Abstract:
A method and apparatus for merging data acquired by two or more capture devices from two or more points in a computer system, frames are compared for duplicates, then duplicate frames are analyzed to determine the time difference between the timestamps of a first capture device and a second capture device. If the duplicate frames are the first set of duplicate frames discovered, then all previous timestamps and all subsequent timestamps from the second capture device are adjusted by the time difference. If duplicate frames are again discovered, the time difference is recalculated and all subsequent frames from the second capture device are adjusted by the recalculated time difference. After all the frames have been analyzed and the timestamps adjusted, the frames are merged together and put into chronological order to simulate a single capture of data encompassing all of the points where the data was collected.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a Continuation-in-Part claiming priority benefit from U.S. patent application Ser. No. 12/150,694, filed on Apr. 30, 2008 which was a Continuation-in-Part of U.S. patent application Ser. No. 10/654,817, filed on Sep. 3, 2003, now abandoned. 
     
    
     FIELD OF THE INVENTION 
       [0002]    This invention relates to a method for capturing data from a system of multiple computer networks in order to analyze the networks for performance. The invention also relates to a method for automatically merging data acquired by two or more capture devices from two or more points on a system of computer networks wherein the merged data results in an accurate representation of a single capture file for the entire system. 
       BACKGROUND OF THE INVENTION 
       [0003]    Modern computer networks can include hundreds or thousands of computers connected in networks or tiers. These networks can be, in turn, connected together by larger networks such as the Internet so that systems of many tiers are created. 
         [0004]    The networks communicate through frames or packets of data arranged to transfer information in various protocols. The protocols can include, for example, TCP/IP or HTTP. Enterprise applications on the networks communicate through messages broken down into frames. Usually it requires many frames to communicate messages between the computers and tiers of the network system. 
         [0005]    “Enterprise applications” are programs displayed on the computers to accomplish various tasks. They are characterized by multiple components deployed across multiple network tiers accessed by users across the entire network system. Parts of a program can be distributed among several tiers, with each part located in a different computer in a network. Examples of enterprise applications include Enterprise Resource Planning (ERP), Customer Relationship Management (CRM), Supply Chain Management (SCM), and Online Banking, Brokerage, Insurance and Retailing. 
         [0006]    Enterprise applications typically provide a variety of business functions that users may execute. For example, an online stock trading application may provide some of the following business functions: “log in”, “display account status”, “retrieve stock prospectus”, “sell stock”, “buy stock”, and “log out”. When a user executes a business function, a sequence of transactions is performed with each transaction consisting of a source component transmitting a request (via a network message) to a destination component, often on another tier, and perhaps waiting for a reply message. The destination component processes the request and in the processing consumes local (server) resources such as cpu, disk input/output, and memory and may generate subsequent requests (subtransactions) to other components. 
         [0007]    The time that elapses between the user executing the business function (submitting his or her request) and the display of the results on the user&#39;s workstation is called the end user response time. The end user response time is typically the most critical measure of end user satisfaction with network and application performance. If the response times are too long, end users will be unsatisfied. 
         [0008]    In order to maintain and improve performance, application and system managers must monitor the performance of the network system for response times in order to understand the current performance of applications and components, be able to identify and predict current and future performance problems, and evaluate potential solutions to those problems. Typical problems include data “bottlenecks” such as firewalls and routers and system “delays” caused by mechanical access to data by a disk drive. 
         [0009]    The most common method to monitor performance of the system is to capture and analyze network data that is transferred across the tiers via frames. For example, to analyze the performance of the system in relation to requests from a work station, the requests and replies are tracked across the system. To track the requests and replies, data frames are captured and arranged in chronological order to determine how the messages between computers are flowing. The message flow often allows a determination of system performance in relation to response times. 
         [0010]    Data frames are captured by computers connected to the network which monitors network traffic with “sniffer” programs. The sniffer programs receive and store copies of data frames in one or more files. During storage, the network sniffer adds data to the frame which indicates the time that the frame was received relative to the sniffer. The added data is known as a “time stamp.” 
