Patent ID: 7065571

Claim:
A method for policy-based billing for a distributed network session, comprising: (a) receiving a plurality of packets at a plurality analyzers; (b) aggregating the plurality of packets; (c) analyzing the plurality of packets to identify a plurality of flows; (d) identifying a session associated with the flows; (e) identifying at least one application associated with the session; (f) reconstructing the session utilizing the identified application, the session reconstruction being carried out at a plurality of collaborating nodes; (g) identifying a user associated with the session; (h) determining a policy; and (i) billing the user the session in accordance with the policy; wherein the session reconstruction is performed at a first analyzer, and upon a successful session reconstruction on the first analyzer, a first message is sent to at least one second analyzer separate from the first analyzer, the first message corresponding to session data, and upon an unsuccessful session reconstruction on the first analyzer, one or more messages is sent to the second analyzer, the one or more messages including unrecognized data.