System and method for correlating request and reply packets
AssigneeNetwork General Technology
InventorsDavid C. Petersen, Vladimir A. Sukhanov
Life of this patent
Estimating the term…
Abstract
A system, method and computer program product are provided for correlating request packets and reply packets during network analysis. Initially, first information is monitored associated with at least one layer of a request packet that resides above a data link control layer thereof. Further monitored is second information associated with at least one layer of a reply packet that resides above the data link control layer thereof. The request packet and the reply packet are then correlated utilizing the first information and the second information. A network is then analyzed based on the correlated request packet and reply packet.
Claims7
A method for correlating request packets and reply packets during network analysis, comprising:
- (a) reading a packet from a capture file;
- (b) identifying a key associated with at least one layer of the packet that resides above a data link control layer;
- (c) determining whether the packet is a request packet or a reply packet;
- (d) if the packet includes a request packet:
- (i) storing data associated with the request packet in a hash table utilizing the key as an index into the hash table, and
- (ii) decoding the request packet;
- (e) if the packet includes a reply packet;
- (i) determining whether the reply packet includes the key,
- (ii) if the reply packet includes the key, retrieving the data associated with the request packet from the hash table utilizing the key,
- (iii) correlating the reply packet with the request packet associated with the data, and
- (iv) decoding the reply packet;
- (f) determining whether another packet exists in the capture file;
- and
- (g) repeating (a)–(f) if it is determined that another packet exists in the capture file.
A computer-implemented method for correlating request packets and reply packets during network analysis, comprising:
- (a) identifying a key associated with at least one layer of a packet that resides above a data link control layer;
- (b) responsive to the packet including a request packet:
- (i) storing data associated with the request packet utilizing the key as an index corresponding to the stored data, and
- (ii) decoding the request packet;
- and
- (c) responsive to the packet including a reply packet:
- (i) if the reply packet includes the key, retrieving the data associated with the request packet utilizing the key as the index corresponding to the data,
- (ii) correlating the reply packet with the request packet associated with the data, and
- (iii) decoding the reply packet using at least in part the retrieved data associated with the request packet.
Dependencies are inferred from the claim text.