Patent ID: 8867343

Claim:
A method for monitoring flows of packets over a network, wherein a network device enables actions, comprising: selecting at least one of a plurality of flows for passive monitoring in real time over a network; providing at least one trigger that is initiated in real time by at least one condition that is associated with the at least one selected flow; determining at least one other flow that is related to the at least one selected flow, wherein the at least one other related flow is unassociated with the at least one trigger, and wherein the at least one selected flow and the at least one other related flow corresponds to at least the same application, node, or network device; buffering in real time the at least one selected flow in a buffer, wherein each selected flow is arranged as a thread in the buffer; if buffering the at least one selected flow dominates a capacity of the buffer over at least one other selected flow, throttling the buffering of the at least one dominant selected flow until the capacity of the buffer is able to buffer the at least one other selected flow; if the at least one condition occurs and initiates the at least one trigger, enabling other actions, including: recording in real time each packet for the at least one selected flow that is associated with the at least one condition, wherein each buffered packet for the selected flow is recorded in real time along with the selected flow's packets that are received after the initiation of the trigger, and after the initiation of the trigger, recording in real time each packet for the at least one other related flow; and enabling in real time analysis and play back of the recorded flows regarding at least the occurrence of the condition.