Patent ID: 8488466

Claim:
A method, comprising: receiving, at a network captured traffic distribution device, a plurality of data patterns of interest; receiving, at the network captured traffic distribution device, a traffic flow of captured data packets, the captured data packets being at least one of a copy and a representation of the data packets flowing through a communication network, wherein the captured data packets are received via at least one of a mirror port resident on a source of the captured data packets and a traffic capture point located along a communication link between two communicating devices, and the network captured traffic distribution device includes a plurality of ingress and egress ports; scanning data packets of the traffic flow of captured data packets to find a data packet including a data pattern of interest and, for any found data packets, determining identifying information therefrom; scanning data packets of the traffic flow to find one or more data packets with identifying information matching identifying information of a found data packet; determining an egress port of the network captured traffic distribution device assigned to the found data packet based upon the data pattern of interest detected in the found data packet; and transmitting the found data packet and any data packets having matching identifying information to the assigned egress port.