Patent ID: 7177930

Claim:
A system for network traffic analysis comprising: a classification engine operable to parse received frames, each frame comprising a plurality of layers of protocols and each frame having a type corresponding to an application layer protocol, and to provide pre-analysis of the received frames to generate classification information on a flow-basis and on a per packet-basis; a filter processing engine operable to reduce the received frames based on a type of each frame indicated by the generated classification information to form information representing filtered frames; and an analysis block operable to perform detailed analysis on layers of protocols of the filtered frames and generate objects representing the analysis, wherein the filter processing engine and the analysis block enable analysis of the received frames in different modes, including: a first mode wherein the filter processing engine reduces the received frames by passing only specified types of frames and the analysis block performs detailed analysis on all layers of protocols of the filtered frames; a second mode wherein the filter processing engine passes all types of frames and the analysis block performs detailed analysis on only specified layers of protocols of the filtered frames; and a third mode wherein the filter processing engine reduces the received frames by passing only specified types of frames and the analysis block performs detailed analysis on only specified layers of protocols of the filtered frames.