Patent ID: 8285834

Claim:
A method for sniffing packets communicated over a network, the method comprising: examining state information stored in at least one main storage control block of an operating system to identify an active protocol stack within a plurality of protocol stacks on the network, the active protocol stack actively being used to communicate a packet over the network; analyzing the protocol stack to identify at least one attribute of the active protocol stack, the at least one attribute identifying one of a plurality of protocol stack configurations present on the network and distinguishing the active protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network; enabling a packet intercept for the identified active protocol stack based on the identified protocol stack configuration; collecting data about said packets communicated over said network using said packet intercept; using an operating system exit to detect the termination of the active protocol stack when the communication of packets across the active protocol stack have been ended, wherein detecting the termination of the protocol stack comprises: detecting a termination process from the active protocol stack; and determining that the protocol stack includes an enabled packet intercept; and in response to detecting that the active protocol stack is no longer in a state where it is capable of communicating packets over the network, removing the packet intercept from the active protocol stack.