Trigger based recording of flows with play back

1. A method for monitoring flows of packets over a network, wherein a network device enables actions, comprising:

selecting at least one of a plurality of flows for passive monitoring in real time over a network;

providing at least one trigger that is initiated in real time by at least one condition that is associated with the at least one selected flow;

determining at least one other flow that is related to the at least one selected flow, wherein the at least one other related flow is unassociated with the at least one trigger, and wherein the at least one selected flow and the at least one other related flow corresponds to at least the same application, node, or network device;

buffering in real time the at least one selected flow in a buffer, wherein each selected flow is arranged as a thread in the buffer;

if buffering the at least one selected flow dominates a capacity of the buffer over at least one other selected flow, throttling the buffering of the at least one dominant selected flow until the capacity of the buffer is able to buffer the at least one other selected flow;

if the at least one condition occurs and initiates the at least one trigger, enabling other actions, including:

recording in real time each packet for the at least one selected flow that is associated with the at least one condition, wherein each buffered packet for the selected flow is recorded in real time along with the selected flow's packets that are received after the initiation of the trigger, and

after the initiation of the trigger, recording in real time each packet for the at least one other related flow; and

enabling in real time analysis and play back of the recorded flows regarding at least the occurrence of the condition.

2. The method of claim 1 , wherein the buffer is at least one of a ring buffer or first in first out buffer.

3. The method of claim 1 , wherein the real-time buffering of the at least one selected flow in the buffer, further comprises providing a tag for at least each buffered packet associated with the selected flow, wherein the tag enables reference to at least another consecutive buffered packet in the thread for the selected flow.

4. The method of claim 1 , further comprising editing at least one of the at least one trigger or the selection of the at least one selected flow from the plurality of flows.

5. The method of claim 1 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer.

6. The method of claim 1 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, instantiating a new buffer to separately buffer in real time the dominant selected flow.

7. The method of claim 1 , wherein the at least one trigger is based on an analysis of at least one transaction attribute at layer 7 of the Open Systems Interconnection model, wherein the at least one transaction attribute is associated with the at least one selected flow.

8. The method of claim 1 , wherein playing back the recorded flow, further comprises selecting at least one value for playing back at least a portion of the recorded flow.

9. A network device for monitoring flows of packets over a network, comprising:

a transceiver device for monitoring communication over the network; a memory device for storing at least instructions; and

a processor device that is operative to execute instructions that enable actions, including:

selecting at least one of a plurality of flows for passive monitoring in real time over a network;

providing at least one trigger that is initiated in real time by at least one condition that is associated with the at least one selected flow;

determining at least one other flow that is related to the at least one selected flow, wherein the at least one other related flow is unassociated with the at least one trigger, and wherein the least one selected flow and the at least one other related flow corresponds to at least the same application, node, or network device;

buffering in real time the at least one selected flow in a buffer, wherein each selected flow is arranged as a thread in the buffer;

if buffering the at least one selected flow dominates a capacity of the buffer over at least one other selected flow, throttling the buffering of the at least one dominant selected flow until the capacity of the buffer is able to buffer the at least one other selected flow;

if the at least one condition occurs and initiates the at least one trigger, enabling other actions, including:

recording in real time each packet for the at least one selected flow that is associated with the at least one condition, wherein each buffered packet for the selected flow is recorded in real time along with the selected flow's packets that are received after the initiation of the trigger, and

after the initiation of the trigger, recording in real time each packet for the at least one other related flow; and

enabling in real time analysis and play back of the recorded flows regarding at least the occurrence of the condition.

10. The network device of claim 9 , wherein the buffer is at least one of a ring buffer or first in first out buffer.

11. The network device of claim 9 , wherein the real-time buffering of the at least one selected flow in the buffer, further comprises providing a tag for at least each buffered packet associated with the selected flow, wherein the tag enables reference to at least another consecutive buffered packet in the thread for the selected flow.

12. The network device of claim 9 , further comprising editing at least one of the at least one trigger or the selection of the at least one selected flow from the plurality of flows.

13. The network device of claim 9 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer.

14. The network device of claim 9 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, instantiating a new buffer to separately buffer in real time the dominant selected flow.

15. The network device of claim 9 , wherein the at least one trigger is based on an analysis of at least one transaction attribute at layer 7 of the Open Systems Interconnection model, wherein the at least one transaction attribute is associated with the at least one selected flow.

16. The network device of claim 9 , wherein playing back the recorded flow, further comprises selecting at least one value for playing back at least a portion of the recorded flow.

