Patent ID: 6789116
Filing Date: 2004-09-07
Classification: H04L

Abstract:
A packet monitor for examining all packets passing through a connection point on a computer network, the monitor comprising:(a) a packet acquisition device coupled to the connection point and configured to receive packets passing through the connection point; and (b) a memory for storing a database comprising none or more flow-entries for previously encountered conversational flows to which a received packet may belong; (c) a lookup engine coupled to the packet acquisition device configured to lookup whether a received packet belongs to a flow in the flow-entry database, and to determine the state of the flow for the received packet in the case that the packet belongs to a flow-entry; (d) a state determining mechanism coupled to the lookup engine to determine the state of a flow in the case that the received packet does not belong to a flow in the flow-entry database, and (e) a state processor coupled to the lookup engine and to the state determining mechanism configured to perform any state operations specified for the state of the flow starting from the last encountered state of the flow in the case that the packet is from an existing flow, and to perform any state operations required for the initial state of the new flow in the case that the packet is from an existing flow.