Smart match search method for captured data frames
View Patent ↗Embodiments disclose a method and computer program products for automatically generating a list of search criteria to be used by the computing system when searching captured data frames for one or more resulting data frames having a specific protocol field. The method includes an act of accessing a specific protocol field from one of the captured data frames and an act of accessing protocol definitions. The captured data frame is then interpreted using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the captured data frames. Finally, the specific protocol field and the list of additional protocol field and value pairs are used to automatically identify the one or more resulting data frames having the specific protocol field.
1. In a computing system having access to a plurality of captured data frames present on a communication network that have been captured by a protocol analyzer, at least a subset of the captured data frames being search data frames that are to be searched, the search data frames being structured in accordance with different protocol definitions, the search data frames being structured to include one or more protocol fields structured in accordance with its corresponding protocol definitions, the computing system also having access to a database of protocol definitions that define frame formats for the search data frames by specifying a relationship between the protocol fields of the search data frames, a method for automatically generating a list of search criteria to be used by the computing system when searching the search data frames for one or more resulting data frames having a specific protocol field, the method comprising:
an act of accessing a specific protocol field from one of the captured data frames;
an act of accessing the protocol definitions;
an act of interpreting the captured data frame using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the search data frames; and
an act of using the specific protocol field and the list of additional protocol field and value pairs to automatically identify the one or more resulting data frames having the specific protocol field.
2. The method in accordance with claim 1 further comprising:
an act of filtering the list of additional protocol field and value pairs such that any protocol field with more than a predetermined number of values is removed from the list of additional protocol field and value pairs.
3. The method in accordance with claim 1 , wherein the protocol definitions are configured in a hierarchical tree-like structure, the act of interpreting the captured data frame using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the search data files comprising:
act of interpreting the captured data frame using the hierarchical tree-like protocol definitions to identify those protocol field and value pairs that are common in any path to a location of the specific protocol field in the hierarchical tree-like structure
an act of generating a list of the identified protocol field and value pairs.
4. The method in accordance with claim 3 further comprising:
an act of generating, based on the protocol definitions, one or more data frames that include different values for the identified protocol fields;
an act of analyzing the generated one or more data frames to identify only those generated data frames that include the specific protocol field; and
an act of identifying as search criteria protocol field and value pairs that are common to substantially all the generated data frames.
5. The method in accordance with claim 4 further comprising:
an act of ascertaining the number of different values that an identified protocol field has; and
an act of eliminating any identified protocol fields with more than a predetermined number of values from the search criteria.
6. The method in accordance with claim 1 , wherein the act of using the specific protocol field and value pair and the list of additional protocol field and value pairs to automatically identify the one or more resulting data frames having the specific protocol field comprises:
an act of translating the additional protocol field and value pairs into fixed length values at a fixed byte offset in the captured data frame; and
an act of finding those search data frames that include the fixed length values at the fixed byte offset in the search data frames.
7. A computer program product for use in a computing environment including a computing system having access to a plurality of captured data frames present on a communication network that have been captured by a protocol analyzer, at least a subset of the captured data frames being search data frames that are to be searched, the search data frames being structured in accordance with different protocol definitions, the search data frames being structured to include one or more protocol fields structured in accordance with its corresponding protocol definition, the computing system also having access to a database of protocol definition files that define frame formats for the search data frames by specifying a relationship between the protocol fields of the search data frames, the computer program product for implementing a method for allowing the computing system to automatically generate a list of search criteria to be used by the computing system when searching the search data frames for one or more resulting data frames having a specific protocol field, the computer program product comprising one or more computer-readable media having thereon computer-executable instructions that, when executed by one or more processors of the computing environment, cause the computing environment to perform the method, the method comprising:
an act of accessing a specific protocol field from one of the captured data frames;
an act of accessing the protocol definitions;
an act of interpreting the captured data frame using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the search data frames; and
an act of using the specific protocol field and the list of additional protocol field and value pairs to automatically identify the one or more resulting data frames having the specific protocol field.
8. A computer program product in accordance with claim 7 , wherein the computer-readable media has thereon computer-executable instructions that, when executed by the one or more processors, further cause the computing system to perform the following:
an act of filtering the list of additional protocol field and value pairs such that any protocol field with more than a predetermined number of values is removed from the list of additional protocol field and value pairs.
9. A computer program product in accordance with claim 7 , wherein the protocol definitions are configured in a hierarchical tree-like structure, wherein the act of interpreting the captured data frame using the protocol definitions to generate a list of additional protocol field and value pairs to use for searching the search data files comprises the following:
an act of interpreting the captured data frame using the hierarchical tree-like protocol definitions to identify those protocol field and value pairs that are common in any path to a location of the specific protocol field in the hierarchical tree-like structure; and
an act of generating list of the identified protocol field and value pairs.
10. A computer program product in accordance with claim 9 , wherein the computer-readable media has thereon computer-executable instructions that, when executed by the one or more processors, further cause the computing system to perform the following:
an act of generating, based on the protocol definitions, one or more data frames that include different values for the identified protocol fields;
an act of analyzing the generated one or more data frames to identify only those generated data frames that include the specific protocol field; and
an act of identifying as search criteria protocol field and value pairs that are common to substantially all the generated data frames.
11. A computer program product in accordance with claim 10 , wherein the computer-readable media has thereon computer-executable instructions that, when executed by the one or more processors, further cause the computing system to perform the following:
an act of ascertaining the number of different values that an identified protocol field has; and
an act of eliminating any identified protocol fields with more ten values from the search criteria.
12. The method in accordance with claim 7 , wherein the act of using the specific protocol field and value pair and the list of additional protocol field and value pairs to automatically identify the one or more resulting data frames having the specific protocol field comprises:
an act of translating the additional protocol field and value pairs into fixed length values at a fixed byte offset in the captured data frame; and
an act of finding those search data frames that include the fixed length values at the fixed byte offset.
13. A computer program product in accordance with claim 7 , wherein the one or more computer-readable media is one of physical memory media, physical storage media, or recordable media.
14. In a computing system including a protocol definition database that includes a plurality of protocol definitions, the plurality of protocol definitions defining interrelationships of protocol fields that are included in data frames of network traffic, a method for analyzing the protocol definitions to automatically generate a library of search criteria for use in searching at least some of the data frames for a specific kind of frame or a frame containing a specific protocol field, the method comprising:
displaying a graphical tree-like representation of protocol definitions, wherein the graphical tree-like representation is configured such that sub-branches of the tree-like representation define protocol fields of at least some of the data frames and wherein sub-branches may be embedded within other sub-branches;
receiving user interaction that selects a path of one or more sub-branches of the graphical tree-like representation in order to identify the one or more sub-branches defining a user desired specific kind of frame or protocol field; and
the computing system identifying those protocol fields that are commonly encountered in the path of the one or more sub-branches before encountering the one or more sub-branches defining the user desired specific kind of frame or protocol field.
15. The method in accordance with claim 14 further comprising:
receiving user input that causes the identified commonly encountered protocol fields to be stored in a memory as a library of search criteria for the specific kind of frame or protocol field.
16. The method in accordance with claim 15 , wherein the library of search criteria is accessible by the computing system and is used to search at least some of a plurality of captured data frames for the specific kind of frame or protocol field.
17. The method in accordance with claim 14 further comprising:
receiving user input that causes the identified commonly encountered protocol fields to be used as search criteria by the computing system to search at least some of a plurality of captured data frames for the specific kind of frame or protocol field.
18. A computer program product comprising computer executable instructions that when executed are capable of implementing the method of claim 14 .