Patent ID: 7885190
Filing Date: 2011-02-08
Classification: H04L

Abstract:
1. A method for passively and automatically identifying a flow on a network, comprising: passively reading, at a processor disposed between two endpoints, a first packet transmitted on the network from one of the two endpoints to the other; decoding the first packet into a first plurality of protocol fields; identifying, at the processor, a first source Internet protocol address, a first destination Internet protocol address, a first transport protocol, a first source port, a first destination port, and a first synchronization bit from the first plurality of protocol fields; passively reading, at the processor, a second packet transmitted on the network from one of the two endpoints to the other; decoding the second packet into a second plurality of protocol fields; identifying, at the processor, a second source Internet protocol address, a second destination Internet protocol address, a second transport protocol, a second source port, a second destination port, a second acknowledged bit, and a second synchronization bit from the second plurality of protocol fields; and if the first transport protocol comprises transmission control protocol, the second transport protocol comprises transmission control protocol, the first synchronization bit is set, the second synchronization bit is set, the second acknowledged bit is set, the first source Internet protocol address comprises the second destination Internet protocol address, the second source Internet protocol address comprises the first destination Internet protocol address, the first source port comprises the second destination port, and the second source port comprises the first destination port, then identifying, at the processor, only subsequent packets that correspond to one of as being part of a same flow as the first packet and second packet.