Method and system for storing packet flows

• US 9,473,373 B2
• Filed: 04/04/2013
• Issued: 10/18/2016
• Est. Priority Date: 04/04/2012
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: Henry, Thomas, Blomquist, Scott A.
• Primary Examiner(s): Lai, Andrew
• Assistant Examiner(s): Henson, Jamaal
• Application Number:
  US13/857,012
• Publication Number:
  US 20130265883A1
• Time in Patent Office: 1,293 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

A method for storing a plurality of packets includes receiving a packets from a network, applying a hash function to values of one or more fields in the packet so as define a hash key and to select a storage bucket from a plurality of buckets, and adding the packet to the storage bucket. A bucket record associated with the storage bucket includes a flow index determined based on the values of the one or more fields in the packet.

Claims

1. A method for storing and retrieving a packet flow, the method comprising:

receiving a packet from a network;

hashing values of one or more fields in the received packet so as to select a storage bucket from a plurality of buckets;

storing the packet in the selected storage bucket, wherein a bucket record associated with the selected storage bucket includes a flow index determined based on the values of the one or more fields in the packet;

obtaining values of one or more parameters;

selecting a retrieval bucket from the plurality of buckets by hashing the values of the one or more parameters;

determining whether a bucket record associated with the retrieval bucket contains a flow index associated with the values of the one or more parameters; and

if the bucket record associated with the retrieval bucket contains a flow index associated with the values of the one or more parameters, retrieving at least a portion of the packet flow from the retrieval bucket;

wherein the retrieval bucket is one of a plurality of retrieval buckets selected by hashing the values of the one or more parameters, and the packet flow is retrieved from the plurality of retrieval buckets ordered by time.

2. A method as defined in claim 1, further comprising determining if the packet is a flow setup packet and, if the packet is a flow setup packet, creating a flow record using the values in the one or more fields of the packet, wherein the flow record is associated with the storage bucket.

3. The method as defined in claim 2, wherein the flow record associated with the values in the one or more fields of the packet includes time when the packet was captured.

4. The method as defined in claim 1, wherein the flow index is included into the flow record.

5. The method as defined in claim 1, wherein the storage bucket is created in a non-volatile memory or written to the non-volatile memory when the storage bucket is full or timed out.

6. A non-transitory computer-readable medium which includes computer program instructions that cause a computer system to execute the method defined in claim 1.