Packet structure for mirrored traffic flow

A network device comprising a mirroring module that intercepts packets of a network flow associated with a network user, and forwards routable packets that contain the intercepted packets through a network to an analyzer,

• wherein the mirroring module forms each of the routable packets to include a header that comprises:
• an interception identifier field that identifies the network user;
• and
• an account session field that identifies an interface of the network device from which the packets were intercepted, wherein the account session field comprises a session unique portion of an account session identification integer.

A network device comprising:

• a mirroring module that intercepts packets of a network flow associated with a network user, and forms routable packets that contain the intercepted packets,
• wherein the mirroring module forms each of the routable packets to include a header that comprises:
• a destination field that identifies a network address associated with an analyzer;
• an interception identifier field that identifies the network user;
• a version field that includes analyzer-specific information;
• and
• an account session field that identifies an interface of the network device from which the packets were intercepted, wherein the account session field comprises a session unique portion of an account session identification integer.

A non-transitory computer readable medium comprising a packet generated by a network device from a network flow associated with a network user, wherein the packet comprises:

• a destination field that directs a router to forward the packet to an analyzer;
• an interception identifier field that identifies the network user;
• a version field that controls analysis of the packet by the analyzer;
• and
• an account session field that identifies an interface of the network device from which the packets were intercepted, wherein the account session field comprises a session unique portion of an account session identification integer.

A non-transitory computer-readable medium comprising instructions to cause a programmable processor to:

• intercept packets of a network flow associated with a network user;
• form routable packets that contain the intercepted packets;
• embed user information within the routable packets that identifies the network user;
• embed information within the routable packets that identifies an interface of an intercept device used to intercept the packets associated with the network user, wherein the information comprises session information unique to a session associated with the network user;
• and
• forward the routable packets through a network to an analyzer.