         [0011]    Network system topology often makes it impossible to track message flow for an entire network system from a single network sniffer. To track message flow, frames stored by multiple sniffers must be collected and arranged in chronological order. Even so, the interpretation or analysis of the collected frames from the multiple sniffers can be difficult unless merged into a single file. 
         [0012]    Merging files from different sniffers is difficult due to the inaccuracy of their clocks. In the prior art, the clocks from each sniffer are unstable and unsynchronized. Typically in capture devices clocks are low priority programs that “flutter” or “jitter”. “Flutter” and “jitter” can cause inaccuracy in clock times of up to 10-40 ms per second depending on the clock program and hardware. Therefore, during the data collection period, slight variations in each capture device&#39;s clock can occur. Moreover, the clocks on each sniffer are typically independent and unsynchronized. Because the clocks are not synchronized, the times stamps generated by the various sniffers are not synchronized. If the timestamps are off by even a few milliseconds, the chronologically arranged frames from various sniffers will not be in the right order and so will not give an accurate representation of a single capture file for the entire system making analysis extremely difficult. 
         [0013]    Traditionally, the steps for merging the data from the sniffers into a single file have been performed manually. A common method to overcome the lack of synchronization is to manually calculate or estimate the difference between duplicate timestamps and apply a single time adjustment to all frames in the final merged file. One problem with the prior art methods for correcting the inaccuracy of timestamps lies in the application of the calculated difference. This manual calculation is performed once and applied to all the timestamps of the collected frames. As a result, inadvertent or unavoidable changes in the relative difference between the timestamps during data collection can go undetected. Other problems include the tendency of the prior art methods to be both error prone and time consuming. 
         [0014]    The use of multiple sniffers in order to track message flow from across a network system creates yet another problem. Namely, the same data frame often traverses a single network to which more than one sniffer is attached. Since each network sniffer receives and stores each data frame, the result is duplicate frames stored by various network sniffers. Before analysis, at least one of each of the duplicates must be removed. In the prior art, the duplicates are identified and removed by hand, creating additional errors. 
         [0015]    What is needed is a method wherein the merge of collected data is performed automatically, with no manual intervention. The method should provide for an automatic calculation and adjustment of the difference in timestamps and recalculation of the difference as often as possible. The method should also provide a way to recognize and remove duplicate frames from the final merged file. 
       SUMMARY OF THE INVENTION 
       [0016]    The present invention provides a method for automatically merging data acquired by two or more capture devices in a computer network system, resulting in a single complete capture file. 
         [0017]    In the present invention, frames of data are collected and stored into capture files by two or more capture devices or “sniffers”. A timestamp is added to each frame by each capture device. The capture files are uploaded by the invention where the frames are placed in chronological order in a “dictionary” of frames for each capture file. The frames are indexed by frame identifier sets. The frame identifier sets are a group of parameters common to all frames in a particular dictionary. The frame identifier sets are used to merge the dictionaries together into a single final dictionary of frames which, when arranged in chronological order, is a complete capture file which represents network traffic. 
         [0018]    In order to merge the dictionaries, the frame identifier sets from each dictionary are compared for duplicates and then combined. If any frame identifier set from the second dictionary of frames is not contained in the identifier sets from the first dictionary of frames, then the frame associated with the frame identifier set from the second dictionary of frames is added to the first dictionary of frames. 
         [0019]    When an identifier set from the second dictionary of frames file is the same as a frame identifier set from the first dictionary of frames, the frames associated with these frame identifier sets are considered duplicates. When duplicates are discovered, the difference between the timestamp of the first frame and the second frame is calculated. Then, the duplicate frame from the second dictionary of frames is discarded. If the duplicate frames are the first set of duplicate frames discovered, then the timestamps of the frames in the second dictionary of frames prior in time to the duplicate frames are all adjusted by the calculated time difference. The timestamps of subsequent frames from the second dictionary are adjusted by the calculated time difference. 
         [0020]    When duplicate frames are again discovered, the difference between the timestamps is recalculated and the timestamps for all subsequent frames from the second dictionary are again adjusted by the calculated time difference. The merge process is complete when each of the frames from the second dictionary has either been added to the first dictionary or discarded. The merge process results in a modified first dictionary file which contains all non-duplicate frames from both the first and second dictionaries in chronological order. 
