Network monitoring using virtual packets

A system comprising:

• a first device having:
• a flow processor for receiving flow information from a set of flow information gathering devices,
• said flow processor configured to generate a sequence of virtual packets for each said flow, said sequence of virtual packets being equally distributed over a time for said flow, said time being reported after an end of said flow;
• wherein a first sequence of virtual packets for a first flow is responsive to a first sampling rate of real packets reported in said flow information for said first flow,
• wherein a second sequence of virtual packets for a second flow is responsive to a second sampling rate of real packets reported in said flow information for said second flow,
• wherein said first and second sequences of virtual packets have equivalent sampling rates relative to real packets in said first and second flows;
• a virtual packet buffer for storing virtual packets received from the flow processor;
• a virtual bus coupled to the virtual packet buffer through either a discovery engine, a monitoring engine, a profiling engine or a detection engine.

A non-transitory processor readable storage device having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method including steps of:

• sampling, at a first predetermined rate, first flow information;
• generating first virtual packets in response thereto,
• said first virtual packets being equally distributed over a time reported for said first flow information;
• sampling, at a second predetermined rate, second flow information;
• generating second virtual packets in response thereto;
• and
• recording some of the virtual packets whereby the recorded virtual packets represent equivalent sampling for both the first flow information and the second flow information.