# US 10,769,033 B2 · Packet-based differential backup of network-attached storage device content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,033 B2 - Document ID: US10769033B2 - Status: Granted - Kind: B2 - Application number: 16/246,367 - Filed: 2019-01-11 - Published: 2020-07-16 - Granted: 2020-09-08 - Earliest claimed: 2019-01-11 - Assignees: Cohesity, Inc. - Applicants: Cohesity, Inc. - Inventors: Prashant Pogde; Sunil Moolchandani; Mohit Aron; Markose Thomas - Web page: https://patentgrep.com/patent/US10769033B2 ## CPC - G06F 11/1469: {Backup restoration techniques} - G06F 11/1451: {by selection of backup contents} - G06F 11/1464: {for networked environments} - H04L 69/22: Parsing or analysis of headers - G06F 11/1453: {using de-duplication of the data} - G06F 11/1461: {Backup scheduling policy} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F 2201/855: Details of asynchronous mirroring using a journal to transfer not-yet-mirrored changes - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for performing incremental backup of a network attached storage (NAS) device are described. A storage capture instance associated with a first time instance is received from a network attached storage device. At least a portion of metadata of tracked network packets associated with the network attached storage device is also received. At least one changed content item of the network attached storage device that has changed since the first time instance is identified by analyzing the at least the portion of the metadata of the tracked network packets received. An incremental backup of the network attached storage device is performed at a second time instance based at least in part on the at least one changed content item identified. ## Claims ### Claim 1 A method, comprising: receiving at a secondary storage system from a network attached storage device a storage capture instance associated with a first time instance, the network attached storage device being external to the secondary storage system; receiving, at the secondary storage system from a packet analyzer, at least a portion of metadata of a subset of tracked network packets associated with the network attached storage device, the tracked network packets being selected from a plurality of network packets external to the secondary storage system based on the at least the portion of the metadata in each of the tracked network packets, wherein the packet analyzer analyzes a set of the tracked network packets in route from a client device to the network attached storage device to identify network packets associated with one or more change operations for content items stored by the network attached storage device, wherein the subset of the tracked network packets associated with the network attached storage device include the identified network packets; identifying at least one changed content item of the network attached storage device that has changed since the first time instance by analyzing the at least the portion of the metadata of the tracked network packets received; and performing an incremental backup of the network attached storage device at a second time instance based at least in part on the at least one changed content item identified, wherein performing the incremental backup of the network attached storage device includes: requesting, by the secondary storage system from the network attached storage device, data associated with the at least one changed content item; receiving at the secondary storage system from the network attached storage device the requested data associated with the at least one changed content item; and backing up the requested data associated with the at least one changed content item. ### Claim 2 (depends on 1) The method of claim 1, wherein each of the tracked network packets of the subset includes a header having the at least the portion of the metadata. ### Claim 3 (depends on 2) The method of claim 2, wherein the at least the portion of the metadata is identified based on a location in the header. ### Claim 4 (depends on 3) The method of claim 3, wherein the at least the portion of the metadata includes an identifier for each of the at least one changed content item and at least one operation performed on each of the at least one changed content item. ### Claim 5 (depends on 1) The method of claim 1, wherein the identifying further includes: deduplicating tracked network packets corresponding to a single changed content item. ### Claim 6 (depends on 1) The method of claim 1, wherein the performing the incremental backup further includes receiving the at least one changed content item at the secondary storage system. ### Claim 7 (depends on 1) The method of claim 1, wherein the backing up the requested data associated with the at least one changed content item includes: providing a snapshot data structure tree including a snapshot tree for the at least one changed content item, the snapshot tree including at least one node for the at least one changed content item and at least one pointer from a root node of the snapshot tree to an at least one intermediate node of a previous snapshot tree. ### Claim 8 (depends on 1) The method of claim 1, wherein receiving the at least the portion of the metadata further includes: receiving the at least the portion of the metadata stripped from each of the tracked network packets; and storing, on the secondary storage system, the at least the portion of the metadata stripped from each of the tracked network packets. ### Claim 9 A system, comprising: a processor configured to: receive at a secondary storage system from a network attached storage device a storage capture instance associated with a first time instance, the network attached storage device being external to the secondary storage system; receive, at the secondary storage system from a packet analyzer, at least a portion of metadata of a subset of tracked network packets associated with the network attached storage device, the tracked network packets being selected from a plurality of network packets external to the secondary storage system based on the at least the portion of the metadata in each of the tracked network packets, wherein the packet analyzer is configured to analyze a set of the tracked network packets in route from a client device to the network attached storage device to identify network packets associated with one or more change operations for content items stored by the network attached storage device, wherein the subset of the tracked network packets associated with the network attached storage device include the identified network packets; identify at least one changed content item of the network attached storage device that has changed since the first time instance by analyzing the at least the portion of