Method for time aware inline remote mirroring

A method of monitoring traffic packets passing through a first access point, comprising:

• at a mediator, receiving a request for providing to a remote device portions of the traffic packets passing through the first access point captured at the first access point;
• registering the mediator so as to receive the portions of the traffic packets captured at the first access point;
• at the mediator,
• (i) receiving encapsulated packets from a network,
• (ii) extracting timestamps from the encapsulated packets,
• (iii) decapsulating the encapsulated packets so as to obtain the portions of the traffic packets captured at the first access point, and
• (iv) forming replay packets, wherein the replay packets include the portions of the traffic packets;
• and,
• transmitting the replay packets from the mediator to the remote device, wherein the replay packets are separated by time intervals so as to imitate the traffic packets passing through the first access point, and wherein the time intervals are reproduced using the timestamps.

A packet traffic monitoring system comprising:

• a first probe for coupling with a first access point and programmed to capture portions of traffic packets passing therethrough separated by time intervals, and for encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals, and for transmitting the encapsulated packets over a network;
• and,
• a mediator suitably programmed to:
• receive a request for providing to a remote device the portions of the traffic packets passing through the first access point captured at the first access point;
• register so as to receive the portions of the traffic packets captured at the first access point;
• receive the encapsulated packets from the network,
• decapsulate the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets;
• and,
• transmit the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point.