Patent ID: 7594009
Filing Date: 2009-09-22
Classification: H04L

Abstract:
1. A system for analyzing network traffic, comprising the steps of: using detecting means including a tap which receives and selects packets of data from network traffic and packet creating means which, for each packet selected by the tap, creates a modified selected packet for analysis which consists of the selected packet and a unique identifier for the selected packet which distinguishes that selected packet from all other selected packets, wherein the detecting means analyzes the modified selected packets to detect suspect modified data packets which meet criteria defined by one or more functions in the detecting means, the criteria being indicative of potentially damaging traffic on the network; forwarding details of each detected suspect modified data packet to data processing means; storing details of each detected suspect modified data packet so as to be accessible for use in analysis by the data processing means in conjunction with the details of other detected modified suspect packets; and using the data processing means to analyze the stored suspect modified data packets.