Real-time adaptive processing of network data packets for analysis

摘要

A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

主权项

1. A method for processing network data for analysis, comprising:
receiving data packets by a network monitoring device at a location in a network; determining a session associated with the received data packets; generating a common header summarizing information in headers of a plurality of data packets in the session by the network monitoring device; generating a unit of payload metadata summarizing information in payloads of the plurality of the data packets in the session by the network monitoring device; generating, for each session, a session record including the common header and the payload metadata by the network monitoring device; and storing the session record.