Patent Application

App. No. 12/126,656

Abstract

Claims (61)

1 . A method, comprising:

identifying a packet having a header and a payload in a flow of a data through a network;

classifying the header of the packet in a type of the header;

determining an algorithm to extract a meta-data having information relevant to network traffic visibility based on the type of the header;

extracting the meta-data from the header; and

streaming the meta-data to a storage device.

2 . The method of claim 1 wherein the meta-data is stored in a database of the storage device, and wherein the storage device is limited in a storage capacity (e.g., to 16 terabytes of data).

3 . The method of claim 2 further comprising applying a last recently used algorithm to discard information from the storage device when storage device is limited in the storage capacity.

4 . The method of claim 1 further comprising:

determining that the type of the header is an Ethernet header;

extracting at least one of an Ethernet source address, an Ethernet destination address, and an Ethernet protocol from the Ethernet header as the meta-data of the Ethernet header; and

associating the flow of the data through the network to a physical computing device associated with a user through the meta-data of the Ethernet header.

5 . The method of claim 1 further comprising:

determining that the type of the header is an IPv4 internet protocol header;

extracting at least one of a source IP address, a destination IP address, an IP flag, a header length, an IP protocol, an IP options (e.g., out of bound messages, may depend on application), and a payload length from the IPv4 internet protocol header as the meta-data of the IPv4 internet protocol header;

determining which entity on the network (e.g., which website, which server, etc.) was accessed through the meta-data of the IPv4 internet protocol header; and

determining how much total traffic was sent by a particular user of the network in a session by analyzing the meta-data of the IPv4 internet protocol header and other IPv4 internet protocol headers.

6 . The method of claim 5 further comprising determining that the type of the header is an IPv6 internet protocol header;

extracting at least one of a source IP address, a destination IP address, a next header, and a payload length from the IPv6 internet protocol header as the meta-data of the IPv6 internet protocol header;

determining which entity on the network (e.g., which website, which server, etc.) was accessed through the meta-data of the IPv6 internet protocol header; and

determining how much total traffic was sent by a particular user of the network in a session by analyzing the meta-data of the IPv6 internet protocol header and other IPv6 internet protocol headers.

7 . The method of claim 1 further comprising:

determining that the type of the header is a transfer control protocol (TCP) header;

extracting at least one of a source port, a destination port, a sequence number, a sequence number, an acknowledgement number, a TCP flag, and a TCP option from the TCP header as the meta-data of the TCP header;

determining what kind of activity a particular user engaged in (e.g., web traffic, ftp, instant message traffic, etc.) through an analysis of the meta-data of the TCP header and other headers;

permitting a reconstruction of an artifact (e.g., a file, a photo, etc.) through an analysis of the meta-data of the TCP header.

8 . The method of claim 1 further comprising:

determining that the type of the header is a user datagram protocol (UDP) header;

extracting at least one of a source port, a destination port, a sequence number, and a payload length from the UDP header as the meta-data of the UDP header;

determining that a particular user engaged in (e.g., one line game playing, name server lookups, hacking, etc.) an unauthorized activity through an analysis of the meta-data of the UDP header and other headers;

permitting a reconstruction of an artifact (e.g., a file, a photo, etc.) through an analysis of the meta-data of the UDP header.

9 . The method of claim 1 further comprising:

determining that the type of the header is an address resolution protocol (ARP) header;

extracting at least one of a broadcast data from the ARP header as the meta-data of the ARP header;

determining that a particular user engaged in (e.g., ARP poisoning, etc.) an unauthorized activity through an analysis of the meta-data of the ARP header and other headers;

reconstructing the unauthorized activity (e.g., for attack prevention and attack detection) through an analysis of the meta-data of the ARP header.

10 . The method of claim 1 further comprising storing the meta-data and other meta-data of the flow of network data based on a compliance requirement (e.g., CALEA).

11 . The method of claim 10 wherein the data of the network flows through a local area network.

12 . The method of claim 1 in a form of a machine-readable medium embodying a set of instructions that, when executed by a machine, causes the machine to perform the method of claim 1 .

13 . A method, comprising:

identifying a packet having a header and a payload in a flow of a data through a network;

classifying the header of the packet in a type of the header;

determining an algorithm to extract a meta-data having information relevant to network traffic visibility based on the type of the header;

extracting the meta-data from the header;

determining that a storage device does not have capacity to store the meta-data; and

discarding a last recently used data when the storage device does not have capacity to store the meta-data such that a sliding window is formed in the storage device that discards the last recently used data when making room for the meta-data and future meta-data.

14 . The method of claim 13 further comprising streaming the meta-data to a storage device.

15 . The method of claim 14 wherein the meta-data is stored in a database of the storage device, and wherein the storage device is limited in a storage capacity (e.g., to 16 terabytes of data).

16 . The method of claim 13 further comprising:

determining that the type of the header is an Ethernet header;

extracting at least one of an Ethernet source address, an Ethernet destination address, and an Ethernet protocol from the Ethernet header as the meta-data of the Ethernet header; and

associating the flow of the data through the network to a physical computing device associated with a user through the meta-data of the Ethernet header.

17 . A visibility module, comprising:

an analysis module to analyze a packet having a header and a payload in a flow of a data through a network;

a type module to classify the header of the packet in a type of the header;

an classification module to determine an algorithm to extract a meta-data having information relevant to network traffic visibility based on the type of the header;

a extraction module to extract the meta-data from the header; and

a streaming module to transfer the meta-data to a storage device.

18 . The visibility module of claim 17 wherein the meta-data is stored in a database of the storage device, and wherein the storage device is limited in a storage capacity (e.g., to 16 terabytes of data).

19 . The visibility module of claim 17 further comprising a last recently used data module to apply a last recently used algorithm to discard information from the storage device when storage device is limited in the storage capacity.

20 . The visibility module of claim 17 wherein the data of the network flows through a local area network, and wherein the visibility module is a storage appliance coupled to a gateway (e.g., router) of the local area network.

Assignments (9)