     
    
     
       DETAILED DESCRIPTION OF THE DRAWINGS 
         [0021]    A better understanding of the invention can be obtained from the following detailed description of one exemplary embodiment as considered in conjunction with the following drawings in which: 
           [0022]      FIG. 1  is a block diagram depicting placement of capture devices in a four tier computer network system according to the present invention; 
           [0023]      FIG. 2  is a flow chart of the steps undertaken to “preprocess” a capture file for use in the present invention; 
           [0024]      FIG. 3  is a flow chart of the steps undertaken to “merge” two or more capture files for use in the present invention; and 
           [0025]      FIG. 4  is a block diagram depicting placement of capture devices in a five tier computer network system according to the present invention. 
       
    
    
     DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS 
       [0026]      FIG. 1  shows an example of a typical four-tier computer network system running an internet based enterprise application. The first tier comprises work station  102 . The second tier comprises web server  104 . The third tier comprises application server  106 . The fourth tier comprises database server  108 . Of course, myriad other configurations and applications are possible and are contemplated by the invention. 
         [0027]    Work station  102  is a desktop personal computer running a web browser such as Microsoft Explorer or Netscape. Work station  102  is connected to Internet  114  through Ethernet connection  103 . Internet  114  is connected to a firewall  120  through Ethernet connection  115 . 
         [0028]    A firewall is a set of related programs, located at a network gateway server, that protects the resources of a private network from users from other networks. The firewall may work closely with a router program and examine each data frame transmitted to it and forward the data frame toward its destination. The firewall may include or work with a proxy server that makes network requests on behalf of workstation users. Firewall  120  is connected to a LAN  110  through Ethernet connection  121 . 
         [0029]    LAN  110  is an Ethernet and can function using a number of different protocols. Examples are Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP). Web server  104  is in communication with LAN  110  via an Ethernet connection  111 . 
         [0030]    Web server  104  is a computer which provides the presentation logic necessary to display a web page on work station  102 . Two commercially available web servers are Apache, and Microsoft&#39;s Internet Information Server (IIS). 
         [0031]    Capture device  116  and firewall  122  are connected to LAN  110  via Ethernet connections  117  and  123 , respectively. The invention of course envisions Ethernet connections that are physical or wireless. Firewall  122  is, in turn, connected to LAN  112  via Ethernet connection  113 . LAN  110  and LAN  112  need not function on the same protocol. LAN  112  is in turn connected to application server  106 , database server  108  and capture device  118  through Ethernet connections  107 ,  109 , and  119 , respectively. 
         [0032]    Application server  106  is a server program on a computer in a distributed network that provides the “business logic” for an application program. “Business logic” refers to the routines that perform the data entry, update, query and report processing rather than the presentation logic required to display the data on the screen of work station  102 . Application server  106  obtains the data necessary to perform the required data processing from database server  108 . Database server  108  maintains a persistent store of data available to application server  106 . 
         [0033]    Capture device  116  is positioned to collect incoming and outgoing data associated with web server  104 . It is positioned on LAN  110  because all communications to or from work station  102  from or to web server  104  must traverse LAN  110 . In addition, data sent or received from web server  104  to or from application server  106  must also traverse LAN  110 . To collect the data, capture device  116  is configured to receive and store all data frames with sources or destinations of web server  104 . 
         [0034]    Capture device  118  is positioned to collect incoming and outgoing data associated with application server  106 . Data sent or received from application server  106  to or from web server  104  must traverses LAN  112 . Also data sent or received from application server  106  to or from database server  108  must traverses LAN  112 . To collect the data, capture device  118  is configured to receive and store data frames with sources or destinations associated with application server  106 . 
         [0035]    In the preferred embodiment, capture devices  116  and  118  are known as “sniffers”. A sniffer is a program resident on a computer which monitors and analyzes network traffic and captures or collects data being transmitted on a network. Sniffers are often used in conjunction with a router or other similar type device. A router reads every frame of data passed to it to determine the source and intended destination of the frame and then forwards the frame to the correct destination. If the sniffer is being used to collect data associated with either the source or the destination of the frame, then a copy of the frame is created and stored before the frame is forwarded to the correct destination. Sniffer software is commercially available from McAfee, CISCO, and Sniffer Wireless. 
         [0036]    Analysis computer  101  is a computer system specifically purposed and programmed to analyze data frames collected from the computer network system by the capture devices. Analysis computer  101  is in communication with the capture devices  116  and  118 . Analysis computer  101  includes at least one processor to execute programmed instructions, a memory device for storing the programmed instructions and for storing and manipulating data frames, and storage devices as required to archive and retrieve programs and data. 
         [0037]    In order to receive information from web server  104 , workstation  102  must send a request for information. In the context of an online stock trading enterprise application, data such as account status is requested by work station  102 . Each request and reply are typically made up of many frames of data. The account status request is broken up into frames which travel across Internet  114 , through firewall  120 , to web server  104  by traversing LAN  110 . When frames which make up the account status request traverse LAN  110  with a destination address of web server  104 , capture device  116  makes a copy of the frames and stores them in the capture file. In one embodiment, when capture device  116  makes a copy, the entire frame of data is copied and stored, including overhead data. 
         [0038]    A data packet or data frame consists of payload data and “overhead data” also known as a header, the payload data containing the data to be transferred across a network, the overhead data containing information such as address information of an intended destination on the network. In another embodiment, only the overhead data is copied and stored into a capture file. 
         [0039]    Once the request is received, web server  104  decrypts the status request and forwards the decrypted request that requires business logic to application server  106  traversing LAN  110 , firewall  122  and LAN  112 . When frames that make up the decrypted status request traverse LAN  110  with a source address of web server  104 , capture device  116  makes a copy of the frames and stores that copy in its capture file. Also, when frames associated with the decrypted status request traverses LAN  112  with a destination address of application server  106 , capture device  118  makes a copy of the frames and stores it in its capture file. Capture device  116  and  118  now both have an exact copy of the frames associated with the decrypted status request. 
         [0040]    Application server  106  receives the decrypted status request and using LAN  112  sends a request to database server  108  for the necessary account data. When frames associated with the request for the necessary account data are sent from application server  106 , capture device  118  makes a copy of the frames and stores that copy in the frame file. Database server  108  responds to application server  106  by transmitting the necessary account data to application server  106  via LAN  112 . When frames associated with the necessary account data are sent to application server  106 , capture device  118  makes a copy of the frames and stores them in its capture file. 
         [0041]    Application server  106  performs the required data processing and sends the fulfilled request back to web server  104  across LAN  112  through firewall  122  and across LAN  110 . When frames associated with the fulfilled request traverse LAN  112  with a source address of application server  106 , capture device  118  makes a copy of the frames and stores it in its capture file. Also, when frames associated with the fulfilled request traverse LAN  110  with a destination address of web server  104 , capture device  116  makes a copy of the frames and stores it in its capture file. Web server  104  uses presentation logic to prepare the account status data for display on work station  102 , encrypts the reply, and sends the reply across LAN  110  and Internet  114  to work station  102  for display. When frames associated with the reply are sent across LAN  110  with a source address of web server  104 , capture device  116  makes a copy of the frames and stores it in its capture file. 
         [0042]    When analyzing the performance of the system shown in  FIG. 1 , only data from each of the networks relating to the performance of the system during execution of the application or applications of interest must be collected. In  FIG. 1 , there are four networks of interest, one for each tier. In practice, points of common usage in the network are chosen for data collection. 
         [0043]    In the example of  FIG. 1 , duplicate frames are created whenever data is sent to or from the web server  104  from or to the application server  106 . Since the frames transmitted between the web server  104  and the application server  106  traverse both capture points on the LAN  110  and the LAN  112 , those frames are captured by both capture devices  116  and  118 . The same frame will appear in both capture files with the only potential difference being the timestamp added by the capture device. 
