Patent ID: 8958318
Filing Date: 2015-02-17
Classification: H04L

Abstract:
1. A method comprising: receiving a network flow comprising a plurality of packets at a network device configured to process the network flow for forwarding toward a destination device, wherein upon receipt of the network flow the destination device is configured to generate a return flow that is processed by the network device; monitoring the network flow at the network device for the occurrence of at least one of a plurality of predetermined triggering events that occur during processing of the network flow at the network device; detecting the occurrence of a first triggering event during processing of the network flow; capturing, in response to the detection of the first triggering event, a plurality of packets received after the triggering event; generating an export object including a captured portion of the plurality of packets received after the triggering event and additional information regarding the network flow from which the plurality of packets were captured; sending the export object to an analysis server; and in response to detection of the first triggering event, capturing, at the network device, at least a portion one or more packets in the return flow.