Networked Probe System Selective WebMail Decoding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network surveillance probes face high processing resource costs when decoding internet communications, particularly with compressed or complex data, leading to buffer overflow and data loss due to limited CPU capacity, especially when dealing with webMail responses which are difficult to identify and decode without disrupting communication.
Innovation Solution
The system optimizes processing by only decoding a subset of data by identifying and targeting HTTP responses from webMail servers using client-to-server communications, determining which server-to-client communications to process, and utilizing a networked probe system to disseminate and manage lists of webMail server IP addresses for intelligent data filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the probe decodes all communication data traversing the network link, then complete network surveillance capability is achieved, but processing resource requirements exceed the probe's fixed CPU capacity
Solution Approach 1:
The probe divides network traffic into segments based on packet type identifiers. Instead of processing all traffic uniformly, the system segments traffic into categories (webmail vs. other traffic) and applies different processing levels to each segment, decoding only webmail traffic in detail while passing other traffic through with minimal processing.
Solution Approach 2:
The probe applies different processing qualities to different portions of network traffic. Webmail traffic receives high-quality processing with full decoding and analysis, while other traffic receives low-quality processing with minimal resource consumption. This local differentiation of processing quality allows the probe to maintain surveillance capability for critical traffic while conserving resources.
2Reliability
If the probe buffers data to maintain processing rate, then data loss is prevented, but buffer capacity is limited and processing delay increases
Solution Approach 1:
The probe extracts and identifies webmail traffic packets from the general network traffic stream using packet type identifiers. By extracting only the relevant webmail packets for detailed processing, the system avoids buffering and processing delays for unrelated traffic, maintaining both data completeness for webmail and efficient time processing.
3Measurement precision
If the probe processes compressed or complex webMail data, then decoding capability is achieved, but CPU cycles are excessively consumed
Solution Approach 1:
The probe performs preliminary identification of webmail traffic packets before detailed decoding, using packet type identifiers to pre-sort traffic. This preliminary action allows the system to prepare for intensive decoding only when necessary, avoiding wasted CPU cycles on non-webmail traffic and maintaining high processing throughput for the actual target data.
Solution Approach 2:
The probe changes processing parameters dynamically based on traffic type. When webmail traffic is detected, the probe switches to high-processing modes with full decoding capabilities. For other traffic, processing parameters are reduced to minimal inspection, allowing the system to maintain decoding capability when needed while preserving overall processing throughput.
Data Source
AI summary
A networked probe system for a communications network (28) comprising at least one user device and at least one network device, comprises a plurality of probes (25). A probe (25) is provided in each path between the or each user device and the or each network device. Each probe (25) stores one or more parameters of interest. The probes (25) monitor communication from the user device for a subset of the communication satisfying the one or more parameters. On determining the presence of the one or more parameters in the subset of the communication, the probe (25) provides a notification to all other probes in the network (28).