Trigger based recording of flows with play back

1. A method for improving the monitoring of flows of packets over a network, wherein a network computer performs the method by executing actions, comprising:

selecting one or more of a plurality of flows for passive monitoring in real time over a network, wherein one or more other flows are related to the selected one or more flows;

providing one or more triggers that is initiated in real time by one or more conditions that are associated with the one or more selected flows, wherein the one or more other flows are unassociated with the one or more conditions;

buffering in real time the one or more selected flows in a buffer, wherein each selected flow is arranged as a thread in the buffer;

when one of the plurality of selected flows dominates a capacity of the buffer, executing one or more actions including:

modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer; or

instantiating a new buffer to separately buffer in real time the dominant selected flow; and

when the one or more conditions occurs and initiates the one ormore triggers, recording in real time each packet for the one or more selected flows that is associated with the one or more conditions and each packet for the one or more other flows, wherein each buffered packet for the one or more selected flows is recorded in real time along with the selected flow's packets and each packet for the one or more other flows that are received after the initiation of the one or more triggers.

2. The method of claim 1 , further comprising:

selecting at least one value of the one or more recorded flows, wherein the at least one selected value includes time, byte pattern, offset, sequence number, checksum, pointer, destination port, source port, destination address, source address or payload; and

employing the selected value to play back or retrieve at least a portion of the one or more recorded flows.

3. The method of claim 1 , further comprising enabling in real time analysis and play back of the one or more recorded flows regarding the occurrence of the one or more conditions.

4. The method of claim 1 , further comprising providing a dashboard to control the playback and display of the one or more recorded flows.

5. The method of claim 1 , further comprising employing information from one or more of a plurality of protocols and one or more of a plurality of protocol layers to identify each packet corresponding to the one or more selected flows.

6. The method of claim 1 , wherein the one or more conditions, further comprises information from one or more of a plurality of protocols and one or more of a plurality of protocol layers.

7. A network computer for improving the monitoring of flows of packets over a network, comprising:

a transceiver device for monitoring communication over the network;

a memory device for storing at least instructions; and

a processor device that is operative to execute instructions that enable actions, including:

selecting one or more of a plurality of flows for passive monitoring in real time over a network, wherein one or more other flows are related to the selected one or more flows;

providing one or more triggers that is initiated in real time by one or more conditions that are associated with the one or more selected flows, wherein the one or more other flows are unassociated with the one or more conditions;

buffering in real time the one or more selected flows in a buffer, wherein each selected flow is arranged as a thread in the buffer;

when one of the plurality of selected flows dominates a capacity of the buffer, further enabling one or more actions including:

modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer; or

instantiating a new buffer to separately buffer in real time the dominant selected flow; and

when the one or more conditions occurs and initiates the one or more triggers, recording in real time each packet for the one or more selected flows that is associated with the one or more conditions and each packet for the one or more other flows, wherein each buffered packet for the one or more selected flows is recorded in real time along with the selected flow's packets and each packet for the one or more other flows that are received after the initiation of the one or more triggers.

8. The network computer of claim 7 , further comprising:

selecting at least one value of the one or more recorded flows, wherein the at least one selected value includes time, byte pattern, offset, sequence number, checksum, pointer, destination port, source port, destination address, source address or payload; and

employing the selected value to play back or retrieve at least a portion of the one or more recorded flows.

9. The network computer of claim 7 , further comprising enabling in real time analysis and play back of the one or more recorded flows regarding the occurrence of the one or more conditions.

10. The network computer of claim 7 , further comprising providing a dashboard to control the playback and display of the one or more recorded flows.

11. The network computer of claim 7 , further comprising employing information from one or more of a plurality of protocols and one or more of a plurality of protocol layers to identify each packet corresponding to the one or more selected flows.

12. The network computer of claim 7 , wherein the one or more conditions, further comprises information from one or more of a plurality of protocols and one or more of a plurality of protocol layers.

