Patent ID: 6546420
Filing Date: 2003-04-08
Classification: H04L,Y02D

Abstract:
A method of aggregating multiple flow records that each describe at least one message communicated among nodes of a network, the method comprising the steps of:selecting a first plurality of flow records from among said multiple flow records that satisfy a first set of criteria; selecting a second plurality of flow records from among said multiple flow records that satisfy a second set of criteria; creating and storing information that establishes each flow record from said second plurality of flow records as representative of network flow which is responsive to network flow that is represented by the first plurality of flow records; aggregating at least two records from said second plurality of flow records that reflect network flow of a particular type from a first node to a second node; wherein the step of selecting a first plurality of flow records from among said multiple flow records includes selecting at least one flow record that represents a given network flow from a given source device and given port to a given destination device; and wherein the step of selecting a second plurality of flow records from among said multiple flow records that satisfy a second set of criteria includes the step of determining whether a particular flow record represents a network flow to the given source device and given port from the given destination.