REAL-TIME ADAPTIVE PROCESSING OF NETWORK DATA PACKETS FOR ANALYSIS

摘要

A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

主权项

1. A method, comprising:
determining a session associated with data packets received by a network monitoring device at a location in a network; generating a common header summarizing information in headers of a plurality of data packets in the session by the network monitoring device; generating a unit of payload metadata summarizing information in payloads of the plurality of the data packets in the session by the network monitoring device; and generating, for each session, a session record for storing the session record, the session record including the common header and the payload metadata by the network monitoring device.