System, method and software for protocol analyzer remote buffer management

• US 6,708,292 B1
• Filed: 08/18/2000
• Issued: 03/16/2004
• Est. Priority Date: 08/18/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Network Associates, Inc.
• Inventors: Mangasarian, Jeff
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): LOHN, JOSHUA A
• Application Number:
  US09/640,767
• Time in Patent Office: 1,306 Days
• Field of Search: 714/4, 714/39, 714/43, 709/224
• US Class Current: 714/39
• CPC Class Codes: H04L 47/10 Flow control; Congestion control

Abstract

A method and system for gathering data by monitoring data packets on a network. At least some of the packets are captured in a data buffer. Each captured packet is classified according to a preselected classification system and each captured packet is marked with an indicia of its classification. An analysis program is executed on a network coupled computer. The analysis program displays data about the buffer contents including the indicia before transferring the buffer contents to the analysis program.

Claims

1. A method of gathering data from network data traffic comprising:

monitoring data packets on the network;

capturing at least some of the packets in a data buffer;

classifying each captured packet according to a preselected classification system;

marking each captured packet with an indicia of its classification;

executing an analysis program on a network coupled computer;

displaying data about the buffer contents using the analysis program including the indicia before transferring the buffer contents to the analysis program.

2. The method of claim 1 further comprising a step of using the indicia to create a graphical display on the analysis program describing the buffer contents.

3. The method of claim 1 further comprising

generating user input controls on the graphical display enabling a user to designate a portion of the buffer contents; and

downloading the designated data to the exclusion of un-designated data from the buffer to the computer executing the analysis program.

4. The method of claim 1 further comprising:

using program devices executing on the network-coupled computer to specify the classification system by designating a class indicia for each class and specifying a procedure executable in the remote buffer for performing the classifying step.

5. A system for remote network analysis comprising:

a remote network;

a capture unit coupled to the remote network and operable to capture a selected set of packets from the remote network;

a class tracking buffer in the capture unit responsive to specified classification criteria to tag each captured packet with a classification code indicating membership in one of the specified classes;

an internetwork coupled to the remote network;

a host computer coupled to the internetwork;

software devices executing on the host computer and operable to retrieve data from the capture unit based upon the classification tag associated with each captured packet and analyze the retrieved data;

display devices executing on the host computer operable to display a map of the capture packets within the capture unit along with the classification information indicating membership in a specified class.

6. The system of claim 5 further comprising display devices executing on the host computer operable to display data and analyzed data.

7. The system of claim 5 further comprising a class definition device executing in the host enabling an analyst to specify packet classification criteria.

8. A probe buffer for capturing data packets from a network comprising:

means for coupling to a network;

filter routines executing in the probe and operable to receive packets from the network and select packets meeting predefined criteria;

classification routines operable in cooperation with the filter routines to associate a class code with each of the selected packets;

a packet buffer having a plurality of entries where each entry is sized to hold a captured packet; and

a class tracking buffer having a plurality of entries where each entry corresponds with an entry in the packet buffer and holds the class code associated with the packet held in the corresponding packet buffer.

9. The probe buffer of claim 8 wherein the filter routines are specified by an external host analysis computer.

10. The probe buffer of claim 8 wherein the classification routines are specified by an external host analysis computer.

11. The probe buffer of claim 8 further comprising upload routines executing on the probe buffer and configured to receive a request from an external host analysis computer, wherein the request specifies a starting packet index and a host buffer size and the upload routines are configured to respond to the request with an indication of a last packet from the packet buffer such that a packet range extending from the start packet to the last packet will fit into the host buffer.

12. The probe buffer of claim 11 wherein the upload routines include means for uploading the packet range to the external host analysis computer.

13. A probe analysis computer for analyzing data packets from a network comprising:

means for coupling to a network;

a buffer memory sized to hold a number of data packets during an analysis session;

filter specification routines executing in the probe analysis computer and operable to specify predefined packet selection criteria and operable to specify predetermined packet selection criteria and operable to communicate the packet selection criteria to a remote probe;

class specification routines executing in the probe analysis computer and operable to specify one or more packet classes and operable to communicate the class specification to the remote probe; and

upload routines executing in the probe analysis computer and operable to generate a request specifying a start packet index and the buffer memory size to the remote probe.

14. The probe analysis computer of claim 13 wherein the upload routines receive a response to the request, the response indicating a stop packet index.

15. The probe analysis computer of claim 13 wherein the upload routines generate a preliminary request for probe descriptor data and in response to the preliminary request receive probe descriptor data from a remote probe.

16. The probe analysis computer of claim 15 further comprising a graphical user interface including elements graphically depicting a representation of a probe buffer using the probe descriptor data.