Packet data recording method and system

• US 8,285,833 B2
• Filed: 02/11/2002
• Issued: 10/09/2012
• Est. Priority Date: 02/12/2001
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Blair, Christopher Douglas
• Primary Examiner(s): TODD, GREGORY G
• Application Number:
  US10/467,899
• Publication Number:
  US 20050240656A1
• Time in Patent Office: 3,893 Days
• Field of Search: 709204-207, 709/224, 709230-231, 379/88.17, 379/68, 379/93.07, 379/900, 379/85, 379/265.07, 379/266.1, 379/67.1
• US Class Current: 709/224
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/202 VoIP; Packet switched telephony

Abstract

A data recording system that includes a plurality of network interface cards that may be employed within a single recording device. Each card may be provided with a plurality of network connecting ports to receive packetized data, such as real-time protocol (RTP) streams. For each RTP packet stream being recorded, the system may note the sequence number for the most recently accepted packet and any packet received with a lower sequence number can be readily discarded. The system then may record payload associated with the RTP streams into an audio file saved on a storage device.

Claims

1. A method for recording packet data passing through network access points, comprising:

receiving packet data at plural network interfaces that provide a connection to more than one network access point;

passing the packet data to an IP address filter comparing an IP address and port number of a packet under examination against a list of known destinations determined in accordance with a set of business rules and observed external activity;

comparing the IP address to an entry in a circular buffer to determine a match and, if there is the match, using the IP address as a pointer to an entry in a known destination object to determine if the packet under examination is to be recorded;

passing the packet under examination to a protocol filter to determine a protocol of the packet under examination;

passing the packet under examination to a buffer in accordance with the protocol; and

storing payload data contained within the packet under examination in a storage device.

2. The method of claim 1, wherein determining the protocol further comprises determining if the protocol is real-time transport protocol (RTP), real-time transport control protocol (RTCP) or other protocol.

3. The method of claim 2 further comprising:

passing real-time transport protocol (RTP) data and real-time transport control protocol (RTCP) data to an RTP/RTCP data buffer; and

passing other protocol data to a packet data buffer.

4. The method of claim 3, further comprising:

applying a synchronization to the RTP and RTCP data; and

writing the RTP and RTCP data in contiguous blocks to the storage device.

5. The method of claim 3, further comprising:

writing a WAV audio file for RTP data, and

writing an XML file for other protocol data.

6. The method of claim 1, further comprising if a match is not found, passing the packet under examination to the protocol filter.

7. A method for recording packetized information packet data passing through network access points, comprising:

comparing an IP address of a received packet with an IP address of a destination recorder device having plural network interfaces;

comparing the IP address of the received packet with an IP destination address and an IP port number contained in a list, if the received packet is destined for a device other than the recorder device, the list being determined in accordance with a set of business rules and observed external activity;

comparing the IP address of the received packet to an entry in a circular buffer to determine a match and, if there is the match, using the IP address of the received packet as a pointer for a known destination object; and

recording the received packet based on information contained in the known destination object.

8. The method of claim 7, wherein an entry in the known destination object'"'"'s data structure indicates whether the received packet is to be recorded.

9. The method of claim 7, wherein the list is held in a buffer as a map with an indexing function.

10. The method of claim 9, wherein if the if the IP address of the received packet is not in the list, a hash table is used to determine the pointer for the known destination object.

11. The method of claim 7, wherein the known destination object includes information that allows the protocol filter to determine which protocol the received packet contains.

12. The method of claim 7, further comprising passing the received packet to a protocol filter.

13. The method of claim 12, further comprising determining if the received packet contains payload representing an RTP packet header.

14. The method of claim 13, further comprising passing the RTP packets to a RTP/RTCP packet buffer.

15. The method of claim 14, further comprising sequencing the RTP packets.