Patent ID: 6851061

Claim:
A system for intrusion detection data collection using a protocol stack multiplexor, comprising: a hierarchical protocol stack defined within kernel memory space and comprising a plurality of communicatively interfaced protocol layers, each such protocol layer comprising one or more procedures for processing data packets; a data frame processed through the protocol stack, the data frame comprising a plurality of recursively encapsulated data packets which are each encoded with a protocol recognized by one of the protocol layers; and a protocol stack multiplexor collecting data directly from the protocol stack from at least one of the processed data packets, comprising: an interface interfacing directly into at least one such protocol layer through redirected references to the data packet processing procedures comprised within the at least one such protocol layer; and a logical reference to the processed data packets obtained from the interfaced protocol layer, the logical reference referring to a memory block in the kernel memory space within which the processed data packets are stored and provided to an intrusion detection analyzer executing within user memory space.