Packet data recording method and system
A data recording system that includes a plurality of network interface cards that may be employed within a single recording device. Each card may be provided with a plurality of network connecting ports to receive packetized data, such as real-time protocol (RTP) streams. For each RTP packet stream being recorded, the system may note the sequence number for the most recently accepted packet and any packet received with a lower sequence number can be readily discarded. The system then may record payload associated with the RTP streams into an audio file saved on a storage device.
1. A method for recording packet data passing through network access points, comprising:
receiving packet data at plural network interfaces that provide a connection to more than one network access point;
passing the packet data to an IP address filter comparing an IP address and port number of a packet under examination against a list of known destinations determined in accordance with a set of business rules and observed external activity;
comparing the IP address to an entry in a circular buffer to determine a match and, if there is the match, using the IP address as a pointer to an entry in a known destination object to determine if the packet under examination is to be recorded;
passing the packet under examination to a protocol filter to determine a protocol of the packet under examination;
passing the packet under examination to a buffer in accordance with the protocol; and
storing payload data contained within the packet under examination in a storage device.
2. The method of claim 1 , wherein determining the protocol further comprises determining if the protocol is real-time transport protocol (RTP), real-time transport control protocol (RTCP) or other protocol.
3. The method of claim 2 further comprising:
passing real-time transport protocol (RTP) data and real-time transport control protocol (RTCP) data to an RTP/RTCP data buffer; and
passing other protocol data to a packet data buffer.
4. The method of claim 3 , further comprising:
applying a synchronization to the RTP and RTCP data; and
writing the RTP and RTCP data in contiguous blocks to the storage device.
5. The method of claim 3 , further comprising:
writing a WAV audio file for RTP data, and
writing an XML file for other protocol data.
6. The method of claim 1 , further comprising if a match is not found, passing the packet under examination to the protocol filter.
7. A method for recording packetized information packet data passing through network access points, comprising:
comparing an IP address of a received packet with an IP address of a destination recorder device having plural network interfaces;
comparing the IP address of the received packet with an IP destination address and an IP port number contained in a list, if the received packet is destined for a device other than the recorder device, the list being determined in accordance with a set of business rules and observed external activity;
comparing the IP address of the received packet to an entry in a circular buffer to determine a match and, if there is the match, using the IP address of the received packet as a pointer for a known destination object; and
recording the received packet based on information contained in the known destination object.
8. The method of claim 7 , wherein an entry in the known destination object's data structure indicates whether the received packet is to be recorded.
9. The method of claim 7 , wherein the list is held in a buffer as a map with an indexing function.
10. The method of claim 9 , wherein if the if the IP address of the received packet is not in the list, a hash table is used to determine the pointer for the known destination object.
11. The method of claim 7 , wherein the known destination object includes information that allows the protocol filter to determine which protocol the received packet contains.
12. The method of claim 7 , further comprising passing the received packet to a protocol filter.
13. The method of claim 12 , further comprising determining if the received packet contains payload representing an RTP packet header.
14. The method of claim 13 , further comprising passing the RTP packets to a RTP/RTCP packet buffer.
15. The method of claim 14 , further comprising sequencing the RTP packets.