US 8,055,612 B2 · System and method for aligning data frames in time

A computer system for assembling a comprehensive capture file representing dataframe traffic on a computer network, wherein the computer system includes a memory device for storing electronic data and a computer processor, comprising:

a first capture device, attached to the computer network, to capture a first set of dataframes from the computer network and store the first set of dataframes in a first collection file while selectively keeping a set of overhead data and selectively excluding a set of non-overhead data in the first set of dataframes;
each dataframe of the first set of dataframes including a first frame identifier and a first timestamp;
a second capture device, attached to the computer network, programmed to capture a second set of dataframes from the computer network and store the second set of dataframes in a second collection file;
each dataframe of the second set of dataframes including a second frame identifier and a second timestamp;
the computer processor, in communication with the first collection file and the second collection file and programmed to:
a. chronologically sort the first collection file according to the first timestamp of each dataframe of the first set of dataframes;
b. chronologically sort the second collection file according to the second timestamp of each dataframe of the second set of dataframes;
c. eliminate duplicate dataframes from the first collection of frames so that no dataframes in the first collection file have the same first identifier;
d. eliminate duplicate dataframes from the second collection of frames so that no dataframes in the second collection of frames have the same second identifier;
e. set a flag variable in the memory device to indicate that no duplicate frames have been found;
f. successively select each dataframe of the second collection of frames as a selected dataframe, and compare the second identifier of the selected dataframe to the first identifier of each dataframe in the first collection of frames to determine a if a matched dataframe exists;
g. if a matched dataframe exists, then calculate a time difference between the second timestamp of the selected dataframe and the first timestamp corresponding to the matched dataframe and storing the time difference as a time difference variable in the memory device;
h. discard the selected dataframe;
i. if the flag variable indicates that no duplicate frames have been found, then perform the steps:
i1. for each dataframe in the second collection of frames with a second timestamp preceding the first timestamp of the matched dataframe, alter the second timestamp by the time difference variable;
i2. reset the flag variable to indicate that duplicate frames have been found;
i3. return to step f for a successive dataframe in the second collection of frames;
j. if a matched dataframe does not exist and the flag variable indicates that no duplicate frames have been found, then perform the steps:
j1. move the selected dataframe into the first collection file;
j2. return to step f for a successive dataframe in the second collection of frames;
k. if a matched dataframe does not exist and the flag variable indicates that duplicated frames have been found, then perform the steps:
k1. alter the second timestamp of the selected dataframe in the second collection of frames by the time difference variable;
k2. move the selected dataframe into the first collection of frames;
k3. return to step f for a successive dataframe in the second collection of frames;
l. record the first collection of frames as the comprehensive capture file representing time-synchronized dataframe traffic on the computer network.

22 more elements

A method for merging frames collected by a first capture devices and a second capture device connected to a computer network into a comprehensive capture file comprising:

a. providing an analysis computer connected to the first capture device and the second capture device;
b. collecting frames from the computer network with the first capture device;
c. selectively collecting set of overhead data and selectively excluding a set of non-overhead data in the frames collected from the first capture device;
d. timestamping each frame collected by the first capture device;
e. storing each frame collected by the first capture device in a first capture file;
f. collecting frames from the computer network with a second capture device;
g. timestamping each frame collected by the second capture device;
h. storing each frame collected by the second capture device in a second capture file;
i. uploading the first capture file and the second capture file to the analysis computer;
j. chronologically sorting all frames in the first capture file;
k. chronologically sorting all frames in the second capture file;
l. successively reading each frame with the analysis computer from the second capture file as a chosen frame;
m. comparing the chosen frame from the second capture file to the frames stored in the first capture file with the analysis computer to determine if the frames are duplicate frames;
n. if the chosen frame is a duplicate frame, determining a difference between the timestamps of the duplicate frames, with the analysis computer and setting a numeric variable stored in a memory of the analysis computer equal to the difference and altering all timestamps of the second capture file preceding the timestamp of the chosen frame by the numeric variable;
o. if the chosen frame is not a duplicate frame, altering the timestamp of the chosen frame by the numeric variable with the analysis computer and appending the frame from the second capture file to the first capture file stored in the analysis computer;
p. repeating steps i through l with the analysis computer until all the frames from the second capture file have been read;
q. arranging the frames located in the first capture file in chronological order by the analysis computer to create the comprehensive capture file;
and
r. storing the comprehensive capture file on the analysis computer.

