# US 2018/0324107 A1 · Packet capture ring: reliable, scalable packet capture for security applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324107 A1 - Document ID: US20180324107A1 - Status: Published application - Kind: A1 - Application number: 16/018,973 - Filed: 2018-06-26 - Published: 2018-11-08 - Earliest claimed: 2016-08-01 - Assignees: International Business Machines Corporation; Napatech A/S - Applicants: International Business Machines Corporation; Napatech A/S - Inventors: William A. Bird; Russell Couturier; Thomas D. Silliman; Wayne Tackabury; Alex Omo Agerholm; Michael Milde Lilja; Peter Dahl Ekner; Philip Due Soeberg - Web page: https://patentgrep.com/patent/US20180324107A1 ## CPC - H04L 47/762: triggered by the network - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/0882: Utilisation of link capacity - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 47/34: ensuring sequence integrity, e.g. using sequence numbers - H04L 47/78: Architectures of resource allocation - H04L 49/9084: {Reactions to storage capacity overflow} - H04L 69/24: Negotiation of communication capabilities - H04L 45/28: using route fault recovery - H04L 2012/421: {Interconnected ring systems} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments are directed to a packet capture ring that provides a single network tap for packet capture and a series of processors (or appliances) for handling serialization and search request processing in a confederated and highly scalable manner. One such appliance (a “primary” appliance) maintains a tap port to the network. Each packet capture appliance has a locally attached repository that stores raw packets and a juxtaposed index that allows for retrieval of those packets. The primary appliance sends a single copy of encapsulated packets in opposite directions around the ring to its descendants. A designation is made across the system as to a “currently designated” appliance for servicing requests for indexing and storage of captured packets. This current designation shifts from appliance to appliance in the system, as a “previously designated” appliance has its storage capacity filled. ## Claims ### Claim 1 A computer implemented method comprising: broadcasting, by a network tap appliance comprising a processor and configured to receive packets, a control protocol (CP) message to a plurality of appliances in a ring, the network tap appliance included in the plurality of appliances, wherein each appliance is associated with a repository and an index, and wherein each appliance includes a plurality of network interfaces; obtaining, by the network tap appliance, a current capacity of a first repository in response to the broadcasted CP message; and altering, by the network tap appliance, a packet request from the first repository in response to the current capacity being equal to or approaching within a predetermined amount capacity limit. ### Claim 2 (depends on 1) The method of claim 1, further comprising: designating, by the network tap appliance, a next repository as an active repository on the active packet forwarding designation list. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sending, by the network tap appliance, an encapsulation of the packets in opposite directions around the ring to descendant appliances such that each of the descendant appliances receives two copies of the encapsulation. ### Claim 4 (depends on 3) The method of claim 3, wherein the encapsulation comprises a timestamp as observed and marked by the network tap appliance and a forward header that designates an active appliance. ### Claim 5 (depends on 4) The method of claim 4, further comprising: ignoring, by the descendant appliances, a later-arriving of the two copies of the encapsulation. ### Claim 6 A system for packet capture and search, the system comprising: a plurality of appliances arranged in a ring configuration, wherein each appliance is associated with a repository and an index, and wherein each appliance includes a plurality of network interfaces; and a network tap appliance comprising a processor and configured to receive packets from a network via a network tap, the network tap appliance further configured to: broadcast a control protocol (CP) message to the plurality of appliances in the ring; obtain a current capacity of a first repository in response to the broadcasted CP message; alter a packet request from the first repository in response to the current capacity of the first repository being equal to or approaching within a predetermined amount capacity limit; and designate a next repository as an active repository on the active packet forwarding designation list. ### Claim 7 (depends on 6) The system of claim 6, wherein the network tap appliance is further configured to: send an encapsulation of the packets in opposite directions around the ring to descendant appliances such that two copies of the encapsulation are received by each descendant appliance. ### Claim 8 (depends on 7) The system of claim 7, wherein the encapsulation comprises a timestamp as observed and marked by the network tap appliance and a forward header that designates an active appliance. ### Claim 9 (depends on 6) The system of claim 6, wherein the descendant appliances are further configured to: ignore a later arriving encapsulation of the two copies. ### Claim 10 A computer implemented method for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network; wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index; and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages, the