Apparatus and methods for capturing data packets from a network
View Patent ↗In one embodiment, data packets are captured from a network using a physical, network-connectable data capture probe. As the data packets are captured, the data packets are time-stamped with time-of-capture time-stamps. The time-stamped data packets are then stored; and in parallel, the time-stamped data packets are forwarded to at least one consumer in real-time.
1. A system for data packet capture, the system comprising:
a data packet capture apparatus comprising:
a physical, network-connectable data capture probe;
a time-stamping circuit configured to time stamp data packets captured via the data capture probe;
a real time data packet interface;
a real-time packet forwarding circuit configured to stream the data packets captured via the data capture probe to the real-time data packet interface;
a data store;
a real-time packet storing circuit operating in parallel with the real-time packet forwarding circuit, the real-time packet storing circuit configured to store the data packets captured via the data capture probe, in association with time stamps generated by the time-stamping circuit, in the data store, wherein the data store stores the data packets captured by the data capture probe for non-real time access;
an application configured to receive the data packets from the real-time data packet interface, to drop at least one of the packets, and to obtain a copy of the dropped packet from the data store; and
wherein the real-time packet storing circuit associates stored packets in different groups and the data packet capture apparatus further comprises a configuration interface, wherein the real-time packet storing circuit adaptively reconfigures at least one parameter of the different groups, in response to input received via the configuration interface while data packets are being captured by the data packet capture apparatus.
2. The system of claim 1 , wherein the real-time packet forwarding circuit is configured to stream non-time-stamped data packets.
3. The system of claim 1 , wherein the real-time packet forwarding circuit is configured to stream time-stamped data packets.
4. The system of claim 1 , wherein the different groups correspond to different time periods.
5. The system of claim 1 , wherein the different groups correspond to volumes of captured data packets.
6. The system of claim 1 , wherein the real-time packet storing circuit stores each of first and second consecutively captured groups of data packets in respective first and second partitions of the data store.
7. The system of claim 1 , wherein the real-time packet storing circuit stores each of first and second consecutively captured groups of data packets in respective first and second tables or files in the data store.
8. The system of claim 1 , wherein the data packet capture apparatus further comprises a non-real-time packet interface, the non-real-time packet interface only providing read access to a particular group of data packets in the data store after all of the data packets in the particular group have been stored in the data store.
9. The system of claim 1 , wherein the data packet capture apparatus further comprises a configuration interface, wherein the real-time packet storing circuit configures at least one parameter of the different groups in response to input received via the configuration interface.
10. The system of claim 9 , wherein the at least one parameter of the different groups comprises a time period.
11. The system of claim 9 , wherein the at least one parameter of the different groups comprises a data packet volume.
12. A method for capturing data packets from a network, comprising:
at a data packet capture apparatus;
capturing the data packets at a physical, network-connectable data capture probe of the data packet capture apparatus;
as the data packets are captured, time-stamping the data packets with time-of-capture time-stamps; and
in parallel,
storing the time-stamped data packets in a data store of the data packet capture apparatus for non-real-time access;
forwarding the time-stamped data packets to at least one application in real-time;
associating the stored data packets in different groups;
providing a configuration interface; and
adaptively reconfiguring at least one parameter of the different groups in response to input received via the configuration interface while data packets are being captured by the data packet capture apparatus
at the at least one network monitoring application:
dropping at least one of the data packets and obtaining a copy of the dropped packet from the data store.
13. The method of claim 12 , wherein associating the data packets in different groups comprises defining different groups to correspond to different time periods.
14. The method of claim 12 , wherein associating the data packets in different groups comprises defining different groups in response to volumes of data packets captured.
15. The method of claim 12 , further comprising:
providing application access to a particular group of stored data packets only after all of the data packets in the particular group have been stored.
16. The method of claim 15 , further comprising:
receiving, from the at least one application, an indication that the stored data packets of the particular group of stored data packets can be overwritten.
17. The method of claim 12 , further comprising:
storing each of first and second consecutively stored groups of data packets in respective first and second disk partitions.