Traffic analysis for a lawful interception system

• US 8,200,809 B2
• Filed: 04/03/2008
• Issued: 06/12/2012
• Est. Priority Date: 04/03/2008
• Status: Expired due to Fees

• Current Assignee: At&T Delaware Intellectual Property, Inc. (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Sheppard, Scott
• Primary Examiner(s): Avellino, Joseph
• Assistant Examiner(s): Afolabi, Mark O
• Application Number:
  US12/062,193
• Publication Number:
  US 20090254650A1
• Time in Patent Office: 1,531 Days
• Field of Search: 709/204, 709220-229, 709/246, 370/270, 370351-358, 370/392, 370/235, 455/466, 455/450, 705 1- 5
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

Methods, systems, and computer-readable media provide for analyzing data traffic captured by a lawful interception system. A first record, one or more intermediate records, and a second record are received. Each of the records contains a record of test traffic, such as a website, transmitted across a broadband network. The first record, the one or more intermediate records, and the second record are reassembled to form various versions of the website. The various versions of the website are displayed so that a visual comparison can be made to verify the operation of the lawful interception system.

Claims

1. A method for analyzing data traffic captured by a lawful interception system, comprising:

receiving a first record, the first record being created at a source computer, the first record comprising a record of test traffic generated at the source computer and transmitted from the source computer across a broadband network, the test traffic comprising an access to a website via a web browser;

receiving at least one intermediate record, the at least one intermediate record comprising a record of the test traffic intercepted while being transmitted between a router and a plurality of mediation systems;

receiving a second record, the second record being created at a law enforcement agency system, the second record comprising a record of the test traffic when received at the law enforcement agency system from the mediation systems;

constructing a first version of the website by reassembling first website data contained on the first record into one or more first web pages;

constructing at least one intermediate version of the website based by reassemble intermediate website data contained on the at least one intermediate record into one or more intermediate web pages;

constructing a second version of the website by reassembling second website data contained on the second record into one or more second web pages; and

displaying the one or more first web pages in the first version of the website, the one or more intermediate web pages in the at least one intermediate version of the website, and the one or more second web pages in the second version of the website for enabling a visual comparison between the first record, and the at least one intermediate record, and the second record.

2. The method of claim 1, further comprising:

determining a first time at which the test traffic is generated at the source computer;

determining a plurality of intermediate times at which the test traffic is received at the mediation systems;

determining a second time at which the test traffic is received at the law enforcement agency system;

comparing a difference between the first time and the intermediate times with a first time requirement to determine whether the test traffic is timely received; and

comparing a difference between the intermediate times with a second time requirement to determine whether intercepted test traffic is timely received.

3. The method of claim 1, wherein the test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

4. The method of claim 1, wherein the first record, the at least one intermediate record, and the second record each comprise a packet capture (PCAP) file.

5. The method of claim 1, wherein the router intercepts the test traffic, the router identifying the test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the mediation systems via user datagram protocol (UDP).

6. The method of claim 1, wherein the first record is created via a sniffer program executed at the source computer, wherein the at least one intermediate record is created via a TCPDUMP command executed at the mediation systems, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.

7. A system for analyzing data traffic captured by a lawful interception system, comprising:

a memory for storing a program containing code for analyzing data traffic captured by the lawful interception system;

a processor functionally coupled to the memory, the processor being responsive to computer-executable instructions contained in the program and operative to;

receive a first record, the first record being created at a source computer, the first record comprising a record of test traffic generated at the source computer and transmitted from the source computer across a broadband network, the test traffic comprising an access to a website via a web browser,

receive at least one intermediate record, the at least one intermediate record comprising a record of the test traffic intercepted while being transmitted between a router and a plurality of mediation systems,

receive a second record, the second record being created at a law enforcement agency system, the second record comprising a record of the test traffic when received at the law enforcement agency system from the mediation systems,

construct a first version of the website by reassembling first website data contained on the first record into one or more first web pages,

construct at least one intermediate version of the website by reassembling intermediate website data contained on the at least one intermediate record into one or more intermediate web pages,

construct a second version of the website by reassembling second website data contained on the second record into one or more second web pages, and

display the one or more first web pages in the first version of the website, the one or more intermediate web pages in the at least one intermediate version of the website, and the one or more second web pages in the second version of the website for enabling a visual comparison between the first record, the at least one intermediate record, and the second record.

8. The system of claim 7, wherein the test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

9. The system of claim 7, wherein the first record, the at least one intermediate record, and the second record each comprise a packet capture (PCAP) file.

10. The system of claim 7, wherein the router identifies the test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the mediation systems via user datagram protocol (UDP).

11. The system of claim 7, wherein the first record is created via a sniffer program executed at the source computer, wherein the at least one intermediate record is created via a TCPDUMP command executed at the mediation systems, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.

12. A non-transitory computer-readable medium having instructions stored thereon for execution by a processor to provide a method for analyzing data traffic captured by a lawful interception system, the method comprising:

receiving a first record, the first record being created at a source computer, the first record comprising a record of test traffic generated at the source computer and transmitted from the source computer across a broadband network, the test traffic comprising an access to a website via a web browser;

receiving at least one intermediate record, the at least one intermediate record comprising a record of the test traffic intercepted while being transmitted between a router and a plurality of mediation systems;

receiving a second record, the second record being created at the law enforcement agency system, the second record comprising a record of the test traffic when received at the law enforcement agency system from the mediation systems;

constructing a first version of the website by reassembling first website data contained on the first record into one or more first web pages;

constructing at least one intermediate version of the website by reassembling intermediate website data contained on the at least one intermediate record into one or more intermediate web pages;

constructing a second version of the website by reassembling second website data contained on the second record into one or more second web pages; and

displaying the one or more first web pages in the first version of the website, the one or more intermediate web pages in the at least one intermediate version of the website, and the one or more second web pages in the second version of the website for enabling a visual comparison between the first record, at least one intermediate record, and the second record.

13. The non-transitory computer-readable medium of claim 12, wherein the test traffic is generated at the source computer by executing a predefined sequence of commands in a predefined order.

14. The non-transitory computer-readable medium of claim 12, wherein the first record, the at least one intermediate record, and the second record each comprise a packet capture (PCAP) file.

15. The non-transitory computer-readable medium of claim 12, wherein the router intercepts the test traffic, the router identifying the test traffic based on a given Remote Authentication Dial In User Service (RADIUS) account username;

and wherein the router forwards the intercepted test traffic to the mediation systems via user datagram protocol (UDP).

16. The non-transitory computer-readable medium of claim 12, wherein the first record is created via a sniffer program executed at the source computer, wherein the at least one intermediate record is created via a TCPDUMP command executed at the mediation systems, and wherein the second record is created via the sniffer program executed at the law enforcement agency system.