Triggering packet capture based on detecting a sequence anomaly

A device comprising:

• a network interface in communication with a network;
• a processor configured to execute computer readable instructions included on a non-transitory memory;
• and
• a non-transitory memory including processor-readable instructions that, when executed by the processor, cause the device to
• detect an anomaly in a detected sequence of events occurring during a connectivity process for establishing a connection between a first network device and a second network device of the plurality of network devices, wherein each successive event expected to occur in a specific sequence during the connectivity process is assigned a successive sequence number comprising a positive integer, and wherein the instructions causing the device to determine the anomaly comprises the instructions causing the device to:
• determine a set of positive integers assigned to the detected sequence of events occurring during the connectivity process, and
• determine a difference between the set of positive integers assigned to the detected sequence of events and an expected set of positive integers assigned to a predetermined sequence of events;
• determine that the anomaly satisfies a criterion for triggering a packet capture operation, wherein the criterion comprises a probability that the detected sequence of events will result in a future connectivity issue exceeding a threshold;
• and
• on a condition that the anomaly satisfies the criterion for triggering the packet capture operation, cause at least one of the first network device or the second network device to capture at least one target packet.

A non-transitory computer readable storage medium storing instructions, that, when executed by a computing device cause the computing device to perform a method comprising:

• detecting an anomaly in a detected sequence of events occurring during a connectivity process for establishing a connection between a first network device and a second network device of a plurality of network devices, wherein each successive event expected to occur in a specific sequence during the connectivity process is assigned a successive sequence number comprising a positive integer, and wherein determining the anomaly comprises:
• determining a set of positive integers assigned to the detected sequence of events occurring during the connectivity process, and
• determining a difference between the set of positive integers assigned to the detected sequence of events and an expected set of positive integers assigned to a predetermined sequence of events;
• determining that the anomaly satisfies a criterion for triggering a packet capture operation, wherein the criterion comprises a probability that the detected sequence of events will result in a future connectivity issue exceeding a threshold;
• and
• in response to determining that the anomaly satisfies the criterion for triggering the packet capture operation, causing at least one of the first network device or the second network device to capture at least one target packet.