Patent ID: 7047297
Filing Date: 2006-05-16
Classification: H04L

Abstract:
1. A full time network traffic recording system, comprising a network capture device, said network capture device being configurable to sample network packets on a network segment without regard to packet destinations; a packet annotator, said packet annotator in accessible communication with said network capture device wherein sampled network packets may be referenced or read, said packet annotator annotating the sampled network packets with at least a time of receipt to form annotated packets, a network data caching system, said network data caching system having a network data cache, said packet annotator providing access to said caching system of the annotated packets wherein the annotated packets may be referenced or read, said caching system forming a series of hierarchically organized finite logical storage units containing the annotated packets, said caching system further recording at least a start and an end time of the contained annotated packets to the finite logical storage units, said caching system further being configurable to initiate write commands to a storage interface; and the storage interface operable to receive write commands from said caching system, said interface being configurable to forward write commands to a storage device wherein finite logical storage units may be mapped to media of a configured storage device; wherein said system performs the functions of: (i) indexing received packets using an indexable item database, (ii) receiving a filter request having a filter expression composed of matching expressions linked by logical operators, the filter expression having at least one matching expression referencing an indexable item, (iii) reading the indexable item database, (iv) computing efficiency ratings for each matching expression and successively each logical operator, and (v) filtering stored network traffic data, said filtering applying matching expressions in preferential order of efficiency.