Patent ID: 7958227

Claim:
A method to be executed in a network environment in which packets are exchanged, comprising: capturing a plurality of packets being transmitted over a network through a capture system that includes a processor and a network interface for receiving packets; reconstructing an object based on the packets; communicating the object to an object classification module for classifying the object based on its content, wherein the captured packets are used to reconstruct at least a portion of a document sought to be communicated over the network; determining a protocol associated with the object; classifying the object based at least in part on the protocol, wherein the classifying includes generating metadata associated with the object; storing the metadata and the object; and balancing resources of the capture system, wherein the balancing comprises determining an amount memory of the capture system that is needed to reassemble a flow and determining a flow rate for the capture system from the amount of memory, and wherein the flow rate reflects a number of concurrent sessions that are supported by the capture system, wherein the capture system is configured to allow the document to be forwarded from the capture system to its intended destination at a network node unless a capture rule prohibits forwarding the document based on an analysis of the content of the document, and wherein if the document is not forwarded then an alert is sent to a user associated with a previous registration of data identified within the document, and wherein the alert includes an Internet protocol (IP) source address and an IP destination address associated with attempted transmission of the document.