Patent ID: 7266088

Claim:
A method of analyzing data comprising the steps of: a) creating a data flow table having an entry for each unique data flow, where each data flow entry includes fields selected from the group of fields consisting of origin IP address, destination IP address, time-to-live value, packet length, packet number, start time, stop time, origin port, destination port, protocol, any other suitable value and any combination thereof; b) receiving a data packet that includes at least one of said fields listed in step a); c) comparing said at least one field of said data packet to at least one user-definable set of values; d) adding at least one error field to said data flow table that corresponds with said at least one field of said data packet identified in step c) that is outside of said at least one user-definable set of values; e) entering in said at least one error field said at least one field of said data packet identified in step c) that is outside of said user-definable set of values; f) entering in said data flow table said at least one field of said data packet identified in the last step that is within the at least one user-definable set of values; g) comparing at least one corresponding entry in said data flow table to said at least one field of said data packet entered into said data flow table in the last step; h) adding at least one anomaly field to said data flow table if said field of said data packet differs from said corresponding entry in said data flow by a user-definable value or set of values; i) entering in said at least one anomaly field said at least one field of said data packet identified in step h) that differs from said entry of said data flow table by a user-definable value or set of values; j) identifying data flows in said data flow table for data flows that have ended; k) transmitting data flows, data from said at least one error field, and data from said at least one anomaly field for said data flows that have ended; and l) returning to step b) if there are additional data packets to be processed.