Patent ID: 9686309
Date: 2017-06-20
CPC Classifications: H04L

Claim:
1. A method comprising: receiving, by a network security device operable to protect a private network, configuration information from an administrative user of the network security device, the configuration information including information indicative of a quantity of packets to be captured by the network security device for purposes of performing a post attack analysis; responsive to receipt of the configuration information, configuring, by the network security device, a size of a circular buffer within a memory of the network security device based on the configuration information; receiving, by the network security device, a plurality of packets directed to the private network from a source outside of the private network; temporarily buffering, by the network security device, the plurality of received packets within the circular buffer; determining, by the network security device, whether a packet of the plurality of received packets is potentially associated with a threat or undesired activity (“trigger packet”) by analyzing the plurality of received packets; responsive to an affirmative determination, capturing, by the network security device, contextual information associated with the threat or undesired activity by extracting information regarding at least a portion of the configured quantity of packets from the circular buffer and storing the contextual information within a log to facilitate the post attack analysis; and wherein the quantity of packets is defined in terms of a number of packets, and wherein a first subset of the quantity of packets comprises one or more packets of the plurality of received packets that were received by the network security device prior to the trigger packet and provides context prior to the trigger packet and a second subset of the quantity of packets comprises one or more packets of the plurality of received packets that were received by the network security device after the trigger packet and provides context after the trigger packet.