Patent ID: 8813220

Claim:
A computer-based method for providing information about a potential security incident ascertained from received internet protocol (IP) packets, said method comprising: capturing, with a processing device, IP packets from a computer network; stripping packet header data from the captured IP packets; reviewing the stripped packet header data for multiple occurrences of matching packet header data by selecting key header fields that make the header packets unique, the key header fields excluding a packet length and including two or more of the following: a virtual local area network (VLAN) tag and header fields for an Ethernet header; next header, hop limit, source IP, and destination IP header fields for an IPv6 header; and type and code header fields for an Internet Control Message Protocol (ICMP) header; calculating a cyclic redundancy code (CRC) utilizing only the selected key header fields; once the CRC has been calculated, checking successive entries in a cache for a first empty entry in said cache by comparing the calculated CRC to a stored CRC in each of said successive entries; writing the packet data to the first empty entry in said cache; determining any reviewed packet header data that has occurred multiple times; and storing, in a database, only a single instance of packet header data for any reviewed packet header data that is determined to have occurred multiple times.