Network Interface Datagram Re-sequencing for High-Speed Recording
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for recording computer communications over networks are overwhelmed by high data rates, leading to data loss due to insufficient processing capabilities, especially when using promiscuous mode tapping on advanced networks.
Innovation Solution
A method and system where a recording computer's network interface allocates and orders datagrams based on a session identifier within the datagrams, re-sequences them by timestamp, and checks for error conditions, reducing processing demands by assuming most datagrams are correctly addressed and of the expected type, thereby minimizing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If promiscuous mode tapping is used to collect all packets on the network, then complete communication data can be captured, but the recording computer becomes overwhelmed by high data rates (10 gigabits per second) and experiences processing overload
Solution Approach 1:
The patent segments the network traffic processing by introducing a dedicated network interface card that separates packet capture functions from recording computer processing. The NIC captures and pre-processes packets at the network interface level, filtering and organizing data before passing selected packets to the recording computer, thereby dividing the overwhelming processing task into manageable segments.
Solution Approach 2:
The dedicated network interface card acts as an intermediary between the network and the recording computer. It receives all network traffic, performs initial filtering and organization, and selectively forwards relevant packets to the recording computer, preventing the computer from being overwhelmed by raw network traffic while ensuring complete capture of necessary communication data.
2Reliability
If comprehensive packet filtering and processing is performed on all received datagrams, then data accuracy can be ensured, but processing time and resource consumption increase significantly
Solution Approach 1:
The patent applies partial action by implementing selective filtering at the network interface level. Instead of performing comprehensive processing on all packets, the NIC performs sufficient filtering to identify and forward only relevant packets to the recording computer. This partial processing at the interface level prevents processing time bottlenecks while maintaining data accuracy for captured communications.
Solution Approach 2:
The dedicated network interface card performs preliminary filtering, organization, and validation of packets before they reach the recording computer. By pre-processing packets at the network interface level, the system ensures data accuracy is established early in the capture process, eliminating the need for time-consuming re-processing later while maintaining reliable data capture.
3Productivity
If expensive high-performance computers are used as recording computers, then data processing capability is sufficient, but system cost increases
Solution Approach 1:
The patent extracts the high-performance packet capture and pre-processing functions from the recording computer and places them in a dedicated network interface card. This extraction allows the use of less expensive recording computers while maintaining sufficient data processing capability, as the expensive processing functions are handled by specialized hardware rather than requiring an expensive general-purpose computer.
Solution Approach 2:
The patent enables the use of more affordable recording computers by offloading intensive processing tasks to dedicated network interface hardware. The recording computer can be a lower-cost device since the expensive high-speed packet capture and filtering functions are handled by the specialized NIC, reducing overall system cost while maintaining processing capability.
Data Source
AI summary
Computer communications that are to be recorded are visible to a network interface on a recording computer. The network interface receives the packets to be recorded. The network layer of the recording computer implements a subset of the normal IP module in the network layer. The IP module in the network layer assumes that most IP datagrams are correctly addressed, internally consistent and of the expected protocol type. The recording computer allocates the received datagrams to a recording session based upon at least a first value of a field that is at a fixed position within the datagram. The datagrams for a session are ordered into an ordered recording stream based upon a timestamp within the datagram. The datagrams are also checked for criteria that indicate an error condition. The allocated and ordered datagrams are recorded or associated with other datagrams that have been allocated to the same session.