Systems and methods for collecting and storing network traffic data

摘要

Systems and methods are disclosed for collecting network traffic logs at a plurality of network sites, such as DNS name servers and network routers, and transmitting data extracted from the network traffic logs to a central repository. In one implementation, a system includes a processor and a memory. The memory stores instructions that cause the processor to retrieve PCAP files from a plurality of servers and extract data from the PCAP files. The data comprises header data and digest data. The processor stores the header data and the digest data in a header/digest pair. In another aspect, the processor retrieves a sample of the PCAP files from each of the plurality of servers rather than retrieving all PCAP files.

主权项

1. A computer-implemented method for collecting network traffic data, comprising:
obtaining, by a network site remote from a central repository, one or more packet capture (PCAP) files; extracting, by the network site, data from the one or more PCAP files, wherein the data includes header data and digest data; storing, by the network site, the header data and the digest data in a header/digest pair; and transmitting the header/digest pair to the central repository.