Patent ID: 7580356

Claim:
A method for recording network traffic data, in a network device operably disposed in a network, wherein the network device comprises a measurement data structure including at least one entry and a corresponding measurement key, wherein the at least one entry comprises one or more measurement attributes, comprising: receiving a packet; matching the packet to a data flow; identifying, by a processor, a measurement policy for the data flow from a plurality of measurement engine policies, wherein one of the measurement engine policies is a default measurement engine policy and at least one other of the measurement engine policies is a specific measurement engine policy, wherein each of the measurement policies comprises one or more measurement axes corresponding to respective data flow attributes, and wherein at least one of the measurement engine policies is a dynamic measurement engine policy that further comprises a rule set relating to at least one of the one or more measurement axes, wherein the rule set for the at least one of the one or more measurement axes defines a default state and one or more rules controlling when to switch from the default state to a second state, and wherein the identifying the measurement engine policy comprises applying one or more matching rules to match the data flow to a specific measurement engine policy of the plurality of measurement engine policies and selecting the default measurement engine policy if the data flow is not matched to a specific measurement engine policy; if the identified measurement engine policy is a dynamic measurement engine policy, then applying the rule set to determine states for the at least one or more measurement axes and dynamically select, conditioned on the respective determined states, one or more of the measurement axes in the measurement policy to be applied to the data flow, else selecting all of the one or more measurement axes associated with the identified measurement engine policy; creating, by the processor, a measurement key based on the selected one or more measurement axes and attributes of the data flow corresponding to the selected one or more measurement axes; matching the measurement key to an entry in a measurement data structure; if a matching entry is found, updating at least one of the one or more measurement attributes corresponding to the entry based on the received packet; and if no matching entry is found, creating a new entry in the measurement data structure.