Data collection device for monitoring streams in data network
The invention relates to a data collection device for monitoring streams in a data network using a packet transmission mode, including an extractor for extracting data contained in packets belonging to a stream defined by a transmitter, a receiver, and a protocol. The collection device also includes a syntax analyzer which receives data in real time from the extractor and breaks the data down into elements according to the syntactic rules of the protocol, said syntactic rules enabling the elements to be represented as a tree structure. The syntax analyzer combines respective tree state indicators with at least some of the elements, wherein the tree state indicator combined with an element locates said element within the tree structure. An interface transmits the tree state indicators, together with the elements with which the latter have been combined, to a stream analyzer external to the collection device.
1. Data collection device for monitoring streams in a data network using a packet transmission mode, the device comprising:
an extractor of data contained in packets belonging to a stream defined by a transmitter, a receiver and a protocol;
a syntax analyzer arranged for:
receiving the data from the extractor in real time;
breaking down the data received into elements according to syntactic rules of said protocol, the syntactic rules making it possible to represent said elements as a tree structure; and
associating respective tree state indicators with at least some of said elements, where the tree state indicator associated with an element labels said element in the tree structure; and
an interface for transmitting the tree state indicators to a stream analyzer, together with elements with which they have been associated.
2. Device according to claim 1 , wherein the tree state indicator associated with an element contains an identifier of a parent node of the tree structure to which is attached a site receiving said element in the tree structure representation.
3. Device according to claim 2 , wherein the syntax analyzer is moreover arranged for:
allocating a node identifier to a current element if it is determined according to the syntactic rules that the current element is received, in the tree structure representation, at a site situated at a node of the tree structure; and
including the node identifier allocated to the current element in the tree state indicator associated with said current element.
4. Device according to claim 3 , wherein the syntax analyzer is arranged so that it only stores in memory, for a given stream, after transmission of an element and its associated tree state indicator, each node identifier encountered when moving up the tree structure from the site receiving said element in the tree structure representation.
5. System for monitoring streams in a data network using a packet transmission mode, the system comprising a data collection device according to claim 1 and a stream analyzer receiving the transmitted elements with the associated tree state indicators.
6. System according to claim 5 , wherein the stream analyzer is arranged to construct at least a part of the tree structure from the transmitted elements with the associated tree state indicators.
7. Method for monitoring streams in a data network using a packet transmission mode, the method comprising:
extracting data contained in packets belonging to a stream defined by a transmitter, a receiver and a protocol;
breaking down the data received into elements in real time, according to syntactic rules of said protocol, the syntactic rules making it possible to represent said elements according to a tree structure;
associating respective tree state indicators with at least some of said elements, where the tree state indicator associated with an element labels said element in the tree structure; and
transmitting the tree state indicators to a stream analyzer ( 7 ), together with the elements with which they have been associated.
8. Method according to claim 7 , wherein the tree state indicator associated with an element comprises an identifier of a parent node of the tree structure to which is attached a site receiving said element in the tree structure representation.
9. Method according to claim 8 , further comprising:
allocating a node identifier to a current element if it is determined according to the syntactic rules that the current element is received, in the tree structure representation, at a site situated at a node of the tree structure; and
including the node identifier allocated to the current element in the tree state indicator associated with said current element.
10. Method according to claim 9 , wherein, for a given stream after transmission of an element and its associated tree state indicator, no more is retained than each node identifier encountered when moving up the tree structure from the site receiving said element in the tree structure representation.
11. Method according to claim 7 , further comprising the construction of at least a part of the tree structure, at the stream analyzer level, from the transmitted elements with the associated tree state indicators.