Packet capture ring: reliable, scalable packet capture for security applications

A system for packet capture and search, the system comprising:

• a plurality of appliances arranged in a ring configuration, wherein each appliance is associated with a repository and an index, and wherein each appliance includes a plurality of network interfaces;
• and
• a network tap appliance comprising a processor and configured to receive packets from a network via a network tap, the network tap appliance further configured to:
• broadcast a control protocol (CP) message to the plurality of appliances in the ring;
• obtain a current capacity of a first repository in response to the broadcasted CP message;
• alter a packet request from the first repository in response to the current capacity of the first repository being equal to or approaching within a predetermined amount capacity limit;
• and
• designate a next repository as an active repository on the active packet forwarding designation list.

A computer implemented method for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network;

• wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index;
• and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages, the method comprising:
• obtaining, by a network tap appliance comprising a processor and configured to initially receive the network packet traffic via a network tap, a current capacity of the repositories of the appliances of the ring;
• and
• altering, by the network tap appliance, a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit.

A computer program product for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network;

• wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index;
• and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages;
• the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor that is part of a network tap appliance to cause the processor to:
• obtain a current capacity of the repositories of the appliances of the ring;
• and
• alter a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit.

A system for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, the system comprising:

• a plurality of appliances, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network;
• wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index;
• and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages;
• and
• a network tap appliance comprising a processor configured to:
• obtain a current capacity of the repositories of the appliances of the ring;
• and
• alter a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit.