Dedicated Network Interface for High-Speed Communication Recording
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for recording computer communications over networks are resource-intensive and prone to data loss due to high processing demands, especially when handling high-speed data rates like 10 gigabits per second, which can overload recording computers and result in lost communications.
Innovation Solution
Implementing a network interface on the recording computer that uses a subset of the IP module to allocate packets based on a fixed value within the packet, rather than checking every IP packet, thereby reducing processing load and preventing data loss by associating packets with specific sessions without full network layer processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If promiscuous mode tapping is used to collect all packets on the network, then complete communication recording is achieved, but the recording computer becomes overloaded and data loss occurs
Solution Approach 1:
The patent segments the packet processing function by separating the collection function (performed by the network interface card in promiscuous mode) from the filtering and recording function (performed by the recording computer). This allows the NIC to capture all packets at line rate while the recording computer only processes packets matching specific criteria, thus maintaining recording completeness while reducing processing load.
Solution Approach 2:
The patent introduces an intermediary filtering mechanism that sits between the network interface card and the recording computer. This intermediary layer filters packets based on session identifiers and other criteria before passing them to the recording computer, reducing the volume of data that needs to be processed and stored while ensuring that all relevant communications are captured.
2Measurement precision
If full IP module processing is applied to every packet, then accurate packet allocation is achieved, but processing time and resource usage increase significantly
Solution Approach 1:
The patent applies partial processing by implementing a two-stage packet filtering approach. First, a quick filter checks easily accessible packet fields (such as destination IP address or session identifier) to determine if the packet should be recorded. Only packets that pass this initial filter undergo more thorough processing. This partial action approach maintains accurate packet allocation while significantly reducing the average processing time per packet.
3Speed
If high-speed network interfaces are used to handle 10 gigabits per second data rates, then data capture capability is improved, but the complexity and cost of the recording system increases
Solution Approach 1:
The patent extracts the high-speed packet capture function from the recording computer and assigns it to a dedicated network interface card capable of operating at 10 gigabits per second. The recording computer then receives only the filtered subset of packets that require processing and storage. This extraction allows the system to handle high-speed networks without requiring the recording computer itself to have high-speed processing capabilities, thereby reducing system complexity and cost.
Data Source
AI summary
Computer communications that are to be recorded are visible to a network interface on a recording computer. The network interface receives the packets to be recorded. The network layer of the recording computer implements a subset of the normal IP module in the network layer. Instead of checking every IP packet, the IP module in the network layer assumes that most IP packets are correctly addressed, internally consistent and of the expected protocol type. The recording computer allocates the received packets to a recording session based upon the value of a field that is at a fixed position within the packet. Packets that are allocated to a session are recorded or associated with other packets that have been allocated to the same session.