Packet sniffer

A system for sniffing packets communicated over a network comprising:

• at least one processor operable to execute an identifying unit for examining state information stored in at least one main storage control block of an operating system to identify an active protocol stack within a plurality of protocol stacks on the network, the active protocol stack actively being used to communicate a packet over the network, the identifying unit further operable to identify at least one attribute of the active protocol stack, the at least one attribute identifying one of a plurality of protocol stack configurations present on the network and distinguishing the active protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• the at least one processor operable to execute an enabling unit for enabling a packet intercept for the identified active protocol stack based on the identified protocol stack configuration;
• the at least one processor operable to execute a collecting unit for collecting data about said packets communicated over said network using said packet intercept;
• wherein the enabling unit:
• uses an operating system exit to detect the termination of the active protocol stack when the communication of packets across the active protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• in response to detecting that the active protocol stack is no longer in a state where it is capable of communicating packets over the network, removing the packet intercept from the active protocol stack.

A computer system comprising:

• a processor;
• and
• a program storage device readable by the processor, embodying a program of computer executable code for sniffing packets communicated over a network, the code comprising:
• code for examining state information stored in at least one main storage control block of an operating system to identify an active protocol stack protocol stack within a plurality of protocol stacks on the network, the active protocol stack actively being used to communicate a packet over the network;
• code for analyzing the protocol stack to identify at least one attribute of the protocol stack, the at least one attribute identifying one of a plurality of protocol stack configurations present on the network and distinguishing the active protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• code for enabling a packet intercept for the identified active protocol stack based on the identified protocol stack configuration;
• code for collecting data about said packets communicated over said network using said packet intercept;
• code for using an operating system exit to detect the termination of the active protocol stack when the communication of packets across the active protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• code for removing the packet intercept from the active protocol stack in response to detecting that the active protocol stack is no longer in a state where it is capable of communicating packets over the network.

A non-transitory computer recording medium including computer executable code for sniffing packets communicated over a network, comprising:

• code for examining state information stored in at least one main storage control block of an operating system to identify an active protocol stack within a plurality of protocol stacks on the network, the active protocol stack actively being used to communicate a packet through the network;
• code for analyzing the protocol stack to identify at least one attribute of the protocol stack, the at least one attribute identifying one of a plurality of protocol stack configurations present on the network and distinguishing the active protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• code for enabling a packet intercept for the identified active protocol stack based on the protocol stack configuration;
• code for collecting data about said packets communicated over said network using said packet intercept;
• code for using an operating system exit to detect the termination of the active protocol stack when the communication of packets across the active protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• code for removing the packet intercept from the active protocol stack in response to detecting that the active protocol stack is no longer in a state where it is capable of communicating packets over the network.

A method for sniffing packets communicated over a network, the method comprising:

• examining state information to examine state information stored in at least one main storage control block of an operating system to identify an active TCP/IP protocol stack, the active TCP/IP protocol stack within a plurality of protocol stacks on the network, the active protocol stack in a state actively communicating data;
• analyzing the protocol stack to identify at least one attribute of the active TCP/IP protocol stack, the at least one attribute identifying one of a plurality of protocol stack configurations within TCP/IP and distinguishing the active TCP/IP protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• enabling a packet intercept for the identified active TCP/IP protocol stack based on the identified protocol stack configuration;
• collecting data about the packets communicated over the network using the packet intercept;
• using an operating system exit to detect the termination of the active TCP/IP protocol stack when the communication of packets across the active TCP/IP protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• in response to detecting that the active TCP/IP protocol stack is no longer in a state where it is capable of communicating packets over the network, removing the packet intercept from the active TCP/IP protocol stack.

A system for sniffing packets communicated over a network comprising:

• at least one processor operable to execute an identifying unit for examining state information to stored in at least one main storage control block of an operating system to identify an active TCP/IP protocol stack and analyzing the protocol stack to identify at least one attribute of the protocol stack, the active TCP/IP protocol stack comprising one of a plurality of protocol stacks on the network, the at least one attribute identifying one of a plurality of TCP/IP protocol stack configurations within TCP/IP and distinguishing the active TCP/IP protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• the at least one processor operable to execute an enabling unit for enabling a packet intercept for the identified active protocol stack based on the protocol stack configuration;
• the at least one processor operable to execute a collecting unit for collecting data about the packets communicated over the network using the packet intercept;
• wherein the enabling unit is further for:
• using an operating system exit to detect the termination of the active TCP/IP protocol stack when the communication of packets across the active TCP/IP protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• in response to detecting that the active TCP/IP protocol stack is no longer in a state where it is capable of communicating packets over the network, removing the packet intercept from the active TCP/IP protocol stack.

A non-transitory computer recording medium including computer executable code for sniffing packets communicated over a network, comprising:

• code for examining state information stored in at least one main storage control block of an operating system to identify an active TCP/IP protocol stack, the active TCP/IP protocol stack within a plurality of protocol stacks on the network, the active TCP/IP protocol stack in a state actively communicating data;
• code for analyzing the protocol stack to identify at least one attribute of the protocol stack, the at least one attribute identifying one of a plurality of TCP/IP protocol stack configurations within TCP/IP and distinguishing the active TCP/IP protocol stack from at least one other protocol stack on the network that is not being used to actively communicate a packet over the network;
• code for enabling a packet intercept for the identified active TCP/IP protocol stack based on the protocol stack configuration;
• code for collecting data about the packets communicated over the network using the packet intercept;
• code for using an operating system exit to detect the termination of the active TCP/IP protocol stack when the communication of packets across the active TCP/IP protocol stack have been ended, wherein detecting the termination of the protocol stack comprises:
• detecting a termination process from the active protocol stack;
• and
• determining that the protocol stack includes an enabled packet intercept;
• and
• code for removing the packet intercept from the active TCP/IP protocol stack in response to detecting that the active TCP/IP protocol stack is no longer in a state where it is capable of communicating packets over the network.