Patent ID: 7617314

Claim:
A method for monitoring network traffic, the method implemented on a computer, the method comprising: generating two or more index tables associated with two or more time intervals, each index table comprising a set of pointers to a corresponding set of storage locations storing traffic data captured over the time interval associated with the index table, the traffic data in each set of storage locations organized in a plurality of tuples with associated network traffic measures, each tuple including a set of dimension values uniquely identifying network communications between two end-points, wherein the set of pointers are sorted in an order based on at least one of the dimension values in the tuples for the traffic data captured over the interval of time corresponding to the index table; and in response to a query with respect to a dimension requesting a time aggregated result based on the network traffic measures, aggregating partial results based on network traffic measures into the time aggregated result by accessing the storage locations storing traffic data captured over different time intervals following the order of the pointers in each index table, the aggregating performed by a processor of the computer, the aggregating further comprising: following the order of the pointers in a first index table associated with a first time interval as long as a dimension value pointed to by each pointer is a specified dimension value; and upon reaching a pointer in the first index table pointing to a new dimension value different from the specified dimension value, following the order of the pointers in a second index table corresponding to a second time interval as long as a dimension value pointed to by each pointer is the specified dimension value.