method comprising: obtaining, by a network tap appliance comprising a processor and configured to initially receive the network packet traffic via a network tap, a current capacity of the repositories of the appliances of the ring; and altering, by the network tap appliance, a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit. ### Claim 11 (depends on 10) The method of claim 10, further comprising: breaking, by the network tap appliance, a link between the network tap appliance and a last appliance of the ring; linking, by the network tap appliance, a new appliance with the network tap appliance and the last appliance between respective ones of the plurality of network interfaces; and inserting, by the network tap appliance, a respective forwarding designation of the new appliance into the active packet forwarding designation list. ### Claim 12 (depends on 10) The method of claim 10, further comprising: transmitting, by the network tap appliance, a CP search message to the appliances of the ring; receiving, by the network tap appliance, relevant results from one or more of the appliances of the ring for a respective window of time retained by a respective one of the one or more of the appliances; and merging, by the network tap appliance, the received relevant results by concatenating each of the relevant results. ### Claim 13 (depends on 10) The method of claim 10, further comprising: sending, by the network tap appliance, an encapsulation of the packets in opposite directions around the ring to descendant appliances such that each of the descendant appliances receives two copies of the encapsulation; and performing, by each of the descendant appliances, a de-duplication process to remove a later-arriving of the two copies of the encapsulation. ### Claim 14 A computer program product for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network; wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index; and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages; the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor that is part of a network tap appliance to cause the processor to: obtain a current capacity of the repositories of the appliances of the ring; and alter a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the program instructions further cause the processor to: break a link between the network tap appliance and a last appliance of the ring; link a new appliance with the network tap appliance and the last appliance between respective ones of the plurality of network interfaces; and insert a respective forwarding designation of the new appliance into the active packet forwarding designation list. ### Claim 16 (depends on 14) The computer program product of claim 14, wherein the program instructions further cause the processor to: transmit a CP search message to the appliances of the ring; receive relevant results from one or more of the appliances of the ring for a respective window of time retained by a respective one of the one or more of the appliances; and merge the received relevant results by concatenating each of the relevant results. ### Claim 17 (depends on 14) The computer program product of claim 14, wherein the program instructions further cause the processor to: send an encapsulation of the packets in opposite directions around the ring to descendant appliances such that each of the descendant appliances receives two copies of the encapsulation; and perform a de-duplication process to remove a later-arriving of the two copies of the encapsulation. ### Claim 18 A system for transmission of messages of a control protocol (CP) to established protocol peer appliances in a ring, the system comprising: a plurality of appliances, wherein each appliance is configured to listen for and process network packet traffic transmitted on a primary network, such that the traffic is destined for any listening interface on the network; wherein each appliance in the ring is associated with a storage repository for captured packet traffic and is associated with an index; and wherein each appliance includes a plurality of network interfaces used in execution of the capture processing along with processing of the CP messages; and a network tap appliance comprising a processor configured to: obtain a current capacity of the repositories of the appliances of the ring; and alter a packet storage request from an initially designated repository in response to an initially designated current capacity based on the current capacity of the initially designated repository being equal to or approaching within a predetermined amount capacity limit. ### Claim 19 (depends on 18) The system of claim 18, wherein the processor is further configured to: break a link between the network tap appliance and a last appliance of the ring; link a new appliance with the network tap appliance and the last appliance between respective ones of the plurality of network interfaces; and insert a respective forwarding designation of the new appliance into the active packet forwarding designation list. ### Claim 20 (depends on 18) The system of claim 18, wherein the processor is further configured to: transmit a CP search message to the appliances of the ring; receive relevant results from one or more of the appliances of the ring for a respective window of time retained by a respective one of the one or more of the appliances; and merge the received relevant results by concatenating each of the relevant results.