A time machine arrangement configured to capture network data traffic between at least two network devices in a network environment in which the time machine arrangement is connected, the network environment containing said at least two network devices , an analyzer and the time machine arrangement being positioned between the at least two network devices , the time machine arrangement comprising: a set of network ports , said set of network ports coupling the time machine arrangement to said at least two network devices and said set of network ports including a set of input network ports configured to receive data traffic and a set of output network ports configured to output said data traffic from said time machine arrangement , and a set of processors configured to manage and perform filtering on the flow of data traffic through the time machine arrangement and to forward to said analyzer only data packets that meet a criteria established for the analyzer , characterized in that said set of processors includes: a scheduler component configured to determine a percentage of data traffic that can be handled by each processor of the set of processors ; a filtering component configured to apply a set of filters on said data traffic, the filtering component configured to apply at least one of ingress filtering, egress filtering and deep packet inspection of received data traffic, wherein ingress filtering refers to a technique for verifying the origination of data packets of said data traffic, wherein egress filtering refers to a technique for restricting the flow of outbound data traffic to said output network ports, and wherein deep packet inspection refers to a technique for analyzing data for security and/or data mining purposes; a storage memory component configured to store data traffic copied by time machine arrangement , wherein only data packets from said data traffic that meet certain conditions are stored and wherein said time machine arrangement is configured to save incoming data packets over old data once said storage memory component has reached its maximum capacity; and a trigger component configured to define a set of conditions under which a set of data packets stored within said storage component is protected from being overwritten. a scheduler component configured to determine a percentage of data traffic that can be handled by each processor of the set of processors ; a filtering component configured to apply a set of filters on said data traffic, the filtering component configured to apply at least one of ingress filtering, egress filtering and deep packet inspection of received data traffic, wherein ingress filtering refers to a technique for verifying the origination of data packets of said data traffic, wherein egress filtering refers to a technique for restricting the flow of outbound data traffic to said output network ports, and wherein deep packet inspection refers to a technique for analyzing data for security and/or data mining purposes; a storage memory component configured to store data traffic copied by time machine arrangement , wherein only data packets from said data traffic that meet certain conditions are stored and wherein said time machine arrangement is configured to save incoming data packets over old data once said storage memory component has reached its maximum capacity; and a trigger component configured to define a set of conditions under which a set of data packets stored within said storage component is protected from being overwritten. <EOS>