Sliding window packet management systems

• US 7,673,242 B1
• Filed: 03/21/2006
• Issued: 03/02/2010
• Est. Priority Date: 07/17/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Major, John Darren, Covington, Stanley P., Rowley, Bevan S., Huntington, Stephen Glen
• Primary Examiner(s): KE, PENG
• Application Number:
  US11/387,016
• Time in Patent Office: 1,442 Days
• Field of Search: 715/736, 715/734, 715/735, 715/739, 715/787, 715/783
• US Class Current: 715/736
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: Y10S 715/963 Calendar or scheduling

Abstract

Included in the invention are systems and methods of full time recording network traffic to a hierarchical data storage. Also included in the invention are systems and methods of retrieval of recorded network traffic from a hierarchically organized network data repository. Additionally included in the invention are systems and methods of efficiently filtering data in a hierarchically organized network data repository. Systems and methods of displaying recorded network data utilizing the retrieval systems are also included in the invention. Further included in the invention are systems and methods of providing sliding time window selection user interfaces. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A method, comprising:

accessing network data;

displaying a graphical timeline on a display;

displaying a position on the graphical timeline representative of the network data for network analysis;

displaying on the display data start and end features in association with the graphical timeline;

displaying on the display selection start and end features in association with the graphical timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times;

accepting a selection of a new selection start position from a user;

accepting a selection of a new selection end position from the user; and

providing an indication of an amount of selected network data to the user, the indication reflecting a change in the selection of the new selection start position or the selection of the new selection end position;

wherein the amount of selected network data is approximated if a calculation of the amount of selected network data requires more resources than are available.

2. The method of claim 1, wherein the position is selected utilizing a clock.

3. The method of claim 2, wherein the position is selected utilizing a digital clock.

4. The method of claim 2, wherein the position is selected utilizing an analog clock.

5. The method of claim 2, wherein the position is selected utilizing a calendar.

6. The method of claim 2, wherein the position spans a start position and a stop position.

7. The method of claim 1, further comprising:

accepting a selection of a time of day in a displayed clock from the user;

modifying a selection start time or a selection end time associated with the network analysis of the network data according to the selection; and

displaying the selection start and end features at a new relative position.

8. The method of claim 1, further comprising:

accepting a selection of a day in a displayed calendar from the user;

modifying a selection start time or a selection end time associated with the network analysis of the network data according to the selection day input; and

displaying the selection start and end features at a new relative position.

9. The method of claim 1, further comprising displaying on the display the indication of the amount of selected data.

10. The method of claim 1, wherein the selection start and end features allow the user to select the new selection start position and the new selection end position.

11. The method of claim 1, wherein the selection start and end features include arrowheads that are dragged by the user to select the new selection start position and the new selection end position.

12. The method of claim 1, wherein the selection of the new selection start position and the new selection end position is made using a text box.

13. The method of claim 1, wherein the selection of the new selection start position and the new selection end position is made using a calendar that permits selection of a calendar date.

14. A computer program product embodied on a computer readable medium, comprising:

computer code for identifying network data;

computer code for displaying a graphical timeline on a display;

computer code for displaying a position on the graphical timeline representative of the network data for network analysis;

computer code for displaying on the display data start and end features in association with the graphical timeline;

computer code for displaying on the display selection start and end features in association with the graphical timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times;

computer code for accepting a selection of a new selection start position from a user;

computer code for accepting a selection of a new selection end position from the user; and

computer code for providing an indication of an amount of selected network data to the user, the indication reflecting a change in the selection of the new selection start position or the selection of the new selection end position;

wherein the computer pro ram product is operable such that the amount of selected network data is approximated if a calculation of the amount of selected network data requires more resources than are available.

15. The computer program product of claim 14, wherein the position is selected utilizing a clock.

16. The computer program product of claim 15, wherein the position is selected utilizing a digital clock.

17. The computer program product of claim 15, wherein the position is selected utilizing an analog clock.

18. The computer program product of claim 15, wherein the position is selected utilizing a calendar.

19. The computer program product of claim 15, wherein the position spans a start position and a stop position.

20. A method, comprising:

accessing network data;

displaying at least one of a clock and a calendar;

analyzing the network data using the at least one of a clock and a calendar;

displaying a graphical timeline on a display;

displaying on the display data start and end features in association with the graphical timeline;

displaying on the display selection start and end features in association with the graphical timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times;

accepting a selection of a new selection start position from a user;

accepting a selection of a new selection end position from the user; and

providing an indication of an amount of selected network data to the user, the indication reflecting a change in the selection of the new selection start position or the selection of the new selection end position;

wherein the amount of selected network data is approximated if a calculation of the amount of selected network data requires more resources than are available.

21. A computer program product embodied on a tangible computer readable medium, comprising:

computer code for identifying network data;

computer code for displaying at least one of a clock and a calendar;

computer code for analyzing the network data using the at least one of a clock and a calendar;

computer code for displaying a graphical timeline on a display;

computer code for displaying on the display data start and end features in association with the graphical timeline;

computer code for displaying on the display selection start and end features in association with the graphical timeline, the selection start and end features being displayed at positions relative to the data start and end features with regard to the corresponding times;

computer code for accepting a selection of a new selection start position from a user;

computer code for accepting a selection of a new selection end position from the user; and

computer code for providing an indication of an amount of selected network data to the user, the indication reflecting a change in the selection of the new selection start position or the selection of the new selection end position;

wherein the computer program product is operable such that the amount of selected network data is approximated if a calculation of the amount of selected network data requires more resources than are available.