Patent ID: 6954789
Filing Date: 2005-10-11
Classification: G06F,H04L,Y02D

Abstract:
1. A method of examining packets passing through a connection point on a computer network, each packets conforming to one or more protocols, the method comprising: (a) receiving a packet from a packet acquisition device; (b) performing one or more parsing/extraction operations on the packet to create a parser record comprising a function of selected portions of the packet; (c) looking up a flow-entry database comprising none or more flow-entries for previously encountered conversational flows, the looking up using at least some of the selected packet portions and determining if the packet is of an existing flow; (d) if the packet is of an existing flow, classifying the packet as belonging to the found existing flow; and (e) if the packet is of a new flow, storing a new flow-entry for the new flow in the flow-entry database, including identifying information for future packets to be identified with the new flow-entry, wherein the parsing/extraction operations depend on one or more of the protocols to which the packet conforms.