16 more elements

A method for merging data frames collected by a first capture device and a second capture device, both connected to a computer system into a comprehensive capture file, comprising:

a. collecting data frames transmitted across the system by the first capture device and the second capture devices;
b. timestamping each frame collected by the first capture device;
c. timestamping each frame collected by the second capture device;
d. selectively including set of overhead data and selectively excluding a set of non-overhead data in each frame collected by the first capture device;
e. storing each frame collected by the first capture device in a first capture file;
f. arranging the frames in the first capture file in chronological order;
g. storing each frame collected by the second capture device in a second capture file;
h. arranging the frames in the second capture file in chronological order;
i. initializing a temporary database;
j. successively reading each frame from the second capture file as a chosen frame;
k. successively comparing the chosen frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicate frames;
l. if the chosen frame from the second capture file is a duplicate of a frame from the first capture file,
i. determining a difference between the timestamps of the set of duplicate frames;
ii. setting a variable equal to the difference between the timestamps;
iii. determining if the set of duplicate frames are a first set of the duplicate frames;
and
iv. if the set of duplicate frames is the first set of the duplicate frames, adjusting the timestamp of frames stored in the temporary database and appending the frames stored in the temporary database to the first capture file;
m. if the chosen frame from the second capture file is not a duplicate of a frame from the first capture file,
i. determining if the first set of the duplicate frames has been discovered;
ii. if the first set of the duplicate frames has not been discovered;
appending the chosen frame from the second capture file to the temporary database;
and
iii. if the first set of the duplicate frames has been discovered, adjusting the timestamp of the chosen frame from the second capture file by the variable and appending the chosen frame from the second capture file to the first capture file;
and
n. repeating steps j through l until all the frames from the second capture file have been read;
and
o. arranging the frames located in the first capture file in chronological order to create the comprehensive capture file.

24 more elements

A method for merging data frames collected by a first, second and third capture devices, connected to a computer system into a comprehensive capture file comprising:

a. collecting data frames by the first, second, and third capture devices;
b. selectively including a set of overhead data and selectively excluding a set of non-overhead data in each frame collected by the first capture device;
c. timestamping each frame collected by the first capture device;
d. storing each frame collected by the first capture device in a first capture file;
e. timestamping each frame collected by the second capture device;
f. storing each frame collected by the second capture device in a second capture file;
g. timestamping each frame collected by the third capture device;
h. storing each frame collected by the third capture device in a third capture file;
i. successively reading a frame from the second capture file as a first frame;
j. successively comparing the first frame to the frames stored in the first capture file to determine if the first frame is a duplicate of any of the frames;
k. if the first frame is a duplicate, calculating a difference between the timestamps of the duplicate frames and setting a first time-stamp variable equal to the difference;
l. if the first frame is not a duplicate adjusting the timestamp of the first frame by the first time-stamp variable and appending the first frame from the second capture file to the first capture file;
m. repeating steps “h” through “k” until all the frames from the second capture file have been read;
n. successively reading a chosen frame from the third capture file as a second frame;
o. successively comparing the second frame from the third capture file to the frames in the first capture file to determine if the second frame is a duplicate of any of the frames;
p. if the second frame is a duplicate, determining a difference between the timestamps of the duplicate frames and setting a second time-stamp variable equal to the difference;
q. if the second frame from the third capture file is not a duplicate, adjusting the timestamp of the second frame from the third capture file by the second variable and appending the frame from the third capture file to the first capture file;
r. repeating steps “m” through “p” until all the frames from the third capture file have been read;
and
s. arranging the frames located in the first capture file in chronological order to create the comprehensive capture file.

