Network data collection method and apparatus

A method of collecting network data from a computer network at a remote node having a processor, and operating system, a network protocol module for communicating on the network in accordance with predefined protocol, a management information base arranged in accordance with the protocol and having tables for storing the collected data and having corresponding functions for each table, including a periodic update function, and a network data engine, the method comprising the step of:

• (a) the network protocol module providing a description of the management information base to the network data engine, including providing a description of the tables and providing a pointer to the corresponding periodic update function;
• (b) the network data engine receiving the description and constructing therefrom a control structure for each table;
• (c) after step (b), the network protocol module monitoring the network and receiving all packets passing therethrough;
• (d) upon receiving a packet, the network protocol module passing the packet to the network data engine;
• (e) the network data engine processing the packet in accordance with the control structure for each table;
• (f) at predetermined intervals, the network data engine calling the periodic update function for each table to update the table in accordance therewith;
• and
• (g) the network protocol module providing an array of rank descriptors, cash rank descriptor pointing to a rank, a rank being a table of indices sorted by a corresponding key, and wherein step (f) updates the table via a rank.

A method for collecting network data from a computerized network, the method comprising the steps of:

• (a) creating, for a plurality of groups of data intended to be collected from the network, a respectively corresponding plurality of control structures;
• (b) associating the plurality of control structures with a respectively corresponding plurality of tables, the plurality of tables being adapted to store the plurality of groups of data;
• and
• (c) storing, for each one of the plurality of control structures, in an associated one of the plurality of tables, a respectively corresponding one of the plurality of groups of data based on a network packet received from the computerized network,
• wherein a first set of control structures of the plurality of control structures is associated with a first management information base defining a first set of groups of data of the plurality of groups of data, and wherein step (c) includes a step of:
• calling, for each one of the first set of control structures, functions of the first management information base to update a first set of tables of the plurality of tables,
• and wherein a second set of control structures of the plurality of control structures is associated with a second management information base defining a second set of groups of data different from the first set of groups of data, and wherein step (c) further includes a step of:
• calling, for each one of the second set of control structures, functions of the second management information base to update a second set of tables of the plurality of tables,
• and wherein the functions include a first extract function and a first update function, wherein the first set of tables includes a first table, and wherein the step of calling includes a step of:
• invoking the first extract function to extract a first key from the network packet, and the first update function to update the first table according to the first key,
• and wherein the functions further include a second extract function and a second update function, wherein the first set of tables further includes a second table, and wherein the step of calling further includes a step of:
• invoking the second extract function to extract a second key from the network packet, and the second update function to update the second table according to the second key.

A system for collecting network data from a plurality of groups of data in a computer network through which network packets flow, comprising:

• a plurality of control structures, each control structure corresponding to a group of data from the plurality of groups of data;
• and
• a plurality of tables associated with the plurality of control structures, the plurality of tables being adapted to store the plurality of groups of data;
• wherein for each one of the plurality of control structures a respectively corresponding one of the plurality of groups of data based on the network packet received from the computerized network is stored in an associated one of the plurality of tables, and
• wherein a first set of control structures of the plurality of control structures is associated with a first management information base defining a first set of groups of data of the plurality of groups of data, and wherein for each one of the first set of control structures, functions of the first management information base are called to update a first set of tables of the plurality of tables, and
• wherein a second set of control structures of the plurality of control structures is associated with a second management information base defining a second set of groups of data different from the first set of groups of data, and wherein for each one of the second set of control structures, functions of the second management information base are called to update a second set of tables of the plurality of tables, and
• wherein the functions of the first management information base include a first extract function and a first update function, wherein the first set of tables includes a first table, and wherein function calling includes invoking the first extract function to extract a first key from the network packet, and the first update function to update the first table according to the first key, and
• wherein the functions of the second management information base include a second extract function and a second update function, wherein the first set of tables further includes a second table, and wherein calling further includes invoking the second extract function to extract a second key from the network packet, and the second update function to update the second table according to the second key.