Fast packet retrieval based on flow id and metadata

A method for retrieving captured network traffic data in a high capacity network, the method comprising:

• receiving packet search criteria, the packet search criteria specifying at least a first time range;
• retrieving data flow information associated with the packet search criteria from a fourth data repository, wherein the retrieved data flow information is associated with a second time range, wherein the second time range is narrower than the first time range, and wherein the fourth data repository is configured to store data flow information associated with captured raw data packets stored in a first data repository;
• retrieving metadata information associated with the second time range from a second data repository using corresponding timestamp indexed data stored in a third data repository, wherein the second data repository is configured to store metadata associated with the raw data packets stored in the first data repository and wherein the third data repository is configured to store timestamp indexed data associated with the raw data packets stored in the first data repository and configured to store timestamp indexed data associated with the metadata stored in the second data repository;
• and
• retrieving raw captured data packets associated with the retrieved metadata from the first data repository using corresponding timestamp indexed data stored in the third data repository.

A computer program product for retrieving captured network traffic data in a high capacity network, the computer program product comprising:

• one or more computer-readable storage devices and a plurality of program instructions stored on at least one of the one or more computer-readable storage devices, the plurality of program instructions comprising:
• program instructions to receive packet search criteria, the packet search criteria specifying at least a first time range;
• program instructions to retrieve data flow information associated with the packet search criteria from a fourth data repository, wherein the retrieved data flow information is associated with a second time range, wherein the second time range is narrower than the first time range, and wherein the fourth data repository is configured to store data flow information associated with captured raw data packets stored in a first data repository;
• program instructions to retrieve metadata information associated with the second time range from a second data repository using corresponding timestamp indexed data stored in a third data repository, wherein the second data repository is configured to store metadata associated with the raw data packets stored in the first data repository and wherein the third data repository is configured to store timestamp indexed data associated with the raw data packets stored in the first data repository and configured to store timestamp indexed data associated with the metadata stored in the second data repository;
• and
• program instructions to retrieve raw captured data packets associated with the retrieved metadata from the first data repository using corresponding timestamp indexed data stored in the third data repository.