Patent ID: 7639613

Claim:
A method for recording network traffic data, comprising: maintaining, in a memory of a network device, a measurement data structure including at least one entry and a corresponding measurement key, wherein the at least one entry comprises at least one measurement attribute; receiving, at the network device, a packet having a plurality of packet attributes; associating the packet to a data flow by hashing a plurality of packet attributes of the packet to create a first flow key and matching the first flow key to a second flow key associated with a data flow object of a plurality of data flow objects, wherein each data flow object includes a plurality of data flow attributes, and adding a new data flow object that includes the first flow key to the plurality of data flow objects, if the packet does not match any data flow objects of the plurality of data flow objects; selecting, based on one or more data flow attributes of the data flow object corresponding to the data flow, a measurement engine policy from a plurality of measurement engine policies; creating a second measurement key for the packet based on the selected measurement engine policy and at least one of the plurality of data flow attributes, wherein the plurality of packet attributes used to create the first flow key and the at least one of the data flow attributes used to create the second measurement key differ by at least attribute; and matching the second measurement key to an entry in a measurement data structure; and if a matching entry is found, updating a measurement value of the entry based on the packet; if no matching entry is found, creating a new entry in the measurement data structure.