Vss Monitoring, Inc.

Atlantes Services, Inc.

Vistant Corporation

Seecontrol, Inc.

David Kucharczyk

Terence M Breslin

Jan Allen Hinshaw

Suzy Brown

A network captured traffic distribution device may receive captured data packets including original destination information. The captured data packets may then be encapsulated with, for example, new address information so that they may be transmitted toward a destination intended by the network capture traffic distribution device and not the original destination. Captured data packets may also be reformatted by the network capture traffic distribution device in order to, for example, be compatible with one or more devices communicatively coupled to the network capture traffic distribution device. Optionally, the encapsulated and/or reformatted captured data packets may further be encrypted prior to transmission toward their intended destination.

Encapsulating data packets

Methods, systems, computer-readable media, and devices for filtering captured network traffic received by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Methods, systems, computer-readable media, and devices for applying a plurality of filters to received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are also described. Applying a plurality of filters to the received captured traffic may generate a plurality of filtered captured traffic sets. In some instances, filtered captured network traffic sets that have similar target destinations may be aggregated together and transmitted toward the target destination.

Method, apparatus and system for filtering captured network traffic

Methods, systems, computer-readable media, and devices for aggregating sets of received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Systems for aggregating captured network traffic may include a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology such that each network captured traffic distribution device is communicatively coupled via a communication link with at least one additional stacked network captured traffic distribution device, and an external device. In some embodiments, one or more of the stacked network captured traffic distribution devices, source, and/or external device may operate at locations that are geographically disperse from one another.

Apparatus and system for aggregating captured network traffic

Methods, systems, computer-readable media, and devices for automatically configuring a network captured traffic distribution device communicatively coupled to a stacked topology of network captured traffic distribution devices are described. The automatic configuration may include an exchange of configuration information between a first and second network captured traffic distribution device included in a stacked topology. The configuration information of a network captured traffic distribution device may also be automatically updated when, for example, a change is detected in the stacked topology or on a periodic or as needed basis.

Auto-configuration of network captured traffic device

Methods, systems, computer-readable media, and devices for determining a target destination of captured network traffic received by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology responsively to an inserted virtual local area network (VLAN) tag are described. A target destination for a captured data packet may be determined and a VLAN tag may be inserted into the captured data packet responsively to the determined target destination. The data packet may then be transmitted to an intervening network captured traffic distribution device positioned between the network captured traffic distribution device and the target destination. Once received by the intervening network captured traffic distribution device, the target destination of the received data packet may be determined based on the inserted VLAN tag. The received data packet may then be transmitted toward the target destination.

Method, apparatus and system for inserting a VLAN tag into a captured data packet

Systems, apparatus, and methods for modifying a captured data packet included in a traffic flow of captured data packets are described. A captured data packet may be analyzed in order to, for example, locate a predefined segment of data included in the received captured data packet, determine a type of data included in the data packet, and determine content included in the data packet. The data packet may then be modified based upon the analysis. Exemplary modifications include deleting a portion of the data included in the data packet, truncating the data packet, and modifying data included in the predefined segment.

System, apparatus, and method for modifying captured data packets

Methods, systems, computer-readable media, and devices for determining an optimum route for the transmission of a received traffic flow of captured data packets from a network captured traffic distribution device, through a stacked topology of network captured traffic distribution devices, to a target destination are provided. A plurality of routes through a stacked topology may be determined and analyzed according to one or more criterion. An optimum route may then be selected based upon the analysis. On some occasions, the determination of an optimum route may incorporate information regarding operating conditions for the stacked topology.

Method, apparatus and system for determining an optimum route for transmission of a captured data packet through a stacked topology of network captured traffic distribution devices

Systems, devices, and methods for finding a captured data packet including a data pattern of interest are herein provided. The captured data packet may be included in the traffic flow of data packets received at a network captured traffic distribution device and may be found by scanning the payload portions of data packets included in the traffic flow to find a data packet including a data content pattern of interest. An egress port of the network captured traffic distribution device associated with a found data packet may be determined based upon the data pattern of interest detected in the payload portion of the found data packet and the found data packet may then be transmitted to its assigned egress port.

