Patent ID: 6453345
Filing Date: 2002-09-17
Classification: G06F,H04L

Abstract:
A computer system for facilitating a post-event reconstruction and analysis of a security breach or other catastrophic event on a computer network, the system comprising:network interface circuitry configured to passively and continuously capture all valid data-link-level network traffic at a network connection point to generate a packet stream, the packet stream comprising raw data packets that are transmitted on the network by other computer systems of the network; at least one computer processor configured to process the packet stream to generate an archival data stream; a data recording unit operatively coupled to the processor, the recording unit configured to record the archival data stream onto a non volatile storage medium to generate a low-level archival recording of network traffic, the processor incapable of modifying the recorded archival data stream; a data playback unit operatively coupled to the processor, the playback unit configured to play back the previously recorded archival data stream as computer network traffic on the computer network at the network connection point to recreate computer network traffic events as they previously occurred when recorded, the previously recorded archival data stream is transmitted on the computer network at the network connection point and flows through the computer network as the archival data stream originally flowed through the computer network; a first cyclic data recorder coupled to the processor that cyclically records a daily portion of the packet stream onto a second recording medium to generate a record of the network traffic; and a second cyclic data recorder that cyclically records a daily filtered portion of the packet stream onto a third recording medium to generate a record of a portion of the network traffic.