         [0044]    In addition to “natural” duplicates being created due to the flow of data, duplicates may be intentionally “forced”. For example, a “ping” from one tier could be sent to a second tier such that the frames would be collected by all the capture devices in the system as described above. The ping command verifies connections to a remote computer or computers by sending out “echo” frames. As the frames traverse the system, the capture devices on the system would collect duplicates as described above and the duplicates would be used to create the time adjustments as described above. In one embodiment of the invention, a simple program could send a ping on a regular cycle, such as every second. Because the capture devices in the system would collect duplicate frames associated with the ping, the duplicates can be used to keep the timestamps synchronized. Also, at the start of data collecting, a ping could be sent to force the first frames collected to be duplicates. 
         [0045]    When data frames are collected by capture devices  116  and  118  into capture files, the data frames are stored with the protocol control information used to transport the data on the network of interest. The protocols of the various networks may vary, thus creating a different format of data frame stored. As the data frames are received they are “timestamped” with the time of the capture device. Timestamping is known in the art and is performed by the sniffer software installed on the capture device. Analysis computer  101  collects the time-stamped data frames from capture devices  116  and  118 . 
         [0046]    To merge the capture files collected from the capture devices  116  and  118 , the capture file from capture device  116  is arbitrarily chosen by analysis computer  101  as a first capture file; the capture file from capture device  118  is then designated as the second capture file. The second capture file is then merged into the first capture file to produce a final capture file which is an accurate representation of all data frames collected from the four tier computer network system. 
         [0047]      FIG. 4  illustrates a five-tier computer network system where three capture devices are used to collect data. The first tier comprises work station  402 . The second tier comprises web server  404 . The third tier comprises application server  406 . The fourth tier comprises mainframe  412 . The fifth tier comprises database server  414 . 
         [0048]    In a typical request sequence using the system shown in  FIG. 4 , information is requested at work station  402 . The web browser at work station  402  sends the request to web server. The request travels across Internet  414  and through firewall  428  to web server  404  by traversing LAN  416 . When the request traverses LAN  416  with a destination address of web server  404 , capture device  422  makes a copy of the frames comprising the request and stores that copy in a capture file. Web server  404  decrypts the request and forwards the decrypted request to application server  406  traversing LAN  416 , through firewall  430  and traversing Internal A LAN  418 . When the decrypted request traverses LAN  416  with a source address of web server  404 , capture device  422  makes a copy of the frames comprising the decrypted request and stores that copy in its capture file. Also, when the decrypted request traverses Internal A LAN  418  with a destination address of application server  406 , capture device  424  makes a copy of the frames comprising the decrypted request and stores it in its capture file. Capture device  422  and  424  now both have copies of the frame(s) associated with the decrypted request. 
         [0049]    Application server  406  receives the decrypted request and using Internal A LAN  418  may request data stored in LDAP server  408 . When the request for data traverses Internal A LAN  418  with a source address of application server  406 , capture device  424  makes a copy of the frames comprising the request for data and stores it in its capture file. LDAP server  408  transmits the requested data to application server via Internal A LAN  418 . When the requested data traverses Internal A LAN  418  with a destination address of application server  406 , capture device  424  makes a copy of the frames comprising the requested data and stores it in its capture file. 
         [0050]    Also, application server  406  may request data from mainframe  412  across Internal A LAN  418 , through router  432  and across Internal B LAN  420 . When the request for data traverses Internal A LAN  418  with a source address of application server  406 , capture device  424  makes a copy of the frames comprising the request for data and stores it in its capture file. Also, when the request for data traverses Internal B LAN with a destination address of mainframe  412 , capture device  426  makes a copy of the frames comprising the request for data and stores it in its capture file. Capture device  424  and  426  now both have copies of the frame(s) associated with the request for data. 
         [0051]    After the request for data from application server  406  is received by mainframe  412 , mainframe  412  makes one or more requests for the data from database server  414  via Internal B LAN  420 . When the request for data traverses Internal B LAN  420  with a source address of mainframe  412 , capture device  426  makes a copy of the frames comprising the request for data and stores it in its capture file. 
         [0052]    In another embodiment, capture device  426  may be attached to router  432  to collect the incoming and outgoing data associated with mainframe  412 . The router sends all the relevant data to a port which is connected to the capture device. 
