Patent ID: 7793001

Claim:
A method of capturing trace data for use in network packet traffic analysis, the method comprising: receiving a packet; and storing a representation of the packet in a file, said representation and said file being associated with one of a source address of the packet and a destination address of the packet, wherein storing a representation of the packet in a file comprises: if the file associated with an address is empty, creating and storing the associated representation, the associated representation comprising a time of the packet and a value for each of a set of fields; and if the file associated with an address comprises a representation of a previous packet, creating the associated representation by: determining a time difference between said packet and said previous packet; if a magnitude of the time difference exceeds a threshold, storing the time of said packet and setting a value of the time difference to zero; setting a flag in the representation for each of the set of fields, each flag identifying if a value of a field in said packet is the same as a value of said field in said previous packets; storing each said flag and the time difference; and storing the value of each field from the set of fields where the value of the field in said packet is not the same as the value of the field in the previous packet.