Apparatus, System, and Method for Enhanced Monitoring and Interception of Network Data
An apparatus includes a plurality of microcode controlled state machines and a first circuit. At least one of the microcode controlled state machines is configured to process network data received by the apparatus and to apply a first rule to the network data to produce an associated output indicating a first characteristic of at least a portion of the network data. The first circuit is configured to store a first portion of the network data received by the apparatus prior to the determination of the first characteristic, and to store a second portion of the network data received by the apparatus subsequent to the determination of the first characteristic. The first circuit is also configured to preserve the first portion and the second portion of the network data in response to the determination of the first characteristic.
1 . An apparatus, comprising:
a plurality of microcode controlled state machines, at least one of the plurality of microcode controlled state machines being configured to process network data received by the apparatus and to apply a first rule to the network data to produce an associated output indicating a first characteristic of at least a portion of the network data; and
a first circuit configured to store a first portion of the network data received by the apparatus prior to the determination of the first characteristic, and to store a second portion of the network data received by the apparatus subsequent to the determination of the first characteristic, the first circuit also being configured to preserve the first portion and the second portion of the network data in response to the determination of the first characteristic.
2 . The apparatus of claim 1 , wherein the at least one of the plurality of microcode controlled state machines is configured to direct the first circuit to preserve the first portion and the second portion of the network data in response to the determination of the first characteristic.
3 . The apparatus of claim 2 , wherein the at least one of the plurality of microcode controlled state machines is configured to generate an indication to the first circuit a configurable time interval after the determination of the first characteristic, the indication to direct the first circuit to preserve the first portion and the second portion of the network data.
4 . The apparatus of claim 1 , further comprising a second circuit configured to:
generate a logical combination of the associated output of each of the plurality of microcode controlled state machines; and
direct the first circuit to preserve the first portion and the second portion of the network data based on the logical combination.
5 . The apparatus of claim 4 , wherein the second circuit is configured to generate an indication to the first circuit a configurable time interval after the generation of the logical combination, the indication to direct the first circuit to preserve the first portion and the second portion of the network data.
6 . The apparatus of claim 4 , wherein the second circuit is configured to generate an indication to the first circuit a configurable number of received packets after the generation of the logical combination, the indication to direct the first circuit to preserve the first portion and the second portion of the network data.
7 . The apparatus of claim 1 , wherein the at least one of the plurality of microcode controlled state machines is configured to apply a second rule to the network data to determine the first portion and the second portion of the network data.
8 . The apparatus of claim 7 , wherein:
the at least one of the plurality of microcode controlled state machines is configured to apply the second rule to select a subset of data flows from a set of data flows included in the network data.
9 . The apparatus of claim 8 , wherein the at least one of the plurality of microcode controlled state machines is configured to generate an indication to the first circuit a configurable number of received packets after the determination of the first characteristic, the indication to direct the first circuit to preserve the first portion and the second portion of the network data, wherein the received packets are included in the subset of data flows.
10 . The apparatus of claim 1 , wherein:
the first circuit is configured to preserve the first portion and the second portion of the network data in a first area of memory; and
the first circuit is configured to store a third portion of network data received by the apparatus subsequent to receipt of the second portion of the network data in a second area of memory configured as a circular buffer.
11 . The apparatus of claim 1 , further comprising an output port, and wherein:
the first circuit is configured to preserve the first portion and the second portion of the network data in an area of memory; and
the apparatus is configured to convey the first portion and the second portion of the network data from the area of memory through the output port in response to an indication received by the apparatus.
12 . The apparatus of claim 1 , further comprising a second circuit, and wherein:
the first circuit is configured to preserve the first portion and the second portion of the network data in an area of memory; and
the second circuit is configured to push the first portion and the second portion of the network data from the area of memory across a network independent of a solicitation from the network.
13 . The apparatus of claim 1 , wherein the first characteristic is determined based on an occurrence of a bit pattern in the at least a portion of the network data.
14 . The apparatus of claim 1 , wherein the first characteristic is determined based on an occurrence of a pattern of variation in a data rate associated with the at least a portion of the network data.
15 . The apparatus of claim 1 , further comprising a second circuit configured to process the first network data and the second network data after preservation of the first network data and the second network data by the first circuit to determine whether at least one of the first network data and the second network data implicates a second characteristic.
16 . The apparatus of claim 15 , wherein:
the first characteristic is determined based on an occurrence of a bit pattern in the at least a portion of the network data; and
the second characteristic is determined based on an occurrence of a pattern of variation in a data rate associated with the at least one of the first network data and the second network data.
17 . The apparatus of claim 15 , wherein:
the first characteristic is determined based on an occurrence of a pattern of variation in a data rate associated with the at least a portion of the network data; and
the second characteristic is determined based on an occurrence of a bit pattern in the at least one of the first network data and the second network data.
18 . The apparatus of claim 15 , wherein:
the second circuit is configured to determine whether the at least one of the first network data and the second network data implicates the second characteristic based on performance of a mathematical operation on the first network data and the second network data; and
the mathematical operation includes at least one of a convolution, a moving average, a sum of squares, a linear filtering operation, and a nonlinear filtering operation.
19 . The apparatus of claim 15 , wherein:
the second characteristic is associated with an alert indication; and
the second circuit is configured to generate the alert indication.
20 . The apparatus of claim 15 , further comprising a third circuit configured to push an indication across a network independent of a solicitation from the network, the indication being that the at least one of the first network data and the second network data implicates the second characteristic.