Patent ID: 7747737

Claim:
A network device comprising: a dynamic flow capture (DFC) service card executing a communication protocol to receive, from one or more control sources (CSs), flow capture information specifying at least one destination and criteria for matching one or more packet flows; a network interface card to receive a packet from a network; a control unit to provide contents of the packet from the interface card to the DFC service card; a filter cache maintained by the DFC service card that caches flow capture information recently received from the CSs, wherein the filter cache includes a plurality of flow capture information entries, and each entry specifies a filter defining: (i) at least one criteria of: a source IP address, a destination IP address, a source port, a destination port, or a protocol, (ii) a designation of the CS that requested the filter, and (iii) the destination to which replicated packets matching the criteria should be sent; a filter table that stores the flow capture information received from the CSs except the flow capture information cached in the filter cache, wherein the DFC service card moves the flow capture information cached in the filter cache to the filter table upon expiration of a timer; and an array of reference counts addressable by a range of source IP addresses as one dimension of the array and a range of destination IP addresses as another dimension of the array, wherein each reference count indicates a number of filters specified by the flow capture information capable of matching the addresses ranges associated with the reference count.