Patent ID: 8219675

Claim:
A system for monitoring IP flows across a Network Address Translation (NAT) firewall, comprising: a first monitor probe coupled to an interface on a first side of the NAT firewall, the first monitor probe configured to capture data packets from the interface on the first side of the NAT firewall and to correlate the data packets into a first group of session records; a second monitor probe coupled to an interface on a second side of the NAT firewall, the second monitor probe configured to capture data packets from the interface on the second side of the NAT firewall and to correlate the data packets into a second group of session records; and a processor coupled to the first and second monitor probes, the processor configured to calculate checksum keys for the first and second groups of session records, the checksum keys based upon an invariant portion of the session records, the invariant portion corresponding to a portion that is not modified by translation in the NAT firewall, the invariant portion including data from each of: a Request Method, a Host, a URI, and a UE Profile header.