Attributes of captured objects in a capture system

摘要

A system and method for capturing objects and balancing systems resources in a capture system are described. An object is captured, metadata associated with the objected generated, and the object and metadata stored.

主权项

1. At least one non-transitory machine-readable medium having instructions stored therein and when executed, the instructions cause one or more processors to:
capture a plurality of packets being transmitted over a network through a capture system that includes a processor and a network interface for receiving packets; reconstruct a captured object from the plurality of packets, wherein the captured object is one of a plurality of captured objects reconstructed from the plurality of packets; determine an association between the captured object and a computer name of a computer sending or receiving the captured object, wherein the association is determined by identifying a network address associated with the captured object and reading one or more log files of the network to determine the computer name associated with the network address, wherein the one or more log files are to be updated if the network address is assigned to another computer, wherein the captured object is to be stored in a storage location in a rolling storage; generate metadata of the captured object, the metadata including an indication of an association between the storage location and the computer name of the computer; and search a plurality of metadata of captured objects based on the computer name to determine one or more storage locations in the rolling storage that contain captured objects associated with the computer.