Patent ID: 8649380

Claim:
A method of providing queryable information about an IP network comprised of hosts and routers with IP (Internet Protocol) addresses in the IP network, the method comprising: receiving and storing a plurality of traffic flows from hosts in the IP network, the traffic flows having been obtained by the hosts by, for any given host: monitoring the transmission and receipt of packets on the given host to capture packet data as the packets are sent and received on the given host, and synthesizing the captured packet data to form and store a plurality of traffic flows, each traffic flow corresponding to a plurality of the packets that were all sent or received between a same source IP address and a same destination IP address via a same application, a same application-level protocol, or a same port, each traffic flow including a statistic derived from the packets in the corresponding plurality; receiving and storing, in association with the traffic flows, a plurality of routing paths, each routing path comprising indicia of one or more routers that routed some of the packets; and providing queryable access to the traffic flows and routing paths to allow a query to be answered.