Systems, methods, and apparatus for detecting a pattern within a data packet

Systems, apparatus, and methods for managing an overflow of data packets received by a switch are disclosed. A traffic flow of data packets may be transmitted to a switch and it may be determined whether the switch has sufficient input capacity available to enable receipt of the transmitted data packets. When the input capacity of the switch is insufficient, a traffic flow control measure may be implemented to, for example, pause, limit, filter, or otherwise modify the traffic flow of data packets so that any overflowing data packets will not be lost or otherwise compromised due to the switch's inability to accept the data packets.

Systems, apparatus, and methods for managing an overflow of data packets received by a switch

Systems, apparatus, and methods for inserting information into a captured data packet included in a traffic flow of captured data packets are herein disclosed. Exemplary information inserted into a capture data packet includes a data segment, a time stamp, port stamp, a virtual local area network (VLAN) tag, Gateway General Packet Radio Service (GPRS) Tunneling Protocol (GTP) information, and multi-protocol label switching (MPLS) information.

System, apparatus, and methods for inserting information into captured data packets

Data packets received at network traffic distribution device are analyzed to determine whether they include unwanted information, and, if so, the network traffic distribution device removes the unwanted information and then transmits the data packets, absent the unwanted information, to an assigned egress port (e.g., a monitor port communicatively coupled to a monitoring device). The flow of data packets may be received at the network traffic distribution device from a mirror port resident on a source of the captured data packets and/or a traffic capture point located along a communication link between two communicating devices within a network. In addition to analyzing the data packets and removing unwanted information therefrom, the network traffic distribution device may perform additional operations on the data packets as well.

System, apparatus and method for removing unwanted information from captured data packets

Systems, devices, and methods for finding a captured data packet including a data pattern of interest and data packets associated with the found data packet are herein provided. A traffic flow of captured data packets may be received by a network captured traffic distribution device and may be duplicated. A traffic flow of captured data packets may be scanned for data packets including a data pattern of interest and identifying information may be determined for any found data packets. A duplicate traffic flow of captured data packets may also be scanned for data packets with identifying information that matches a found data packet. An egress port for the found data packet may be determined and both the found data packet and any data packets with identifying information matching found data packet might be transmitted to the determined egress port.

Systems, methods, and apparatus for detecting a pattern within a data packet and detecting data packets related to a data packet including a detected pattern

Methods, systems, and devices for monitoring network capacity and determining network utilization are herein disclosed. A traffic flow of captured data packets received at an ingress port of a network captured traffic distribution device may be sampled at a frequency corresponding to a first time period. The sample may be analyzed to determine whether, for example, the ingress port is active during the first time period. An increment may be added to a first counter based on a determination that the ingress port is active. The increments from a predefined plurality of first time periods may be aggregated and the predefined plurality of first time periods may correspond to a second time period. A second counter value may be generated for the second time period based on the aggregate and a percent utilization of the ingress port for the second time period may be determined based on the second counter value.

Systems, apparatus, and methods for monitoring network capacity

A network traffic distribution device (e.g., a network tap or similar device) is configured to receive and analyze captured network traffic data packets that include tunneling IDs (e.g., GTP tunneling IDs) and, based on that analysis, to distribute those data packets in such a way that data packets with the same tunneling IDs are distributed to a common egress port of the network traffic distribution device. In some cases, each flow of data packets with a common tunneling ID is sent to a unique external device, while in other cases, two or more traffic flows, each with packets having respective, common tunneling IDs may be provided to the same external device, either via a common egress port of the network traffic monitoring device or via separate egress ports thereof.

System, method and apparatus for distributing captured data packets including tunneling identifiers

An intelligent fast switch-over network active tap system enables active monitoring of a network segment connected between network devices. A fail-safe relay subsystem is coupled between a pair of network ports, enabling transmission of network communications signals through a passive cross-connect between the network ports or through an active bridge subsystem. The active bridge subsystem is capable of independently establishing network links with the network devices, and a separate network link with a monitoring device. A controller manages operation of the relay and active bridge subsystems, including switches between passive and active network transmission through the tap system and to determine and establish the active network links subject to symmetric network link parameters and state. Thereby, the network link status of the connected network devices is preserved on switch between active and passive transmission and correctly reflected in the presence of link and power failures.

Growing community of inventors

Santa Fe, NM, United States of America

David Kucharczyk