of providing a user with a means of controlling the display of the network communication.

8. The method of claim 5 further comprising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in chronological order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.

9. The method of claim 1 wherein the first predetermined set of criteria includes the address of at least one computer connected to the network.

10. The method of claim 1 wherein the first predetermined set of criteria includes specifying a predetermined time interval.

11. A method for simulating network communications traffic comprising the steps of:

sequencing selected packets from a network communication using a predetermined process;

simulating a network communication session by a process comprising the steps of;

acquiring sequenced packets that are associated with the network communication session until a first request packet is detected;

feeding the first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, determining whether the next sequenced packet is of a type that may be interpreted by the display engine and either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine and acquiring additional response packets until all of the additional response packets responding to the first request packet have been sent to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, initiating the creation of a visualization of the information in the next sequenced packet and acquiring additional response packets until all of the additional response packets responding to the first request packet have been incorporated into the visualization, and then sending the visualization to the display engine;

wherein the predetermined process comprises the steps of;

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the first selected packet meets the second predetermined set of criteria, determining whether the first selected packet is out of sequence;

if the first selected packet is not out of sequence, sending the first selected packet to the simulation engine;

if the first selected packet is out of sequence, adding the first selected packet to a temporary store;

repeating the steps of reading packets, determining whether the second predetermined set of criteria is met, and sending the packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as the out-of-sequence packets in the temporary store fall into proper sequence, sending properly sequenced packets to the simulation engine; and

each time an out-of-sequence packet is added to the temporary store testing the temporary store for an overflow condition and, if the overflow condition is detected, generating an error message.

12. The method of claim 11 further comprising the steps of:

attaching a network capture device to a network;

using the network capture device to capture network packets as the network packets are passed across the network;

storing the captured network packets on a mass storage device in chronological order; and

selecting a portion of the captured network packets based on a first predetermined set of criteria.

13. The method of claim 12 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected portion of the captured network packets;

(b) if the first packet relates to a request or to a response, adding the first packet to a sorted list corresponding to the second predetermined set of criteria that are satisfied by the first packet; and

(c) repeating steps (a) and (b) on additional captured packets until all the captured network packets relating to the first predetermined set of criteria have been sequenced.

14. The method of claim 11 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring sequenced packets and sending the sequenced packets to the display engine until all of the sequenced packets responding to the additional request packets have been sent to the display engine.

15. The method of claim 11 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

16. The method of claim 11 further comprising the step of using the display engine to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with the network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

17. The method of claim 15 further comprising the step of providing a user with a means of controlling the display of the network communication.

18. The method of claim 15 further comprising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.

19. A method for simulating network communications traffic comprising the steps of:

acquiring sequenced packets that are associated with a network communication;

feeding a first request packet to a display engine;

acquiring a next sequenced packet;

if the next sequenced packet is a response packet produced in response to the first request packet, either;

if the next sequenced packet is of a type that may be interpreted by the display engine, sending the next sequenced packet to the display engine;

or

if the next sequenced packet is not of a type that may be interpreted by the display engine, creating a visualization of the information in the next sequenced packet and sending the visualization to the display engines;

sequencing selected packets from the network communication using a predetermined process;

wherein the predetermined process comprises the steps of;

reading a first selected packet;

determining whether the first selected packet meets a second predetermined set of criteria;

if the first selected packet meets the second predetermined set of criteria, determining whether the first selected packet is out of sequence;

if the first selected packet is not out of sequence, sending the first selected packet to the simulation engine;

if the first selected packet is out of sequence, adding the first selected packet to a temporary store;

repeating the steps of reading the selected packets, determining whether the second captured network set of criteria is met, and sending the selected packets to the simulation engine or adding out-of-sequence packets to the temporary store;

as the out-of-sequence packets in the temporary store fall into proper sequence, sending properly sequenced packets to the simulation engine; and

each time an out-of-sequence packet is added to the temporary store, testing the temporary store for an overflow condition and, if the overflow condition is detected, generating an error message.

20. The method of claim 19 further comprising the step of acquiring additional response packets until all of the additional response packets responding to the first request packet have been acquired and sent to the display engine.

21. The method of claim 19 further comprising the steps of:

attaching a network capture device to a network;

using the network capture device to capture network packets as the network packets are passed across the network;

storing the captured network packets on a mass storage device in chronological order; and

selecting a portion of the captured network packets based on a first predetermined set of criteria.

22. The method of claim 19 wherein the predetermined process comprises the steps of:

(a) decoding a first packet from the selected packets;

(b) if the first packet relates to a request or to a response, adding the first packet to a sorted list corresponding to the second predetermined set of criteria that are satisfied by the first packet; and

(c) repeating steps (a) and (b) on additional captured packets until all of the additional captured packets relating to a first predetermined set of criteria have been sequenced.

23. The method of claim 19 further comprising the steps of:

acquiring additional request packets from the sequenced packets; and

repeating the steps of acquiring the sequenced packets and sending the sequenced packets to the display engine until all of the response packets responding to the additional request packets have been sent to the display engine.

24. The method of claim 19 further comprising the step of using the display engine to display a visual representation of at least a portion of the network communication on a computer monitor.

25. The method of claim 19 further comprising the step of using the display to display on a computer monitor at least one of:

a hexadecimal representation of the content of at least one packet;

a decode of at least one packet;

a listing of packets associated with the network communication;

a graphic representation of request and response packets associated with the network communication; and

a composite visual reconstruction of any text or graphic information contained in at least one packet.

26. The method of claim 24 further comprising the step of providing a user with a means of controlling the display of the network communication.

27. The method of claim 24 further compromising the step of permitting a user to control the display the network communication by selecting a command to implement at least one of the following operations:

playing display pages in chronological order;

playing display pages in chronological order using a predetermined timing sequence;

stopping the playing of display pages;

going to a next display page;

going to a previous display page;

going to a first display page;

going to a last display page;

or

going to a user-selected display page.