Patent ID: 9614891
Date: 2017-04-04
CPC Classifications: H04L

Claim:
1. A computer-implemented method, comprising: accessing, using one or more processors, a plurality of Transmission Control Protocol (TCP) packets captured at a first computing device, the plurality of TCP packets including interleaved sets of TCP packets that are associated with individual ones of a plurality of TCP connections involving the first computing device; performing a search to identify, using the one or more processors, in the plurality of TCP packets, a first subset of TCP packets that are associated with a TCP connection of the plurality of TCP connections, the TCP connection being between the first computing device and a second computing device, the identification of the first subset of TCP packets based at least partly on the first subset of TCP packets including identification data associated with one or more of the first computing device and the second computing device, the identification of the first subset of TCP packets being performed in-stream with the captured plurality of TCP packets, wherein the plurality of TCP packets comprises a plurality of subsets of TCP packets, and the plurality of subsets of TCP packets comprises the first subset of TCP packets; determining, using the one or more processors, at least one Hypertext Transfer Protocol (HTTP) communication between the first computing device and the second computing device, the at least one HTTP communication included in the TCP connection, the determining the at least one HTTP communication based at least partly on at least one TCP event in the first subset of TCP packets associated with the TCP connection; identifying, using the one or more processors, a second subset of TCP packets that are associated with the at least one HTTP communication, wherein the second subset of TCP packets represents a portion of the packets in the first subset of TCP packets; storing, using the one or more processors, the second subset of TCP packets in time order, such that the second subset of TCP packets describes at least a portion of data that is communicated within the TCP connection and within the at least one HTTP communication, the time order indicative of a time the second subset of TCP packets were captured; and after the storing, using the second subset of TCP packets to diagnose problems manifested at a first layer but detected at a second layer.