         [0053]    Analysis computer  401  is a computer system specifically purposed and programmed to analyze data frames collected from the computer network system by the capture devices. Analysis computer  401  includes at least one processor to execute programmed instructions, a memory device for storing the programmed instructions and for storing and manipulating data frames, and storage devices as required to archive and retrieve programs and data. Analysis computer  401  is in communication with the capture devices  422 ,  424  and  426 . 
         [0054]    Duplicate frames are created whenever data is sent to or from web server  404  from or to application server  406 . Since the frames between web server  404  and application server  406  traverse both capture points on LAN  416  and Internal A LAN  418 , the frames are captured by both capture devices  422  and  424 . 
         [0055]    Similarly, frames between application server  406  and mainframe  412  traverse both capture points on Internal A LAN  418  and Internal B LAN  420 . The frames between application server  406  and mainframe  412  are captured by capture device  424  and  426 . 
         [0056]    In the preferred embodiment of the invention, after all captured data frames necessary to evaluate the system are collected and timestamped by each capture device, the captured data frames are then downloaded by the analysis computer and stored as a set of capture files, one capture file for each capture device. The analysis computer includes and executes programmed instructions which “preprocess” each capture file into a dictionary of frames and then “merge” the dictionary of frames into a final analysis file. In another embodiment, the preprocessing may be performed on any one of the capture devices. In another embodiment, the merge may be performed on any one of the capture devices. 
         [0057]    To merge the capture files collected by capture devices  422 ,  424 , and  426 , the capture files from capture devices  422 ,  424  and  426  are first downloaded by analysis computer  401  after which analysis computer  401  merges the capture files from capture devices  422  and  424  into a first dictionary of frames and moves the data frames from capture device  426  into a second dictionary of frames. Then the first dictionary of frames associated to capture devices  422  and  424  is merged with a second dictionary of frames associated to capture device  426  to produce a final dictionary of frames yielding a final capture file which is an accurate and concise representation of data frames collected from the five tiers. 
         [0058]    “Preprocessing” is needed to build a standardized set of identifiers for each frame and to eliminate duplicate frames within each capture file. Typically a single capture device will not collect two of the same frames at different times. However, due to the configuration of some routers, a single capture device will collect two of the same frames when monitoring two or more ports on the router. Also, due to “glitches”, electrical, or machine error, it is possible for the same frame to be collected at two different times by a single capture device and therefore for a frame to have two different timestamps. To prevent the same frame from having different timestamps, all duplicate frames within a capture file are discarded during preprocessing except the frame with the earliest timestamp. 
         [0059]      FIG. 2  is a flow chart of program steps which, when executed by the analysis computer, preprocesses each capture file. The program steps start at Step  200 . At Step  201 , the analysis computer initializes a dictionary of frames file. At Step  202 , the analysis computer downloads each capture file from each capture device. Then, operating on each capture file independently, the analysis computer arranges the frames of the capture file in chronological order at Step  203 . 
         [0060]    At Step  204  the analysis computer requires input of a list of required frame identifier parameters. Examples of identifier parameters vary according to protocol, but can include source address, destination address, protocol identification, sequence number, acknowledgment number, window size, protocol flags (such as ACK and PSH), and length of data payload. Choosing frame identifier parameters is required in order to standardize frame information from the different protocols used by different networks in order to analyze message flow and timing. Ideally, the choice includes a minimum number of parameters which are common to and uniquely identify the frames generated by different protocols. In the preferred embodiment the minimum number of parameters includes source address, destination address, sequence and arrangement number. For each frame this set is referred to as the identifier set. 
         [0061]    At Step  205 , each frame of the capture file is read to determine the frame identifier set. At Step  209 , the analysis computer determines if the end of file has been reached. If so, the program ends at Step  215 . If not at the end of file, the analysis computer proceeds to Step  208 . 
         [0062]    At Step  208 , a frame identifier set for the next frame in the capture file is compared to the frame identifier sets for each frame included in the dictionary of frames. Initially, the dictionary of frames is empty. If a match is found, then the program proceeds to Step  212  and discards the frame in the capture file which is associated with that frame identifier set. The program then returns to Step  205 . If a match is not found, then at Step  210  the frame associated with that frame identifier set is stored in the dictionary of frames associated with the specific capture device being analyzed. The stored frame is indexed by the frame identifier set. 
