Method and apparatus for flexible application-aware monitoring in high bandwidth networks

1. An apparatus comprising:

at least one pre-capture filter,

a plurality of post-capture filters, wherein each post-capture filter is associated with an application type and wherein the plurality of post-capture filters includes post-capture filters for at least two of: a video application type, an audio application type, and a text application type; and

a plurality of monitoring stations, wherein each monitoring station is associated with an application type,

wherein the at least one pre-capture filter is operative to:

receive a plurality of packets transmitted in a network, and for each received packet to:

identify an application type of the received packet, and, responsively to the identified application type, to

select a post-capture filter from the plurality of post-capture filters, such that the selected post-capture filter is associated with the identified application-type, and to

send the received packet to the selected post-capture filter; and

wherein each of said plurality of application-type specific post capture filters is operative to:

receive from said at least one pre-capture filter packets of a specific application type and to distribute said packets of said specific application type among at least two monitoring stations associated with said specific application type.

2. An apparatus according to claim 1 , and wherein at least one of said plurality of post capture filters is operative to limit the rate of packets transmitted to said at least one of the plurality of monitoring stations.

3. An apparatus according to claim 2 , and wherein said at least one post capture filter is associated with a plurality of monitoring stations, and is operative, upon receipt of an indication from one of said monitoring stations associated therewith, to balance a load of packets transmitted to at least one of said monitoring stations.

4. An apparatus according to claim 3 , and wherein said indication comprises back-pressure from said at least one of said monitoring stations.

5. An apparatus according to claim 3 , and wherein said indication comprises an overload message transmitted by said at least one of said monitoring stations.

6. An apparatus according to claim 1 , and wherein said at least one pre capture filter functions as a demultiplexer.

7. A method for monitoring data transmitted over a communications network, the method comprising:

employing a pre capture filter to receive a plurality of packets transmitted in said communications network; and for each received packet;

employing said pre capture filter to identify an application type of the received packet,

employing said pre capture filter to select a post-capture filter from a plurality of post-capture filters, such that the selected post-capture filter is associated with the identified application-type and wherein the plurality of post-capture filters includes post-capture filters for at least two of: a video application type, an audio application type, and a text application type; and

employing said pre capture filter to send the received packet to the selected post-capture filter; and

employing said selected post capture filter to distribute the plurality of received packets among a plurality of monitoring stations that are each associated with the identified application type.

8. A method according to claim 7 , and also comprising:

employing at least one of said plurality of post capture filters for limiting the rate of packets transmitted to at least one of said plurality of monitoring stations.

9. A method according to claim 8 , and wherein said at least one post capture filter is associated with the plurality of monitoring stations, and, said limiting the rate comprises, upon receipt of an indication from at least one of said monitoring stations associated therewith, balancing a load of packets transmitted to said at least one of said monitoring stations.

10. A method according to claim 9 , and wherein said indication comprises back-pressure from said at least one of said monitoring stations.

11. A method according to claim 9 , and wherein said indication comprises an overload message transmitted by said at least one of said monitoring stations.

12. A method according to claim 7 , further comprising employing said at least one pre-capture filter as a demultiplexer.