International Business Machines Corporation

Napatech A/s

Peter Dahl Ekner

William Alexander Bird

Wayne Francis Tackabury

Russell L Couturier

Michael Milde Lilja

Thomas D Silliman

Philip Due Soeberg

Alex Omo Agerholm

Peter Korger

Søren Kragh

Embodiments are directed to a method of implementing a packet capture ring. The packet capture ring includes a plurality of appliances, and the plurality of appliances includes a first appliance and a second appliance. The first appliance and the second appliance are both attached to a network tap, and the first appliance works as a master appliance. The master appliance ingests packets from the network tap, encapsulates the packets and forwards encapsulated packets in the packet capture ring. The method includes: detecting, by the second appliance, a failure of the first appliance; working, by the second appliance, as the master appliance; and removing, by the second appliance, the first appliance from a forwarding designation list.

Fault-tolerant architecture for packet capture

Embodiments are directed to a packet capture ring that provides a single network tap for packet capture and a series of processors (or appliances) for handling serialization and search request processing in a confederated and highly scalable manner. One such appliance (a 'primary' appliance) maintains a tap port to the network. Each packet capture appliance has a locally attached repository that stores raw packets and a juxtaposed index that allows for retrieval of those packets. The primary appliance sends a single copy of encapsulated packets in opposite directions around the ring to its descendants. A designation is made across the system as to a 'currently designated' appliance for servicing requests for indexing and storage of captured packets. This current designation shifts from appliance to appliance in the system, as a &#x201c;previously designated&#x201d; appliance has its storage capacity filled.

Packet capture ring: reliable, scalable packet capture for security applications

A de-serializer, such as forming part of a SERDES, in which a point in time of receipt, on the serial data path, of receipt of a particular part of a data packet, such as an SOF, is determined from when that part is output on the parallel data path from knowledge of the clock controlling the parallel data path as well as which of the parallel lanes the part is output on.

System and a method for identifying a point in time of receipt of a data packet

An apparatus and a method where a plurality of physically separate data receiving/analyzing elements receive data packets and time stamp these. A controlling unit determines a storing address for each data packet based on at least the time stamp, where the controlling unit does not perform the determination of the address until a predetermined time delay has elapsed after the time of receipt.

Distributed processing of data frames by multiple adapters using time stamping and a central controller

Growing community of inventors

Hilleroed, Denmark

Peter Dahl Ekner