Granted Patent B2

US 8,004,998 · App. 12/471,437 · Granted Aug 23, 2011

Abstract

Claims (52)

1. A method, comprising:

capturing a network data using a virtual software switch, a processor, and a memory, wherein the network data is communicated to at least one port of the virtual software switch;

forming a stored network data in a memory;

regenerating the stored network data to form a reconstructed data;

performing a network visibility analysis using the reconstructed data;

aggregating a payload data from the network data, wherein the network data comprises a plurality of different packets; and

generating an extracted artifact of a network data using the aggregated payload data.

2. The method of claim 1 , further comprising:

communicating the reconstructed data at a variable communication rate.

3. The method of claim 2 , further comprising:

controlling an ingress location filter of a virtual software switch.

4. The method of claim 3 , further comprising:

regulating an egress location filter of a virtual software switch to control a flow of network data.

5. The method of claim 3 , further comprising:

applying an access control list to at least one of the control of the ingress location filter and the regulation of the egress location filter of the virtual software switch.

6. The method of claim 1 , further comprising:

communicating the reconstructed data at an upper threshold rate.

7. The method of claim 1 , further comprising:

communicating the reconstructed data at an lower threshold rate.

8. The method of claim 1 , further comprising:

communicating the reconstructed data at an intermittent rate.

9. The method of claim 1 , wherein the memory is comprised of a virtual storage device communicatively coupled to the virtual software switch.

10. The method of claim 9 , further comprising:

trunking the reconstructed data of the virtual software switch to a remote location.

11. The method of claim 10 , wherein the reconstructed data is communicated to at least one of a physical network and a virtual network.

12. The method of claim 1 , further comprising:

matching the payload data with an entry of a library of known artifacts; and

determining a type of the payload data based on a match with the entry of the library of known artifacts.

13. The method of claim 1 , wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation.

14. The method of claim 1 , wherein a machine is caused to perform the method of claim 1 when a set of instructions are executed by the machine, wherein the set of instructions is embodied by the method of claim 1 in a form of a machine-readable medium.

15. A system, comprising:

a virtual software switch to capture a network data using a processor and a memory, wherein the network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch;

an additional memory to store the network data;

a regeneration module to form a reconstructed data using the stored network data;

a virtual appliance to aggregate a payload data from the network data, wherein the network data comprises a plurality of different packets; and

an extraction module to form an extracted artifact using the aggregated payload data.

16. The system of claim 15 , wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation.

17. The system of claim 15 , wherein the reconstructed data is formed using a variable communication rate.

18. The system of claim 17 , wherein the variable communication rate is comprised of at least one of a real time, an upper rate, a lower rate, and a customizable rate.

19. The system of claim 18 , further comprising:

a transferable control module to filter the network data using at least one of an ingress location and an egress location of the virtual software switch.

20. A method, comprising:

capturing a network data using a virtual software switch, a processor, and a memory, wherein the network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch;

aggregating a payload data from the network data, wherein the network data is comprised of different packets;

generating an extracted artifact using the aggregated payload data, wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation;

forming a stored network data using the network data in a virtual storage device communicatively coupled to the virtual software switch; and

regenerating the stored network data to form a reconstructed data, wherein the reconstructed data is formed using a variable communication rate comprised of at least one of a real time, an upper rate, a lower rate, and a customizable rate, and wherein the reconstructed data is communicated to at least one of a physical network and a virtual network.

21. The method of claim 20 , further comprising:

filtering the network data using at least one of an ingress location and an egress location of the virtual software switch, wherein an access control list is used to control a filter of at least one of the ingress location and the egress location;

matching the payload data with an entry of a library of known artifacts;

determining a type of the payload data based on a match with the entry of the library of known artifacts; and

communicating the network data between the virtual software switch and a remote port using a network trunk.

Assignments (10)