Instrument monitoring system

1. A network device for interpreting a first data stream, the network device comprising:

a network interface configured to receive captured data streams including the first data stream, the captured data streams sent between an instrument and a controlling device for the instrument;

memory coupled to the network interface, the memory configured to store the captured data streams; and

a processor configured to:

receive the first data stream sent by the instrument to the controlling device; and

identify data frames in the first data stream using a first process thread by:

searching for a first instance of a bit pattern in the first data stream;

identifying bits corresponding to a message length of a first presumed data frame based on a location relative to the first instance of the bit pattern;

identifying a second presumed data frame in the first data stream based on the message length of the first presumed data frame;

determining whether a second instance of the bit pattern exists at a predicted location in the second presumed data frame;

in response to identifying the second instance of the bit pattern at the predicted location, increasing a count of the bit pattern and continue scanning for the bit pattern at predicted locations in presumed data frames until a threshold for the count is reached; and

in response to the threshold for the count being reached, identify the first presumed data frame and the second presumed data frame as actual identified data frames.

2. The network device of claim 1 , wherein said identifying the data frames in the first data stream further comprises:

in response to said identifying the second instance of the bit pattern at a different location from the predicted location, starting a second process thread using the second instance at the different location as an alternate basis for framing the data frames in the first data stream.

3. The network device of claim 1 , wherein the bit pattern identifies a message type of the first presumed data frame.

4. The network device of claim 3 , wherein the bits corresponding to the message length of the first presumed data frame precede bits corresponding to the message type of the first presumed data frame.

5. The network device of claim 1 , wherein a bit rate associated with the first data stream is further determined by the processor as a measure or indicia of running time or utilization of the instrument.

6. The network device of claim 1 , wherein the identified data frames in the first data stream contain run state information for the instrument and the run state information is used to determine running time or utilization of the instrument.

7. The network device of claim 1 , wherein the identified data frames in the first data stream contain data or metadata used by the processor to determine instrument operation, including instrument setpoints and operating values.

8. The network device of claim 7 , wherein a comparison between the instrument setpoints and the operating values is used to trigger alerts or generate visualizations.

9. The network device of claim 7 , wherein a comparison between the data and the metadata of the identified data frames in the first data stream collected over a plurality of instrument runs is used to trigger alerts or generate visualizations.

10. The network device of claim 1 , wherein:

the network device is in communication with a mirroring switch between the instrument and the controlling device; and

the first data stream is mirrored from an original data stream received by the mirroring switch from at least one of the instrument and the controlling device.

11. The network device of claim 1 , wherein the network device is located between the instrument and the controlling device and the network device comprises a proxy server for facilitating communications between the instrument and the controlling device.

12. The network device of claim 1 , the processor further configured to select the bit pattern to be searched based on a known protocol used by the instrument.

13. A method for interpreting a data stream, the method comprising:

receiving the data stream sent by an instrument to a controlling device; and

identifying data frames in the data stream using a first process thread by:

searching for a first instance of a bit pattern in the data stream;

identifying bits corresponding to a message length of a first presumed data frame based on a location relative to the first instance of the bit pattern;

identifying a second presumed data frame in the data stream based on the message length of the first presumed data frame;

determining whether a second instance of the bit pattern exists at a predicted location in the second presumed data frame;

in response to identifying the second instance of the bit pattern at the predicted location, increasing a count of the bit pattern and continue scanning for the bit pattern at predicted locations in presumed data frames until a threshold for the count is reached; and

in response to the threshold for the count being reached, identify the first presumed data frame and the second presumed data frame as actual identified data frames.

14. The method of claim 13 , wherein said identifying the data frames in the data stream further comprises:

in response to said identifying the second instance of the bit pattern at a different location from the predicted location, starting a second process thread using the second instance at the different location as an alternate basis for framing the data frames in the data stream.

15. The method of claim 14 , wherein said identifying the data frames in the data stream further comprises:

in response to identifying a third instance of the bit pattern at a second location different from a third predicted location for the third instance, starting a third process thread using the third instance at the second location as a second alternate basis for framing the data frames in the data stream.

16. The method of claim 15 , further comprising:

in response to the threshold for the count being reached by one of the first, the second and the third process threads, selecting a framing hypothesis for the data stream corresponding to the one of the first, the second and the third process threads where the threshold was reached.

17. The method of claim 13 , wherein said receiving the data stream sent by the instrument comprises proxying, using a proxy server, communications between the instrument and the controlling device.

18. The method of claim 13 , further comprising:

determining instrument utilization based on at least one of run state information collected from the identified data frames in the data stream and a bit rate of the data stream.

19. The method of claim 13 , further comprising:

based on data or metadata collected from the identified data frames in the data stream, triggering one or more alerts or generating visualizations.

20. A non-transitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to interpret a data stream, by executing steps comprising:

receiving the data stream sent by an instrument to a controlling device; and

identifying data frames in the data stream using a first process thread by:

searching for a first instance of a bit pattern in the data stream;

identifying bits corresponding to a message length of a first presumed data frame based on a location relative to the first instance of the bit pattern;

identifying a second presumed data frame in the data stream based on the message length of the first presumed data frame;

determining whether a second instance of the bit pattern exists at a predicted location in the second presumed data frame;

in response to identifying the second instance of the bit pattern at the predicted location, increasing a count of the bit pattern and continue scanning for the bit pattern at predicted locations in presumed data frames until a threshold for the count is reached; and

in response to the threshold for the count being reached, identify the first presumed data frame and the second presumed data frame as actual data frames.