Patent ID: 8195793

Claim:
A method of filtering network transactions for analysis received over a computer network by a network test device, comprising: determining, by the network test device, a traffic type of a network transaction; determining a relationship behavior corresponding to the traffic type, the relationship behavior being a client/server relationship or a peer to peer relationship; determining which side of the network transaction is a client and which side is a server, based on the determined relationship behavior; assigning a level of confidence determination to the network transaction based on the determined traffic type, the determined relationship behavior, and the determined side of client or server, wherein levels of confidence determinations assigned to network transactions enable users to observe all traffic that is of type “unknown whether client/server”, to observe all traffic that is of type “best guess is client/server,” and to observe all traffic that is of type “known client/server”; determining if the traffic type of the network transaction is a kind that falls into a type of relation of interest; and determining if a server address of the network transaction is in a server traffic group of interest.