17 more elements

An apparatus for analyzing the performance of a computer system, wherein two or more capture devices are in communication with the computer system and wherein the two or more capture devices collect data which consists of frames from the computer system, and wherein the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising:

a computer for uploading the data collected by the capture devices, programmed to execute the following steps:
a. store each frame collected by a first capture device in a first capture file;
b. store each frame collected by a second capture device in a second capture file;
c. selectively include a set of overhead data and selectively exclude a set of non-overhead data in each frame collected by the first capture device,
d. successively read a chosen frame from the second capture file;
e. successively compare the chosen frame from the second capture file to the frames stored in the first capture file to determine if the chosen frame is a duplicate of any of the frames;
f. if the chosen frame is a duplicate frame, determine a difference between the timestamps of the duplicate frames, set a time-stamp variable equal to the difference;
g. if the chosen frame is not a duplicate, adjust the timestamp of the chosen frame by the variable and append the frame from the second capture file to the first capture file;
h. repeat steps “c” through “f” until all the frames from the second capture file have been read;
i. arrange the frames located in the first capture file in chronological order to create a comprehensive capture file;
and;
j. using the comprehensive capture file to analyze the performance of the computer system.

9 more elements

An apparatus for analyzing the performance of a system, wherein two or more capture devices are in communication with the system, wherein the two or more capture devices collect data which consists of collected frames from the system and the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising a computer for uploading the data collected by the capture devices wherein the computer is programmed to execute the following steps:

a. store each frame collected by a first capture device in a first capture file;
b. arrange the first frames in the first capture file in chronological order;
c. selectively include set of overhead data and selectively exclude a set of non-overhead data in each frame collected by the first capture device;
d. store each frame collected by a second capture device in a second capture file;
e. arrange the second frames in the second capture file in chronological order;
f. successively read a frame from the second capture file as a selected frame;
g. compare the selected frame from the second capture file to the frames stored in the first capture file to determine if the selected frame is a duplicate of any the frames are a set of duplicates;
h. if the selected frame from the second capture file is a duplicate of a frame from the first capture file,
i. calculate a time difference between the timestamps of the duplicates;
ii. set a numeric variable equal to the time difference;
and
iii. determine if the set of duplicate frames are the first set of duplicate frames, and;
iv. if the set of duplicate frames is the first set of duplicate frames, alter the timestamp of frames in a temporary database and appending the frames in the temporary database by the numeric variable to the first capture file;
i. if the selected frame from the second capture file is not a duplicate of a frame from the first capture file,
i. determine if the first set of duplicate frames has been discovered;
ii. if the first set of duplicate frames has not been discovered, append the selected frame from the second capture file to a temporary database;
iii. if the first set of duplicate frames has been discovered, alter the timestamp of the selected frame from the second capture file by the numeric variable and append the selected frame from the second capture file to the first capture file;
j. repeat steps “e” through “h” until all the frames from the second capture file have been read;
and
k. arrange the frames located in the first capture file in chronological order to create a comprehensive capture file.

17 more elements

An apparatus for analyzing the performance of a system, wherein two or more capture devices in communication with the system, wherein the two or more capture devices collect data which consists of frames from the system and the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising:

a computer for uploading the data collected by the capture devices programmed to execute the following steps;
a. store each frame collected by a first capture device in a first capture file;
b. store each frame collected by a second capture device in a second capture file;
c. store each frame collected by a third capture device in a third capture file;
d. selectively include a set of overhead data and selectively exclude a set of non-overhead data in each frame collected by the first capture device;
e. successively read a frame from the second capture file as a first frame;
f. successively compare the first frame to the frames stored in the first capture file to determine if the first frame is a duplicate of any the frames are a set of duplicates;
g. if the first frame is a duplicate of a frame from the first capture file, calculate a difference between the timestamps of the set of duplicates and set a first numeric variable equal to the difference;
h. if the first frame is not a duplicate of a frame from the first capture file, change the timestamp of the first frame by the first numeric variable and add the first frame to the first capture file;
i. repeat steps “d” through “g” until all the frames from the second capture file have been read;
j. successively read a frame from the third capture file as a second frame;
k. compare the second frame the frames in the first capture file to determine if the second frame is a duplicate of any the frames are duplicates;
l. if the second frame is a duplicate of a frame from the first capture file, determine a difference between the timestamps of the duplicate frames and setting a second numeric variable equal to the difference;
m. if the second frame is not a duplicate of a frame from the first capture file, adjust the timestamp of the second frame by the second numeric variable and add the second frame to the first capture file;
n. repeat step “i” through “l” until all the frames from the third capture file have been read;
and
o. arrange the frames located in the first capture file in chronological order to create a comprehensive capture file.

14 more elements

System and method for aligning data frames in time

Life of this patent

System and method for aligning data frames in time

Life of this patent

Abstract

Claims22