Attributes of captured objects in a capture system

• US 7,958,227 B2
• Filed: 05/22/2006
• Issued: 06/07/2011
• Est. Priority Date: 05/22/2006
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Deninger, William, de la Iglesia, Erik, Ahuja, Ratinder Paul Singh, Lowe, Rick
• Primary Examiner(s): Etienne; Ario
• Assistant Examiner(s): Williams; Clayton R
• Application Number:
  US11/439,112
• Publication Number:
  US 20070271371A1
• Time in Patent Office: 1,842 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones

Abstract

A system and method for capturing objects and balancing systems resources in a capture system are described. An object is captured, metadata associated with the objected generated, and the object and metadata stored.

Claims

1. A method to be executed in a network environment in which packets are exchanged, comprising:

capturing a plurality of packets being transmitted over a network through a capture system that includes a processor and a network interface for receiving packets;

reconstructing an object based on the packets;

communicating the object to an object classification module for classifying the object based on its content, wherein the captured packets are used to reconstruct at least a portion of a document sought to be communicated over the network;

determining a protocol associated with the object;

classifying the object based at least in part on the protocol, wherein the classifying includes generating metadata associated with the object;

storing the metadata and the object; and

balancing resources of the capture system, wherein the balancing comprises determining an amount memory of the capture system that is needed to reassemble a flow and determining a flow rate for the capture system from the amount of memory, and wherein the flow rate reflects a number of concurrent sessions that are supported by the capture system, wherein the capture system is configured to allow the document to be forwarded from the capture system to its intended destination at a network node unless a capture rule prohibits forwarding the document based on an analysis of the content of the document, and wherein if the document is not forwarded then an alert is sent to a user associated with a previous registration of data identified within the document, and wherein the alert includes an Internet protocol (IP) source address and an IP destination address associated with attempted transmission of the document.

2. The method of claim 1, further comprising:

decompressing the object.

3. The method of claim 1, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.

4. An article of manufacture including program code stored on a non-transitory computer-readable medium which, when executed by a machine, causes the machine to perform a method, the method comprising:

capturing a plurality of packets being transmitted over a network through a capture system;

reconstructing an object based on the packets;

communicating the object to an object classification module for classifying the object based on its content, wherein the captured packets are used to reconstruct at least a portion of a document sought to be communicated over the network;

determining a protocol associated with the object;

classifying the object based at least in part on the protocol, wherein the classifying includes generating metadata associated with the object;

storing the metadata and the object; and

balancing resources of the capture system, wherein the balancing comprises determining an amount memory of the capture system that is needed to reassemble a flow and determining a flow rate for the capture system from the amount of memory, and wherein the flow rate reflects a number of concurrent sessions that are supported by the capture system, wherein the capture system is configured to allow the document to be forwarded from the capture system to its intended destination at a network node unless a capture rule prohibits forwarding the document based on an analysis of the content of the document, and wherein if the document is not forwarded then an alert is sent to a user associated with a previous registration of data identified within the document, and wherein the alert includes an Internet protocol (IP) source address and an IP destination address associated with attempted transmission of the document.

5. The article of manufacture of claim 4, further comprising:

decompressing the object.

6. The article of manufacture of claim 4, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.

7. A capture system provisioned in a network environment in which packets propagate, comprising:

a capture device;

wherein the capture device includes;

a processor and a computer-readable memory;

a network interface module to receive a plurality of packets;

a packet capture module coupled to the network interface module;

an object assembly module configured to reassemble an object associated with the captured packets;

an object classification module to generate a tag for the object and balance memory resources of the capture system, the object classification module classifying the object based on its content, wherein the captured packets are used to reconstruct at least a portion of a document sought to be communicated over the network; and

an object store module configured to store the object and the tag, wherein the balancing comprises determining an amount memory of the capture system that is needed to reassemble a flow and determining a flow rate for the capture system from the amount of memory, and wherein the flow rate reflects a number of concurrent sessions that are supported by the capture system, wherein the capture system is configured to allow the document to be forwarded from the capture system to its intended destination at a network node unless a capture rule prohibits forwarding the document based on an analysis of the content of the document, and wherein if the document is not forwarded then an alert is sent to a user associated with a previous registration of data identified within the document, and wherein the alert includes an Internet protocol (IP) source address and an IP destination address associated with attempted transmission of the document.

8. The capture system of claim 7, wherein the amount of memory needed to reassemble a flow is characterized by the number of bytes per flow.