Patent ID: 7953092

Claim:
A method of capturing packets, comprising: receiving packets from a network attaching a timestamp to each received packet distributing the received packets between a plurality of capture engines, each capture engine including a respective one of a plurality of capture memories capturing packets using the plurality of capture engines, wherein the plurality of capture engines collectively perform actions including determining if each received packet matches one or more of a plurality of predetermined capture criteria storing at least some of the received packets that match one or more of the plurality of capture criteria, each of the capture engines storing packets in the respective capture memory discontinuing storing received packets in accordance with a predetermined completion criteria after discontinuing storing received packets, eliminating non-contiguous packets from the packets stored in the plurality of capture memories and preparing a list in timestamp order of contiguous packets stored in the plurality of capture memories wherein eliminating non-contiguous stored packets comprises: determining, for each of the plurality of capture engines, if the respective capture memory wrapped while storing received packets when one or more of the plurality of capture memories wrapped determining the latest timestamp among the earliest packet stored in each capture memory that wrapped discarding all stored packets having timestamp values less than the latest timestamp among the earliest packet stored in each capture memory that wrapped.