Patent ID: 8037175

Claim:
A network device comprising: a dynamic flow capture (DFC) service card executing a communication protocol to receive, from one or more control sources (CSs), flow capture information specifying criteria for matching one or more packet flows and at least one destination to which replicated packets matching the criteria should be sent; a network interface card to receive a packet from a network; a control unit to provide contents of the packet from the interface card to the DFC service card; and a filter cache maintained by the DFC service card that caches flow capture information recently received from the CSs, wherein the filter cache includes a plurality of flow capture information entries, and each entry specifies a filter defining: (i) at least one criteria of: a source IP address, a destination IP address, a source port, a destination port, or a protocol, (ii) a designation of the CS that requested the filter, and (iii) the destination to which replicated packets matching the criteria should be sent, wherein the control unit sends replicated packets matching the criteria to the destination.