Apparatus for analyzing traffic

An apparatus for analyzing traffic, comprising:

• a filtering unit running on a processor configured to analyze a plurality of traffic packets according to a filtering rule and filter out a TCP packet from the traffic packets;
• a TCP analysis unit configured to identify whether the state of a 3-way handshake state (Synchronization (SYN), SYN/Acknowledgement (ACK) for the TCP packet is normal or abnormal and analyze the TCP packet of which the 3-way handshake state is identified as being normal;
• an HTTP analysis unit configured to identify whether the TCP packet is an HTTP packet based on the content of a HTTP request/response header of the TCP packet and analyze the HTTP packet;
• and
• a pair analysis unit configured to parse requests and responses HTTP packets without regard to their order that client sends requests and then server sends response packet or vice versa, and to reorder the requests and the responses sequence so that the requests and the responses can pair with each other correctly, and to
• correlate between TCP and HTTP sessions based upon management of a record table on the TCP and HTTP sessions and terminations of the TCP and HTTP sessions by, at least, inserting a current packet into a head of the record table if a sequence number of the current packet is greater than the sequence number of the packet in fetched record.