Systems and methods of network monitoring

A network monitor device comprising:

• a network interface;
• memory having program code stored thereon;
• and
• a processor programmed by at least the program code to enable the network monitor device to:
• receive a first packet from the network interface;
• create a filter instance if the first received packet matches a filter template, the filter instance based at least partially on the filter template;
• receive a description of the filter template including at least one protocol header field and at least one value associated with the at least one protocol header field;
• receive a second packet from the network interface;
• and
• store the second received packet if the second received packet matches the created filter instance.

A system for network monitoring comprising:

• means for receiving a first packet;
• means for creating a filter instance if the first received packet matches a filter template, the filter instance based at least partially on the filter template;
• means for receiving a second packet;
• means for storing the second received packet if the second received packet matches the created filter instance;
• means for receiving a monitor request from a remote device, the request including a filter instance and an address;
• means for capturing packets in accordance with the filter instance;
• and
• means for sending a report associated with the captured packets to the address in the request.