Dynamic Snapshot Value for Network Packet Capture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex and dynamic network environments, existing network monitoring technologies face challenges in effectively capturing and analyzing network packets due to the sheer volume of data and diverse packet types, making it difficult to efficiently monitor and store network traffic for troubleshooting and analysis.
Innovation Solution
The implementation of a dynamic snapshot value system for network monitoring computers (NMCs) that adjusts the amount of data captured per packet based on network flow characteristics, such as traffic volume and protocol usage, allowing for increased capture during flow turns and reduced capture during non-interesting periods to manage storage requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a fixed snapshot value is used for packet capture, then storage requirements are reduced, but critical network events may be missed due to insufficient capture during flow turns
Solution Approach 1:
The patent implements dynamic snapshot values that automatically adjust based on network flow characteristics. The system monitors packet capture rates and flow behavior, increasing the snapshot value during flow turns (when traffic direction changes) to capture more data, and decreasing it during stable periods to reduce storage requirements. This dynamic adjustment resolves the contradiction by making the capture volume adaptive rather than fixed.
Solution Approach 2:
The system changes the snapshot value parameter based on detected network conditions. When a flow turn is detected (indicating potential critical events), the snapshot value is increased to capture more packet data. During normal operation, the snapshot value is reduced. This parameter change strategy allows the system to capture sufficient detail during critical events while minimizing storage usage during routine operation.
2Loss of information
If the snapshot value is increased to capture more data during flow turns, then critical events are captured, but storage requirements and processing overhead increase
Solution Approach 1:
The system periodically monitors network flow characteristics and adjusts the snapshot value accordingly. Rather than maintaining a high snapshot value continuously, it only increases the value during detected flow turns (periodic critical events) and reduces it during normal operation. This periodic adjustment pattern captures necessary information during events while minimizing overall storage requirements.
Solution Approach 2:
The snapshot value parameter is dynamically changed based on network conditions. The system detects flow turns and temporarily increases the snapshot value to capture complete packet data during these critical moments. After the event, the parameter is reduced back to a lower value. This selective parameter change ensures complete capture of critical events without the continuous storage overhead of high-value capturing.
3Productivity
If packet capture is performed at high speed networks, then monitoring capability is improved, but the sheer volume of data makes efficient storage and analysis difficult
Solution Approach 1:
The patent applies different snapshot values to different time periods and network conditions rather than using a uniform capture rate. During flow turns (local critical periods), the snapshot value is increased to capture detailed data. During stable periods, the snapshot value is reduced. This local quality approach ensures high monitoring capability when needed while reducing overall data volume for storage and analysis.
Solution Approach 2:
The system performs partial packet capture by using variable snapshot values. Instead of capturing all packets at maximum detail continuously, it captures complete packets only during detected flow turns and uses reduced snapshot values during normal operation. This partial action approach maintains monitoring capability for critical events while significantly reducing the total data volume that requires storage and analysis.
Data Source
AI summary
Embodiments are directed to capturing packets on a network. A snapshot value may be provided for a network monitoring computer (NMC). If the NMC may be provided packets of a network flow, characteristics of the network flow may be monitored. If the characteristics of the network flow indicate that a flow turn may be occurring on the network flow, the snapshot value may be modified by increasing it to a provided value. If conditions indicate that the flow turn may be complete, the snapshot value maybe reset by decreasing it to another provided value. A portion of each of the packets may be captured by the NMC, such that the size of the portion may be equivalent to the snapshot value. The captured portion of each of the packets may be stored in a memory of the NMC.