17. A system for monitoring flows of packets over a network, comprising:

a first network device that includes:

a transceiver device for communicating over the network;

a memory device for storing at least instructions; and a processor device that is operative to execute instructions that enable actions, comprising communicating at least one flow of packets with at least a second network device; and

a third network device that includes:

a transceiver device for monitoring communication between the first network device and the second network device;

a memory device for storing at least instructions; and

a processor device that is operative to execute instructions that enable actions, comprising:

selecting at least one of a plurality of flows for passive monitoring in real time over a network;

providing at least one trigger that is initiated in real time by at least one condition that is associated with the at least one selected flow;

determining at least one other flow that is related to the at least one selected flow, wherein the at least one other related flow is unassociated with the at least one trigger, and wherein the least one selected flow and the at least one other related flow corresponds to at least the same application, node, or network device;

buffering in real time the at least one selected flow in a buffer, wherein each selected flow is arranged as a thread in the buffer;

if buffering the at least one selected flow dominates a capacity of the buffer over at least one other selected flow, throttling the buffering of the at least one dominant selected flow until the capacity of the buffer is able to buffer the at least one other selected flow;

if the at least one condition occurs and initiates the at least one trigger, enabling other actions, including:

recording in real time each packet for the at least one selected flow that is associated with the at least one condition, wherein each buffered packet for the selected flow is recorded in real time along with the selected flow's packets that are received after the initiation of the trigger, and

after the initiation of the trigger, recording in real time each packet for the at least one other related flow; and

enabling in real time analysis and play back of the recorded flows regarding at least the occurrence of the condition.

18. The system of claim 17 , wherein the buffer is at least one of a ring buffer or first in first out buffer.

19. The system of claim 17 , wherein the real-time buffering of the at least one selected flow in the buffer, further comprises providing a tag for at least each buffered packet associated with the selected flow, wherein the tag enables reference to at least another consecutive buffered packet in the thread for the selected flow.

20. The system of claim 17 , further comprising editing at least one of the at least one trigger or the selection of the at least one selected flow from the plurality of flows.

21. The system of claim 17 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer.

22. The system of claim 17 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, instantiating a new buffer to separately buffer in real time the dominant selected flow.

23. The system of claim 17 , wherein the at least one trigger is based on an analysis of at least one transaction attribute at layer 7 of the Open Systems Interconnection model, wherein the at least one transaction attribute is associated with the at least one selected flow.

24. The system of claim 17 , wherein playing back the recorded flow, further comprises selecting at least one value for playing back at least a portion of the recorded flow.

25. A processor readable non-transitive storage media that includes instructions for monitoring flows of packets over a network, wherein execution of the instructions by a network device enables actions, comprising:

selecting at least one of a plurality of flows for passive monitoring in real time over a network;

providing at least one trigger that is initiated in real time by at least one condition that is associated with the at least one selected flow;

determining at least one other flow that is related to the at least one selected flow, wherein the at least one other related flow is unassociated with the at least one trigger, and wherein the least one selected flow and the at least one other related flow corresponds to at least the same application, node, or network device;

buffering in real time the at least one selected flow in a buffer, wherein each selected flow is arranged as a thread in the buffer;

if buffering the at least one selected flow dominates a capacity of the buffer over at least one other selected flow, throttling the buffering of the at least one dominant selected flow until the capacity of the buffer is able to buffer the at least one other selected flow;

if the at least one condition occurs and initiates the at least one trigger, enabling other actions, including:

recording in real time each packet for the at least one selected flow that is associated with the at least one condition, wherein each buffered packet for the selected flow is recorded in real time along with the selected flow's packets that are received after the initiation of the trigger, and

after the initiation of the trigger, recording in real time each packet for the at least one other related flow; and

enabling in real time analysis and play back of the recorded flow regarding at least the occurrence of the condition.

26. The media of claim 25 , wherein the buffering of the at least one selected flow in the buffer, further comprises providing a tag for at least each buffered packet associated with the selected flow, wherein the tag enables reference to at least another consecutive buffered packet in the thread for the selected flow.

27. The media of claim 25 , further comprising editing at least one of the at least one trigger or the selection of the at least one selected flow from the plurality of flows.

28. The media of claim 25 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer.

29. The media of claim 25 , further comprising if one of a plurality of selected flows dominates a capacity of the buffer, instantiating a new buffer to separately buffer in real time the dominant selected flow.

30. The media of claim 25 , wherein playing back the recorded flow, further comprises selecting at least one value for playing back at least a portion of the recorded flow.