the metadata of the tracked network packets received; and perform an incremental backup of the network attached storage device at a second time instance based at least in part on the at least one changed content item identified, wherein to perform the incremental backup of the network attached storage device, the processor is configured to: request, by the secondary storage system from the network attached storage device, data associated with the at least one changed content item; receive, at the secondary storage system from the network attached storage device, the requested data associated with the at least one changed content item; and back up the requested data associated with the at least one changed content item; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 10 (depends on 9) The system of claim 9, wherein each of the tracked network packets of the subset includes a header having the at least the portion of the metadata. ### Claim 11 (depends on 10) The system of claim 10, wherein the at least the portion of the metadata is identified based on a location in the header. ### Claim 12 (depends on 11) The system of claim 11, wherein the at least the portion of the metadata includes an identifier for each of the at least one changed content item and at least one operation performed on each of the at least one changed content item. ### Claim 13 (depends on 9) The system of claim 9, wherein the processor being configured to identify the at least one changed content item further includes the processor being configured to: deduplicate tracked network packets corresponding to a single content item. ### Claim 14 (depends on 9) The system of claim 9, wherein the processor being configured to perform the incremental backup further includes the processor being configured to receive the at least one changed content item at the secondary storage system. ### Claim 15 (depends on 9) The system of claim 9, wherein to back up the requested data associated with the at least one changed content item, the processor is configured to: provide a snapshot data structure tree including a snapshot tree for the at least one changed content item, the snapshot tree including at least one node for the at least one changed content item and at least one pointer from a root node of the snapshot tree to an at least one intermediate node of a previous snapshot tree. ### Claim 16 (depends on 9) The system of claim 9, wherein to receive the at least the portion of the metadata, the processor is further configured to: receive the at least the portion of the metadata stripped from each of the tracked network packets; and store, on the secondary storage system, the at least the portion of the metadata stripped from each of the tracked network packets. ### Claim 17 A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for: receiving at a secondary storage system from a network attached storage device a storage capture instance associated with a first time instance, the network attached storage device being external to the secondary storage system; receiving, at the secondary storage system from a packet analyzer, at least a portion of metadata of a subset of tracked network packets associated with the network attached storage device, the tracked network packets being selected from a plurality of network packets external to the secondary storage system based on the at least the portion of the metadata in each of the tracked network packets, wherein the packet analyzer analyzes a set of the tracked network packets in route from a client device to the network attached storage device to identify network packets associated with one or more change operations for content items stored by the network attached storage device, wherein the subset of the tracked network packets associated with the network attached storage device include the identified network packets; identifying at least one changed content item of the network attached storage device that has changed since the first time instance by analyzing the at least the portion of the metadata of the tracked network packets received; and performing an incremental backup of the network attached storage device at a second time instance based at least in part on the at least one changed content item identified, wherein performing the incremental backup of the network attached storage device includes: requesting, by the secondary storage system from the network attached storage device, data associated with the at least one changed content item; receiving, at the secondary storage system from the network attached storage device, the requested data associated with the at least one changed content item; and backing up the requested data associated with the at least one changed content item. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein each of the tracked network packets of the subset includes a header having the at least the portion of the metadata. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the at least the portion of the metadata is identified based on a location in the header. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the at least the portion of the metadata includes an identifier for each of the at least one changed content item and at least one operation performed on each of the at least one changed content item. ### Claim 21 (depends on 19) The computer program product of claim 19, wherein the computer instructions for identifying further include computer instructions for: deduplicating tracked network packets corresponding to a single changed content item. ### Claim 22 (depends on 17) The computer program product of claim 17, wherein the instructions for performing the incremental backup further include instructions for receiving the at least one changed content item at the secondary storage system. ### Claim 23 (depends on 17) The computer program product of claim 17, wherein the computer instructions for backing up the requested data associated with the at least one changed content item includes computer instructions for: providing a snapshot data structure tree including a snapshot tree for the at least one changed content item, the snapshot tree including at least one node for the at least one changed content item and at least one pointer from a root node of the snapshot tree to an at least one intermediate node of a previous snapshot tree. ### Claim 24 (depends on 17) The computer program product of claim 17, wherein the computer instructions for receiving the at least the portion of the metadata further include computer instructions for: receiving the at least the portion of the metadata stripped from each of the tracked network packets; and storing, on the secondary storage system, the at least the portion of the metadata stripped from each of the tracked network packets.