Techniques for traffic capture and reconstruction

1. A method for reconstructing application-layer traffic flowing between a plurality of client devices and a cloud computing platform, comprising:

receiving packets transported between client devices and servers operable in a cloud computing platform;

saving the received packets to a zero-copy queue, wherein the zero-copy queue is configured for storing the packets in a shared memory for subsequent processing;

analyzing the packets saved in the zero-copy memory to identify their respective at least one session;

reconstructing each of the at least one identified session into a session window having a configurable size, wherein a reconstructed session includes application-layer requests and application-layer responses to and from a plurality of cloud-based applications hosted on the servers; and

for each of the at least one identified session, matching each application-layer request to a corresponding application-layer response based on a matching identifier and a time-interval threshold to result with the reconstructed application-layer traffic.

2. The method of claim 1 , further comprising:

sending each application-layer request to an application-layer server;

receiving a corresponding application-layer response in response to the request provided by the application-layer server.

3. The method of claim 2 , further comprising:

receiving pairs matching application-layer requests and application-layer responses designated by file names of the pairs;

retrieving the designated application-layer responses from the shared memory; and

parsing contents of each of the retrieved designated application-layer responses.

4. The method of claim 1 , wherein a plurality of application-layer requests and application-layer responses are received in a single session.

5. The method of claim 4 , wherein reconstructing each of the at least one identified session is performed by an independent reconstruction process.

6. The method of claim 5 , further comprising:

distributing the received packets to the independent reconstruction process using a unified distribution function.

7. The method of claim 1 , wherein identification of the at least one session is based on at least one of: an IP-tuple of the at least one session, a sequence number of a SYN packet, and a SYN-ACK packet sent when the session was initiated.

8. The method of claim 1 , wherein reconstructing each of the at least one identified session further comprises:

identifying packets as either application-layer requests or application-layer responses;

marking each identified application-layer request and application-layer response with a matching identifier;

writing the marked application-layer requests and application-layer responses to any one of: an output queue, an output buffer, an output file, and an output directory of a file system.

9. The method of claim 8 , further comprising:

enumerating the requests and responses in the reconstructed session.

10. The method of claim 8 , further comprising:

detecting holes in the reconstructed session created due to dropped packets.

11. The method of claim 8 , wherein any one of the output queue, the output buffer, the output file, and the output directory are part of the shared memory.

12. The method of claim 1 , wherein matching application-layer requests to application-layer corresponding responses further comprises:

filtering application-layer requests based on a whitelist; and

saving application-layer filtered responses to the shared memory.

13. The method of claim 1 , wherein the application-layer traffic including the application-layer requests and responses is transported using a hypertext transfer protocol 1.1 (HTTP/1.1).

14. The method of claim 1 , wherein the method operates in a proxy mode where the application-layer traffic is not relayed to the cloud-computing platform.

15. The method of claim 1 , wherein the method operates in a tap mode where the application-layer traffic is relayed to the cloud-computing platform.

16. The method of claim 1 , wherein the matching identifier includes at least matching an IP-tuple, a sequence number associated with the respective packet, and a time stamp.

17. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1 .

18. An appliance for reconstructing application-layer traffic flowing between a plurality of client devices and a cloud computing platform, comprising:

a network interface card configured to receive packets transported between client devices and servers operable in a cloud computing platform, wherein the network interface card is further configured to save the received packets to a zero-copy queue, wherein the zero-copy queue is configured for storing the packets in a shared memory for subsequent processing;

a flow processor configured to analyze the packets saved in the zero-copy memory to identify their respective at least one session, wherein the flow processor is further configured to reconstruct each of the at least one identified session into a session window having a configurable size, wherein a reconstructed session includes application-layer requests and application-layer responses to and from a plurality of cloud-based applications hosted on the servers; and

a request feeding processor configured to match, for each of the identified sessions, each request to a corresponding response based on a matching identifier and a time-interval threshold to result with the reconstructed application-layer traffic.

19. The appliance of claim 18 , further comprising:

an application-layer server; and

a response retrieval processor configured to retrieve a corresponding response in response to the request provided by the application-layer server.

20. The appliance of claim 18 , further comprising:

an application-layer parser configured to:

receive pairs matching requests and responses designated by file names of the pairs;

retrieve the designated responses from the shared memory; and

parse contents of each of the retrieved responses.

21. A system for reconstructing application-layer traffic flowing between a plurality of client devices and a cloud computing platform, comprising:

a processor; and

a shared memory, the memory containing instructions that, when executed by the processor, configure the system to:

receive packets transported between client devices and servers operable in a cloud computing platform;

save the received packets to a zero-copy queue, wherein the zero-copy queue is configured for storing the packets in the shared memory for subsequent processing;

analyze the packets saved in the zero-copy memory to identify their respective at least one session;

reconstruct each of the at least one identified session into a session window having a configurable size, wherein a reconstructed session includes application-layer requests and application-layer responses to and from a plurality of cloud-based applications hosted on the servers; and

for each of the identified session, match each application-layer request to a corresponding application-layer response based on a matching identifier and a time-interval threshold to result with the reconstructed application-layer traffic.

22. The system of claim 21 , wherein the system is further configured to:

send each application-layer request to an application-layer server;

receive a corresponding application-layer response in response to the request provided by the application-layer server.

23. The system of claim 22 , wherein the system is further configured to:

receive pairs matching application-layer requests and application-layer responses designated by file names of the pairs;

retrieve the designated application-layer responses from the shared memory; and

parse contents of each of the retrieved designated application-layer responses.

24. The system of claim 21 , wherein a plurality of application-layer requests and application-layer responses are received in a single session.

25. The system of claim 24 , wherein reconstructing each of the at least one identified sessions is performed by an independent reconstruction process.

26. The system of claim 25 , wherein the system is further configured to:

distribute the received packets to the independent reconstruction process using a unified distribution function.

27. The system of claim 21 , wherein identification of the at least one session is based on at least one of: an IP-tuple of the at least one session, a sequence number of a SYN packet, and a SYN-ACK packet sent when the session was initiated.

28. The system of claim 21 , wherein the system is further configured to:

identify packets as either application-layer requests or application-layer responses;

mark each identified application-layer request and application-layer response with a matching identifier;

write the marked application-layer requests and application-layer responses to any one of: an output queue, an output buffer, an output file, and an output directory of a file system.

29. The system of claim 28 , wherein the system is further configured to:

enumerate application-layer requests and application-layer responses in the reconstructed session.

30. The system of claim 28 , wherein the system is further configured to:

detect holes in the reconstructed session created due to dropped packets.

31. The system of claim 28 , wherein any one of the output queue, the output buffer, the output file, and the output directory are part of the shared memory.

32. The system of claim 21 , wherein the system is further configured to:

filter requests based on a whitelist; and

save filtered responses to the shared memory.

33. The system of claim 21 , wherein the application-layer traffic is transported using a hypertext transfer protocol 1.1 (HTTP/1.1).

34. The system of claim 21 , wherein the system is configured to operate in a proxy mode where the application-layer traffic is not relayed to the cloud-computing platform.

35. The system of claim 21 , wherein the system is configured to operate in a tap mode where the application-layer traffic is relayed to the cloud-computing platform.

36. The system of claim 21 , wherein the matching identifier includes at least matching an IP-tuple, a sequence number associated with the respective packet, and a time stamp.