# US 10,454,984 B2 · Method for streaming packet captures from network access devices to a cloud server over HTTP > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,984 B2 - Document ID: US10454984B2 - Status: Granted - Kind: B2 - Application number: 15/607,089 - Filed: 2017-05-26 - Published: 2017-09-14 - Granted: 2019-10-22 - Earliest claimed: 2013-03-14 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: John Bicket; Benjamin A. Chambers - Web page: https://patentgrep.com/patent/US10454984B2 ## CPC - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 41/0246: Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols - H04L 43/028: by filtering - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 49/25: Routing or path finding in a switch fabric - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 65/762: {at the source (reformatting of additional data in video distribution servers H04N21/2355)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for streaming packet captures over the Internet includes multiple network access devices, each operating as one of a gateway device, a wireless access point, and a network switch, and a management server communicatively coupled to the network access devices over the Internet for managing the network access devices. The management server maintains a persistent hypertext transport protocol (HTTP) connection with each of the network access devices over the Internet. The management server is to generate a bytecode based on a filtering expression for packet captures (PCAPs) representing one or more PCAPs filtering rules, transmit the bytecode to the network access devices without requiring the network access devices to compile the PCAPs filtering rules, receive PCAPs from the network access devices captured by the network access devices based on the PCAPs filtering rules, and merge the PCAPs received from the network access devices into merged PCAPs. ## Claims ### Claim 1 A system, comprising: a management server comprising a processor and a memory, configured to manage a plurality of network access devices by: transmitting a bytecode to at least a portion of the network access devices, the bytecode representing one or more packet captures (PCAPs) filtering rules; and generating merged PCAPs based on PCAPs captured by at least the portion of the plurality of network devices based on the bytecode; wherein a PCAP stream received from network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream; and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started. ### Claim 2 (depends on 1) The system of claim 1, wherein the management server is configured to transmit the bytecode to at least the portion of the plurality of network access devices without requiring the portion of the plurality of network access devices to compile the PCAPs filtering rules. ### Claim 3 (depends on 1) The system of claim 1, wherein the management server includes a web interface configured to provide a set of network management tools for configuring the plurality of network access devices over the Internet, and wherein the management server is configured to transmit the bytecode based on a filtering expression received via the web interface that specifies how the PCAPs are to be captured. ### Claim 4 (depends on 1) The system of claim 1, wherein the management server maintains a persistent hypertext transport protocol (HTTP) connection with each of the plurality of network access devices. ### Claim 5 (depends on 4) The system of claim 4, wherein each of the plurality of network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection. ### Claim 6 (depends on 5) The system of claim 5, wherein the management server is configured to stream the PCAPs a over the Internet via the HTTP connections between the management server and at least the portion of the plurality of network access devices. ### Claim 7 (depends on 6) The system of claim 6, wherein the management server is configured to stream the PCAPs from the HTTP server components of the portion of the plurality of network access devices to the HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks. ### Claim 8 A method, comprising: transmitting, by the management server, a bytecode to at least a portion of a plurality of network access devices, the bytecode representing one or more packet capture (PCAPs) filtering rules; and generating merged PCAPs based on PCAPs captured by at least the portion of the plurality of network devices based on the bytecode; wherein a PCAP stream received from network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream; and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started. ### Claim 9 (depends on 8) The method of claim 8, wherein transmitting the bytecode to at least the portion of the network access devices is performed without requiring the portion of the plurality of network access devices to compile the PCAPs filtering rules. ### Claim 10 (depends on 8) The method of claim 8, further comprising: providing a set of network management tools on a web interface for configuring the plurality of network access devices over the Internet, wherein the transmitting transmits the bytecode based on a filtering expression received via the web interface to specify how the PCAPs are to be captured. ### Claim 11 (depends on 8) The method of claim 8, wherein each of the plurality of network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection. ### Claim 12 (depends on 11) The method of claim 11, further comprising: streaming the PCAPs from the HTTP server component of each of the portion of the plurality of network access devices to the HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks. ### Claim 13 A non-transitory machine-readable medium having instructions stored therein, which when executed by one or more processors of a management server, cause the one or more processors to: transmit a bytecode to at least a portion of a plurality of network access devices, the bytecode representing one or more packet capture (PCAPs) filtering rules; and generate merged PCAPs based on PCAPs captured by at least the portion of the plurality of network devices based on the bytecode; wherein a PCAP stream received from network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream; and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the execution of the instructions by the one or more processors causes the processor to transmit the bytecode to at least the portion of the network access devices without requiring the network access devices to compile the PCAPs filtering rules. ### Claim 15 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the execution of the instructions by the one or more processors causes the processor to, provide a set of network management tools, via a web interface, for configuring the plurality of network access devices over the Internet, transmit the bytecode based on a filtering expression received from the web interface that specifies how the PCAPs are to be captured. ### Claim 16 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein each of the network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection. ### Claim 17 (depends on 16) The non-transitory machine-readable medium of claim 16, wherein the execution of the instructions by the one or more processors causes the processor to stream the PCAPs from the HTTP server components of each of the portion of the plurality of network access devices to the HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks.