Back to results
US 8,264,976 B2Granted
Network monitoring based on pointer information
AssigneeMcAfee, Inc.
InventorStephen Robinson
Life of this patent
Estimating the term…
Abstract
A computer system and method for identifying and extracting content from data traffic, the system including: a capture driver arranged to monitor data traffic and to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet; a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols; and a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application.
Claims34
A computer system for identifying and extracting content from data traffic, the system comprising:
- a memory;
- one or more network adapters;
- and
- a processing device communicatively coupled to the memory and configured to execute program code stored in the memory, the program code comprising:
- a capture driver arranged to interface with the one or more network adapters, to monitor data traffic, to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet;
- a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols;
- and
- a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application, wherein the control interface is adapted systematically to send pointer information relating to the captured data packet to decoder modules in turn until either a module accepts the data or until there are no more modules to try, wherein each module is adapted to communicate with the control interface to notify it to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module notifies the control interface that it no longer wishes to receive packets on the stream, the control interface notifies a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.
5 more elements
A method for analyzing computer network traffic, the method comprising the steps of:
- (a) capturing a raw data packet from a network;
- (b) examining the lowest layer of the data packet to identify its protocol;
- (c) selecting one of a plurality of protocol modules which is adapted to decode said identified protocol;
- (d) sending data relating to said data packet to said selected module;
- (e) receiving data from said selected module after said protocol has been decoded, and examining the next lowest protocol;
- (f) repeating steps (c) to (e) until there are no more modules to decode the data or until there are no more layers in the packet;
- and
- (g) generating a notification, by a first module, to continue to send packets on a specific stream or to discontinue sending packets on the stream, and, if the first module generates a notification that it is no longer to receive packets on the stream, notifying a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.
5 more elements
A method for identifying and extracting content from data traffic, the method comprising:
- monitoring data traffic and copying data packets from the traffic to a buffer without disrupting the traffic flow, and generating pointer information to identify specific parts of a data packet;
- systematically routing the pointer information to one or more of a plurality of decoder modules in turn until either a module accepts the data or until there are no more modules to try, each module being adapted to decode one or more specific data transfer protocols in the data packet;
- and
- routing extracted content from the data traffic to a computer application, wherein each module is adapted to generate a notification to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module generates a notification that it no longer wishes to receive packets on the stream, a second module processing a lower protocol layer is notified so the second module can stop processing the lower protocol layer.
1 more element
A computer system for identifying and extracting content from data traffic, the system comprising:
- a memory;
- one or more network adapters;
- and
- a processing device communicatively coupled to the memory and configured to execute program code stored in the memory, the program code comprising:
- a capture driver arranged to monitor data traffic and to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet;
- a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols;
- and
- a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application, wherein each module is adapted to communicate with the control interface to notify it to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module notifies the control interface that it no longer wishes to receive packets on the stream, the control interface notifies a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.
5 more elements
Dependencies are inferred from the claim text.