INTELLIGENT LOAD BALANCING AND HIGH SPEED INTELLIGENT NETWORK RECORDERS

摘要

A high speed intelligent network recorder for recording a plurality of flows of network data packets into and out of a computer network over a relevant data time window is disclosed. The high speed intelligent network recorder includes a printed circuit board; a high speed network switching device mounted to the printed circuit board; and an X column by Y row array of a plurality of intelligent hard drives with micro-computers mounted to the printed circuit board and coupled in parallel with the high speed network switching device.;A method for network recording is disclosed. In one embodiment, the method includes the following: receiving a plurality of incoming packets, wherein each incoming packet belongs to a conversation flow; forming a capture stream of packet records for the incoming packets; and performing intelligent load balancing on the capture stream of packet records, the load balancing including reading the metadata for each packet record, determining a packet record is part of either a hot flow or a cold flow, selecting a destination node for each packet record based on the flow hash, and steering the packet record to one of a plurality of encapsulation buffers based on the destination node, wherein a cold flow tends to be maintained in a flow coherency at a node. The method may further include operations that include querying and back-testing in order to enable distributed analytics by using low cost, low band width nodes.

主权项

1. A high speed intelligent network recorder for distributed recording and analytics of a plurality of flows of network data packets into and out of a computer network over a relevant data time window, the high speed intelligent network recorder comprising:
a printed circuit board; a high speed network switching device coupled to the printed circuit board, the high speed network switching device adapted to couple to a network and receive a plurality of flows of network data packets to and from one or more network devices in the network; an X column by Y row array of a plurality of intelligent hard drives coupled to the printed circuit board and in parallel to the high speed network switching device, wherein the product of X and Y is greater than fifty, each of the plurality of intelligent hard drives including,
a micro-computer coupled to the high speed network switching device, the micro-computer having a processor, a memory coupled to the processor, and a network interface adapter coupled to the high speed network switching device to send and receipt network data packets,a low cost high speed hard drive coupled to the micro-computer, anda network interface adapter coupled to the microcomputer and the high speed network switching device; wherein the X column by Y row array of the plurality of intelligent hard drives records a plurality of flows of network data packets in the network over a relevant data time window.