Error checking at the re-sequencing stage

• US 8,132,089 B1
• Filed: 07/15/2008
• Issued: 03/06/2012
• Est. Priority Date: 05/02/2008
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Blair, Christopher Douglas
• Primary Examiner(s): BAKER, STEPHEN M
• Application Number:
  US12/173,146
• Time in Patent Office: 1,330 Days
• Field of Search: 714/811, 714/815
• US Class Current: 714/811
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

Computer communications that are to be recorded are visible to a network interface on a recording computer. The network interface receives the packets to be recorded. The network layer of the recording computer implements a subset of the normal IP module in the network layer. The IP module in the network layer assumes that most IP datagrams are correctly addressed, internally consistent and of the expected protocol type. The recording computer allocates the received datagrams to a recording session based upon at least a first value of a field that is at a fixed position within the datagram. The datagrams for a session are ordered into an ordered recording stream based upon a timestamp within the datagram. The datagrams are also checked for criteria that indicate an error condition. The allocated and ordered datagrams are recorded or associated with other datagrams that have been allocated to the same session.

Claims

1. A method of recording computer communications, comprising:

receiving a first plurality of IP datagrams directed to a recording network interface;

allocating the first plurality of IP datagrams to a first recording stream of datagrams based upon a first session identifier specified at a first offset in the plurality of IP datagrams;

ordering the first plurality of IP datagrams into an ordered recording stream based upon a timestamp;

while ordering the first plurality of IP datagrams, checking the first plurality of IP datagrams for criteria that indicate an error condition; and

,

storing at least a portion of the ordered recording stream associated with the first recording stream of datagrams.

2. The method of claim 1 wherein the error condition triggers more detailed datagram checking at the network layer.

3. The method of claim 1 wherein the criteria includes detecting more than a threshold number of datagrams having timestamps within a set time period.

4. The method of claim 3 wherein the error condition triggers more detailed datagram checking at the network layer.

5. The method of claim 1 wherein the criteria includes detecting a datagram that was received out of order by a threshold number of datagrams.

6. The method of claim 5 wherein the error condition triggers more detailed datagram checking at the network layer.

7. The method of claim 1 wherein the criteria includes detecting more than a threshold number of duplicate datagrams out of a set number of datagrams.

8. The method of claim 7 wherein the error condition triggers more detailed datagram checking at the network layer.

9. A system for recording computer communications, comprising:

a network interface receiving a plurality of IP datagrams to be recorded;

a datagram allocator that allocates the plurality of IP datagrams to a recording stream based upon a session identifier specified at a fixed offset in each of the plurality of IP datagrams;

a re-sequencer that orders the plurality of IP datagrams based upon a timestamp into an ordered plurality of IP datagrams and checks the plurality of IP datagrams for criteria that indicate an error condition; and

,

datagram storage that stores at least a portion of the ordered plurality of IP datagrams.

10. The system of claim 9 wherein the error condition triggers more detailed datagram checking at the network layer.

11. The system of claim 9 wherein the criteria includes detecting more than a threshold number of datagrams having timestamps within a set time period.

12. The system of claim 11 wherein the error condition triggers more detailed datagram checking at the network layer.

13. The system of claim 9 wherein the criteria includes detecting a datagram that was received out of order by a threshold number of datagrams.

14. The system of claim 13 wherein the error condition triggers more detailed datagram checking at the network layer.

15. The system of claim 9 wherein the criteria includes detecting more than a threshold number of duplicate datagrams out of a set number of datagrams.

16. The system of claim 15 wherein the error condition triggers more detailed datagram checking at the network layer.

17. A computer readable medium having instructions stored thereon for recording computer communications that, when executed by a computer, at least direct the computer to:

receive a first plurality of IP datagrams directed to a recording network interface;

allocate the first plurality of IP datagrams to a first recording stream of datagrams based upon a first session identifier specified at a first offset in the plurality of IP datagrams;

order the first plurality of IP datagrams into an ordered recording stream based upon a timestamp;

while ordering the first plurality of IP datagrams, checking the first plurality of IP datagrams for criteria that indicate an error condition; and

,

storing at least a portion of the ordered recording stream associated with the first recording stream of datagrams.

18. The computer readable medium of claim 17 wherein the error condition triggers more detailed datagram checking at the network layer.

19. The computer readable medium of claim 17 wherein the criteria includes detecting more than a threshold number of datagrams having timestamps within a set time period.

20. The computer readable medium of claim 19 wherein the error condition triggers more detailed datagram checking at the network layer.

21. The computer readable medium of claim 17 wherein the criteria includes detecting a datagram that was received out of order by a threshold number of datagrams.

22. The computer readable medium of claim 21 wherein the error condition triggers more detailed datagram checking at the network layer.

23. The computer readable medium of claim 17 wherein the criteria includes detecting more than a threshold number of duplicate datagrams out of a set number of datagrams.

24. The computer readable medium of claim 23 wherein the error condition triggers more detailed datagram checking at the network layer.