Network analysis device and method

摘要

One embodiment of a device includes a network filter configured to filter a plurality of network streams in real-time at the network analysis device to access at least one of the plurality of network streams based on filter parameters input to the network filter. The device further includes a processor configured to compile network information associated with the accessed at least one of the plurality of network streams to allow interaction with the network information.

主权项

1. A network analysis device comprising:
a network filter comprising:
a packet comparator configured to:
monitor each packet of a plurality of network streams to determine characteristic information corresponding to a network address and a network port of each of the plurality of network streams; andstore the characteristic information of each network stream of the plurality of network streams in a first memory of the network filter which is accessible by a given processor of the network analysis device, to generate a list of channels corresponding to the plurality of network streams based on the characteristic information stored therein; anda filter stage configured to:
filter the plurality of network streams in real-time at the network filter to store packets of at least one of the plurality of network streams in a second memory of the network filter based on filter parameters input to the network filter and the stored characteristic information;validate packets of at least one of the plurality of network streams stored in the second memory based on a data rate thereof with respect to a processing capability of the given processor;store descriptor information in a third memory of the network filter to enable the given processor to access the validated packets stored in the second memory and exclude non-validated other plurality of network streams from being accessed by the given processor of the network analysis device, wherein the given processor is configured to access the packets from the second memory based on the descriptor information to enable interaction with the network streams.