Real-time hierarchical protocol decoding

A method of analyzing communication protocol data, comprising:

• receiving a first packet associated with an operation associated with a first hierarchical level of operations associated with a target device that is being monitored, wherein the first hierarchical level of operations is one of a plurality of hierarchical levels of operations;
• receiving one or more packets generated by a hardware analyzer configured to observe device communication protocol traffic associated with the target device, wherein at least one of the one or more packets generated by the hardware analyzer comprises a “no activity” packet that the hardware analyzer is configured to generate and provide as output if the hardware analyzer determines that no activity has been seen on a monitored communication stream within a prescribed time;
• and
• determining that the operation associated with the first hierarchical level of operations has timed out in the event that the at least one of the one or more packets generated by the hardware analyzer are received after the first packet is received but before a subsequent second packet associated with the operation associated with the first hierarchical level of operations is received.

An analysis system, comprising:

• a communication interface configured to receive an analysis stream associated with a target device;
• and
• a processor coupled to the communication interface and configured to:
• receive via the communication interface a first packet associated with an operation associated with a first hierarchical level of operations associated with the target device, wherein the first hierarchical level of operations is one of a plurality of hierarchical levels of operations;
• receive via the communication interface one or more packets generated by a hardware analyzer, wherein at least one of the one or more packets generated by the hardware analyzer comprises a “no activity” packet that the hardware analyzer is configured to generate and provide as output if the hardware analyzer determines that no activity has been seen on a monitored communication stream within a prescribed time;
• and
• determine that the operation associated with the first hierarchical level of operations has timed out in the event that the at least one of the one or more packets generated by the hardware analyzer are received after the first packet is received but before a subsequent second packet associated with the operation associated with the first hierarchical level of operations is received.

A computer program product for analyzing target device communication protocol data, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a first packet associated with an operation associated with a first hierarchical level of operations associated with a target device that is being monitored, wherein the first hierarchical level of operations is one of a plurality of hierarchical levels of operations;
• receiving one or more packets generated by a hardware analyzer, wherein at least one of the one or more packets generated by the hardware analyzer comprises a “no activity” packet that the hardware analyzer is configured to generate and provide as output if the hardware analyzer determines that no activity has been seen on a monitored communication stream within a prescribed time;
• and
• determining that the operation associated with a first hierarchical level of operations associated with the target device has timed out in the event that the at least one of the one or more packets generated by the hardware analyzer are received after the first packet is received but before a subsequent second packet associated with the operation associated with a first hierarchical level of operations associated with the target device is received.