Packet file system
AssigneeIntrusion Inc.
InventorsDaris A. Nevil, Uma Gavani
Life of this patent
Estimating the term…
Abstract
A system and method of recording packets and packet streams to random-access block-oriented recording media, and retrieving the packets and packet streams from said recording media is disclosed. Incoming packets are copied into very large fixed sized blocks, which in turn are distributed to a plurality of disk drives for recording. Supplementary blocks of index data constructed as packets are received and recorded. The index data reduces the time required to locate and read specific packets and packet streams from the recording media. Recorded packets are retrieved and converted to standard pcap format files.
Claims27
A system for network packet recording and retrieval comprising:
- a packet collector operable to receive and concatenate a plurality of data packets and data packet streams into fixed sized blocks from a monitored network;
- a storage manager operable to write the blocks to and read the blocks from at least one non-volatile storage device;
- and
- a packet retriever operable to locate at least one of the data packets and data packet streams in the at least one storage device and subsequently read the located packets from the at least one storage device into memory.
A method for network packet recording and retrieval comprising:
- receiving and concatenating data packets and data packet streams into fixed sized blocks from a monitored network;
- writing the fixed-sized blocks to and reading the blocks from at least one storage device;
- and
- locating specific data packets and packet streams in the at least one storage device and subsequently reading the located packets from the at least one storage device into memory.
A system for network packet recording and retrieval comprising:
- at least one processor operable to execute computer program instructions;
- at least one memory operable to store computer program instructions executable by the processor;
- and
- computer program instructions stored in the at least one memory and executable to perform the steps of:
- receiving and concatenating data packets and data packet streams into fixed sized blocks from a monitored network;
- writing the fixed-sized blocks to and reading the blocks from at least one storage device;
- and
- locating specific data packets and packet streams in the at least one storage device and subsequently reading the located packets from the at least one storage device into memory.
Dependencies are inferred from the claim text.