A computer-implemented method of monitoring logical connections in a computer network, the computer network including a first multiplicity of stations, during a connection a pair of stations exchanging packets via the computer network, each packet including protocol control information and user data, the protocol control information including datalink layer information, network layer information, transport layer information, and a total number of bytes of user data associated with the packet, the datalink layer information including a source station identifier, a destination station identifier, and a network protocol identifier, the network layer information including a source network entity identifier and a destination entity identifier, and a type field, each packet including one of connection id and a pair of transport entity identifiers, the computer network including a connection record database having a second multiplicity of records, each record including identifiers for a pair of stations associated with an existing logical connection, one of a connection id and a pair of transport entity identifiers, a start of activity timestamp, a last activity timestamp, and a total number of bytes transferred during the logical connection, the method comprising the computer-implemented steps of:
- a) determining whether a packet is part of a logical connection upon receipt of the packet;
- b) ignoring the packet if it is not part of a logical connection;
- c) searching the connection record database for a third multiplicity of records identifying a pair of stations matching the source station identifier and the destination station identifier;
- d) creating a new record for the packet if no record is found with a pair of station identifiers matching the source station identifier and the destination station identifier of the packet;
- e) searching the third multiplicity of records for a first set of records including a pair of network entity identifiers matching the source and destination network entity identifiers of the packet;
- f) creating a new record for the packet if no record is found including a pair of network entity identifiers matching the source and destination network entity identifiers of the packet;
- g) determining whether the packet uses a Novell protocol by examining the type field of the network layer information of the packet;
- h) if the packet uses the Novell protocol:
- 1) searching the first set of records for a selected record, the selected record including a connection id matching the connection id of the packet,;
- 2) creating a new record for the packet if no record is found including a connection id matching the connection id of the packet;
- i) if the packet does not use the Novell protocol:
- 1) searching the first set of records for a selected record, the selected record including a pair of transport entity identifiers matching a source and destination transport entity identifiers of the packet;
- 2) creating a new record for the packet if no record is found including a pair of transport entity identifiers matching the source and destination transport entity identifiers of the packet;
- and
- j) updating the selected record by changing the last activity timestamp of the selected record to a value representative of a current time and updating the total number of bytes of user data transferred during the connection by the number of bytes of user data associated with the packet.