Patent ID: 8204958

Claim:
An apparatus comprising a non-transitory machine readable storage medium including instructions that, when executed by a network analysis expansion card coupled to a host device over a PCI-Express bus, cause the network analysis expansion card to: receive a network data item from a network and duplicate the network data item into a first network data item and a second network data item; store, using a capture module, the first network data item on a storage device; buffer, in an input buffer coupled to a statistics module on the network analysis expansion card, the second network data item; repeat the receive, duplicate, store, and buffer steps so that the input buffer contains a plurality of second network data items; select from the input buffer, by the statistics module, one out of every X second network data items of the plurality of second network data items to form a subset of the plurality of second network data items, wherein the X is greater than one and is determined based on a utilization percentage of the input buffer and a rate of change in utilization percentage of the input buffer; and perform, on the host device, network analysis on the subset of the plurality of second network data items, wherein a result of the network analysis is sent back to the statistics module over the PCI-Express bus.