Patent Document ID: 9426071
Application ID: 14463226

Base Claim:
1. A method comprising: intercepting a first packet from a network link at a node coupled to the network link, the node including persistent storage devices organized as a plurality of volumes having a hierarchical file system; computing a first hash value based on a network flow of the first packet; recording the first packet in a packet capture (PCAP) format as a first PCAP record including the first hash value and first flow metadata appended to the first PCAP record; copying the first PCAP record to a first metadata repository stored as a first file on a first volume of the hierarchical file system of the node, wherein the first metadata repository stores a plurality of second PCAP records having second hash values and second flow metadata; and concurrently searching and retrieving one or more of the second PCAP records of the first metadata repository while copying the first packet to a data repository stored as a second file of a second volume of the hierarchical file system of the node to realize a substantially high sustained packet transfer rate of the network link.

---

Claim 4:
4. The method of claim 1 wherein the data repository is embodied as secondary storage and wherein recording the first packet comprises: capturing the first packet and subsequent packets at the substantially high sustained packet transfer rate of the network link for a duration that yields an amount of captured packets that exceeds a memory capacity of the node such that at least a portion of the captured packets is written through to secondary storage without dropping the captured packets and while maintaining capture of the packets at the substantially high sustained packet transfer rate.