Offline analysis of packets

An apparatus comprising:

• means for filtering packets based on at least one rule, wherein the means for filtering discards a first subset of the packets based on the rule and keeps a remaining subset of the packets;
• means for creating a sample of the remaining subset;
• a plurality of means for detecting whether each of a plurality of symptoms exists in the sample;
• and
• means for determining the at least one rule based on the plurality of means for detecting, wherein the plurality of means for detecting and the means for determining execute in a different process from the means for filtering and the means for creating.

A signal-bearing medium encoded with instructions, wherein the instructions when executed comprise:

• filtering packets based on at least one rule, wherein the filtering discards a first subset of the packets based on the rule and keeps a remaining subset of the packets;
• creating a sample of the remaining subset;
• detecting whether each of a plurality of symptoms exists in the sample;
• changing an order of execution of the detecting whether each of the plurality of symptoms exists based on a frequency of each of the plurality of symptoms in the sample;
• and
• determining the at least one rule based on the detecting, wherein the detecting and the determining execute in a different process from the filtering and the creating.

A computer system comprising:

• a processor;
• and
• a network interface comprising
• a plurality of analyzer modules, wherein the plurality of analyzer modules detect a plurality of respective symptoms in packets and create a plurality of respective rules based on the plurality of symptoms,
• a filter module that filters the packets based on the plurality of rules, wherein the plurality of analyzer modules execute offline from the filter module, and
• a sampling module that sends the filtered packets to an application that executes on the processor and that sends a sample of the filtered packets to the plurality of analyzer modules.

A method for configuring a computer, comprising:

• configuring the computer to filter packets based on a rule;
• configuring the computer to analyze the filtered packets for a symptom;
• and
• configuring the computer to create the rule based on the symptom, wherein the filtered packets are analyzed and the rule is created offline from the filtering of the packets.