Network monitoring based on pointer information
View Patent ↗A computer system and method for identifying and extracting content from data traffic, the system including: a capture driver arranged to monitor data traffic and to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet; a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols; and a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application.
1. A computer system for identifying and extracting content from data traffic, the system comprising:
a memory;
one or more network adapters; and
a processing device communicatively coupled to the memory and configured to execute program code stored in the memory, the program code comprising:
a capture driver arranged to interface with the one or more network adapters, to monitor data traffic, to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet;
a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols; and
a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application, wherein the control interface is adapted systematically to send pointer information relating to the captured data packet to decoder modules in turn until either a module accepts the data or until there are no more modules to try, wherein each module is adapted to communicate with the control interface to notify it to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module notifies the control interface that it no longer wishes to receive packets on the stream, the control interface notifies a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.
2. A system according to claim 1 , wherein the identifying and extracting of content from data traffic is effected in real-time.
3. A system according to claim 1 , wherein the identifying and extracting of content from the data traffic is effected one data packet at a time.
4. A system according to claim 1 , wherein the control interface is adapted to route the pointer information successively to more than one decoder module in turn.
5. A system according to claim 1 , wherein the decoder modules are configured to decode each of the following protocols: Internet Protocol (IP); Transmission Control Protocol (TCP) and Hyper Text Transfer Protocol (HTTP).
6. A system according to claim 1 , wherein the control interface is adapted to search for decoder modules.
7. A system according to claim 6 , wherein each of the decoder modules is adapted to register with the control interface and to notify the control interface as to the type of data the decoder module is arranged to decode.
8. A system according to claim 7 , wherein each of the decoder modules notifies the control interface of the data transfer protocol or object type the decoder module is adapted to decode.
9. A system according to claim 1 , wherein the control interface comprises a control engine and memory.
10. A system according to claim 1 , wherein the packet capture driver is configured to identify the one or more network adapters and to retrieve details about the one or more network adapters.
11. A system according to claim 10 , wherein the packet capture driver is configured to modify settings of the one or more network adapters.
12. A system according to claim 1 , wherein the control interface is configured to identify a protocol of a lowest protocol layer in a protocol stack of a captured data packet.
13. A system according to claim 12 , wherein the control interface, after identifying the lowest protocol layer in the captured packet, creates a pointer to a next layer in the protocol stack without modifying the data packet stored in the capture driver buffer.
14. A system according to claim 1 , wherein at least one of the decoder modules is adapted to identify streamed data.
15. A system according to claim 14 , wherein at least one of the decoder modules is adapted to reconstruct streamed data.
16. A system according to claim 14 , wherein the at least one decoder module that is adapted to identify the streamed data is further adapted to notify the control interface when a start of a stream has been detected, and wherein the control interface then creates a stream list in the memory for temporarily storing at least one list comprising pointers to data packets related to the stream.
17. A system according to claim 16 , wherein the stream list is divided into an upload stream list and a download stream list.
18. A system according to claim 1 , wherein the pointer information comprises offsets.
19. A system according to claim 1 , wherein the program code further comprises an application module.
20. A system according to claim 1 , wherein the control interface is configured to identify a type of an object file.
21. A system according to claim 20 , wherein the control interface is configured to distinguish between protocols and objects.
22. A method for analyzing computer network traffic, the method comprising the steps of:
(a) capturing a raw data packet from a network;
(b) examining the lowest layer of the data packet to identify its protocol;
(c) selecting one of a plurality of protocol modules which is adapted to decode said identified protocol;
(d) sending data relating to said data packet to said selected module;
(e) receiving data from said selected module after said protocol has been decoded, and examining the next lowest protocol;
(f) repeating steps (c) to (e) until there are no more modules to decode the data or until there are no more layers in the packet; and
(g) generating a notification, by a first module, to continue to send packets on a specific stream or to discontinue sending packets on the stream, and, if the first module generates a notification that it is no longer to receive packets on the stream, notifying a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.
23. A method according to claim 22 , wherein the act of analyzing the computer network traffic is effected in real-time.
24. A method according to claim 22 , further comprising searching for the protocol modules.
25. A method according to claim 24 , wherein each of the protocol modules registers with a control interface and notifies the control interface as to a data transfer protocol or object type the protocol module is adapted to decode.
26. A method according to claim 22 , further comprising identifying network adapters and retrieving details of such network adapters.
27. A method according to claim 26 , further comprising modifying settings of the network adapters.
28. A method according to claim 22 , further comprising identifying a protocol of a lowest protocol layer in a protocol stack of a captured data packet, and subsequently creating a pointer to a next layer in the protocol stack without modifying the data packet stored in a buffer.
29. A method according to claim 22 , further comprising identifying a start of streamed data, creating a stream list in memory for temporarily storing at least one list comprising pointers to data packets related to said stream and reconstructing streamed data.
30. A method according to claim 22 , wherein the act of sending data relating to said data packet to said selected module comprises sending pointer information to said selected module.
31. A method according to claim 22 , further comprising identifying a type of an object file, and distinguishing between protocols and objects.
32. A method for identifying and extracting content from data traffic, the method comprising:
monitoring data traffic and copying data packets from the traffic to a buffer without disrupting the traffic flow, and generating pointer information to identify specific parts of a data packet;
systematically routing the pointer information to one or more of a plurality of decoder modules in turn until either a module accepts the data or until there are no more modules to try, each module being adapted to decode one or more specific data transfer protocols in the data packet; and
routing extracted content from the data traffic to a computer application, wherein each module is adapted to generate a notification to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module generates a notification that it no longer wishes to receive packets on the stream, a second module processing a lower protocol layer is notified so the second module can stop processing the lower protocol layer.
33. A non-transitory computer readable medium loaded with computer readable code operable, when loaded on a computer, to effect the method steps of claim 22 .
34. A computer system for identifying and extracting content from data traffic, the system comprising:
a memory;
one or more network adapters; and
a processing device communicatively coupled to the memory and configured to execute program code stored in the memory, the program code comprising:
a capture driver arranged to monitor data traffic and to copy data packets from the traffic to a buffer without disrupting the traffic flow, and to generate pointer information to identify specific parts of a data packet;
a plurality of decoder modules, each module being adapted to decode one or more specific data transfer protocols; and
a control interface adapted to receive pointer information from the capture driver, to route the pointer information to one or more of the plurality of decoder modules, and to route extracted content from the data traffic to an application, wherein each module is adapted to communicate with the control interface to notify it to continue to send packets on a specific stream or to discontinue sending packets on the stream, and wherein, when a first module notifies the control interface that it no longer wishes to receive packets on the stream, the control interface notifies a second module processing a lower protocol layer so the second module can stop processing the lower protocol layer.