Patent ID: 7065102

Claim:
A method for correlating request packets and reply packets during network analysis, comprising: (a) reading a packet from a capture file; (b) identifying a key associated with at least one layer of the packet that resides above a data link control layer; (c) determining whether the packet is a request packet or a reply packet; (d) if the packet includes a request packet: (i) storing data associated with the request packet in a hash table utilizing the key as an index into the hash table, and (ii) decoding the request packet; (e) if the packet includes a reply packet; (i) determining whether the reply packet includes the key, (ii) if the reply packet includes the key, retrieving the data associated with the request packet from the hash table utilizing the key, (iii) correlating the reply packet with the request packet associated with the data, and (iv) decoding the reply packet; (f) determining whether another packet exists in the capture file; and (g) repeating (a)–(f) if it is determined that another packet exists in the capture file.