13. A system for improving the monitoring of flows of packets over a network, comprising:

a first network computer that includes:

a transceiver device for monitoring communication over the network;

a memory device for storing at least instructions; and

a processor device that is operative to execute instructions that enable actions, comprising communicating one or more flows of packets with at least a second network computer; and

a third network computer that includes:

a transceiver device for monitoring communication between the first network computer and the second network computer;

a memory device for storing at least instructions; and

a processor device that is operative to execute instructions that enable actions, comprising:

selecting one or more of the plurality of flows for passive monitoring in real time over a network, wherein one or more other flows are related to the selected one or more flows;

providing one or more triggers that is initiated in real time by one or more conditions that are associated with the one or more selected flows, wherein the one or more other flows are unassociated with the one or more conditions;

buffering in real time the one or more selected flows in a buffer, wherein each selected flow is arranged as a thread in the buffer; and

when one of the plurality of selected flows dominates a capacity of the buffer, enabling one or more further actions including:

modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer; or

instantiating a new buffer to separately buffer in real time the dominant selected flow;

when the one or more conditions occurs and initiates the one or more triggers, recording in real time each packet for the one or more selected flows that is associated with the one or more conditions and each packet for the one or more other flows, wherein each buffered packet for the one or more selected flows is recorded in real time along with the selected flow's packets and each packet for the one or more other flows that are received after the initiation of the one or more triggers.

14. The system of claim 13 , wherein the actions of the third network computer further comprise:

selecting at least one value of the one or more recorded flows, wherein the at least one selected value includes time, byte pattern, offset, sequence number, checksum, pointer, destination port, source port, destination address, source address or payload; and

employing the selected value to play back or retrieve at least a portion of the one or more recorded flows.

15. The system of claim 13 , wherein the actions of the third network computer further comprise enabling in real time analysis and play back of the one or more recorded flows regarding the occurrence of the one or more conditions.

16. The system of claim 13 , wherein the actions of the third network computer further comprise providing a dashboard to control the playback and display of the one or more recorded flows.

17. The system of claim 13 , wherein the actions of the third network computer further comprise employing information from one or more of a plurality of protocols and one or more of a plurality of protocol layers to identify each packet corresponding to the one or more selected flows.

18. The system of claim 13 , wherein the one or more conditions, further comprises information from one or more of a plurality of protocols and one or more of a plurality of protocol layers.

19. A processor readable non-transitive storage media that includes instructions for improving the monitoring of flows of packets over a network, wherein execution of the instructions by a network computer enables actions, comprising:

selecting one or more of a plurality of flows for passive monitoring in real time over a network, wherein one or more other flows are related to the selected t one or more flows;

providing one or more triggers that is initiated in real time by one or more conditions that are associated with the one or more selected flows, wherein the one or more other flows are unassociated with the one or more conditions;

buffering in real time the one or more selected flows in a buffer, wherein each selected flow is arranged as a thread in the buffer;

when one of the plurality of selected flows dominates a capacity of the buffer, enabling one or more further actions including:

modifying the real-time buffering of the dominant selected flow to reduce an amount of corresponding packets buffered in the buffer; or

instantiating a new buffer to separately buffer in real time the dominant selected flow; and

when the one or more conditions occurs and initiates the one or more triggers, recording in real time each packet for the one or more selected flows that is associated with the one or more conditions and each packet for the one or more other flows, wherein each buffered packet for the one or more selected flows is recorded in real time along with the selected flow's packets and each packet for the one or more other flows that are received after the initiation of the one or more triggers.

20. The media of claim 19 , further comprising:

selecting at least one value of the one or more recorded flows, wherein the at least one selected value includes time, byte pattern, offset, sequence number, checksum, pointer, destination port, source port, destination address, source address or payload; and

employing the selected value to play back or retrieve at least a portion of the one or more recorded flows.

21. The media of claim 19 , further comprising enabling in real time analysis and play back of the one or more recorded flows regarding the occurrence of the one or more conditions.

22. The media of claim 19 , further comprising providing a dashboard to control the playback and display of the one or more recorded flows.

23. The media of claim 19 , further comprising employing information from one or more of a plurality of protocols and one or more of a plurality of protocol layers to identify each packet corresponding to the one or more selected flows.

24. The media of claim 19 , wherein the one or more conditions, further comprises information from one or more of a plurality of protocols and one or more of a plurality of protocol layers.