         [0063]    The steps shown in  FIG. 2  are repeated for each capture file from each capture device resulting in a pre-processed dictionary of frames in chronological order, with all duplicate frames deleted for each capture device used in the computer network system. 
         [0064]    After each capture file has been “preprocessed” into a separate dictionary of frames, the dictionaries of frames are “merged” into a single dictionary. The first two dictionary of frames are merged together, then all subsequent dictionaries are merged one at a time until all of the dictionaries are merged into a single final dictionary. 
         [0065]      FIG. 3  is a flow chart depicting the preferred method of how the preprocessed dictionaries are merged. The method, which is implemented as a set of program steps stored and executed on the analysis computer, begins at Step  299 . At Step  300  the dictionaries are arbitrarily ordered first through last. At Step  301 , a “flag” variable is initialized to designate whether or not duplicate frames have been identified. If the flag is equal to 0, then duplicate frames have not been identified. If the flag is equal to 1, then duplicate frames have been identified. At Step  302 , a “timestamp adjust variable” is initialized. At Step  303 , a temporary database is initialized. 
         [0066]    At Step  304 , the method reads a frame identifier set from the second dictionary. At Step  309 , the program determines if the end of the file for the second dictionary has been reached. If so, at Step  313  the method generates a final dictionary by arranging the frames contained in the first dictionary in chronological order according to timestamp and ends at Step  315 . If not at the end of file, the program proceeds to Step  308 . At Step  308 , the method compares the frame identifier set from the second dictionary with each frame identifier set from the first dictionary. If a match is found, the program proceeds to Step  314  where it calculates the difference between the time stamps of the frames from the first and second dictionaries associated with the matching frame identifier sets. 
         [0067]    At Step  316 , the value of the calculated timestamp difference is stored as “timestamp adjustment”. The frame associated with the frame identifier set from the second dictionary is then discarded at Step  318 . At Step  320 , the flag is read to determine if the duplicate frames are the first set of duplicate frames discovered. At Step  322 , if the frames are the first set of duplicate frames discovered, then the timestamp for all the frames in the temporary database of frames is adjusted by the value of the “timestamp adjustment” variable. In an alternate embodiment, a temporary database of frames is not created and all the frames from the second dictionary of frames with timestamps earlier than the first set of duplicate frames discovered are adjusted by the value of the “timestamp adjustment”. At Step  323 , the frames in the temporary database are inserted into the first dictionary. The flag is set to 1 at Step  324  and the next frame identifier set from the second dictionary is read at Step  304 . 
         [0068]    If at Step  320 , the flag is equal to 1, then the program returns to Step  304 . 
         [0069]    At Step  308 , if the frame identifier set from the second dictionary is not a match for any frame identifier sets from the first dictionary of frames, then Step  310  checks the value of the flag. If the value of the flag is 1, then, at Step  326 , the timestamp of the frame associated with the identifier set from the second dictionary is adjusted by the value of the variable timestamp adjustment. Moving to Step  328 , the frame associated with the frame identifier set from the second dictionary is inserted into the first dictionary and the method returns to Step  304 . 
         [0070]    If at Step  310  the value of the flag is not equal to 1, then the frame associated with the frame identifier set from the second dictionary is stored in the temporary database at Step  312 . The program then returns to Step  304 . 
         [0071]    After the merge portion of the method is completed, all of the capture files from each of the capture devices of the computer network system have been merged into the first dictionary of frames from the first capture device and all duplicate frames have been eliminated. The timestamps of the various capture devices have been synchronized according to the disclosed algorithm. Moreover, both of these functions have been accomplished automatically without the introduction of human error or approximation. 
         [0072]    Although the invention has been described with reference to one or more preferred embodiments, this description is not to be construed in a limiting sense. There is modification of the disclosed embodiments, as well as alternative embodiments of this invention, which will be apparent to persons of ordinary skill in the art, and the invention shall be viewed as limited only by reference to the following claims.