Packet Capture Device Segmentation for Zero-Lag Network Monitoring

Solution Overview

Problem

Existing packet capturing devices experience a time lag before starting to capture packets after receiving an instruction to start capturing, which hinders immediate analysis of failures in network flows.

Innovation Solution

A packet capturing device with a first capturing function unit that accumulates and converts packets matching target flow conditions, and a second capturing function unit with a ring buffer structure to accumulate packets during the time lag period, ensuring no packet omission upon receiving the capture instruction.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a single capturing function unit is used to process packets after flow condition registration, then the device structure remains simple, but packets are omitted during the time lag period before capturing starts

Engineering Contradiction:

Improvepacket capture completenessVSAvoidcapturing function unit structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The capturing function unit is divided into two independent segments: a first capturing function unit that processes packets after flow condition registration, and a second capturing function unit that processes packets during the time lag period. This segmentation allows each unit to handle specific time periods independently, ensuring no packet omission while maintaining manageable complexity through functional separation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The second capturing function unit performs preliminary action by accumulating packets during the time lag period before the first capturing function unit starts processing. This preliminary capture ensures that packets arriving during the initialization phase are not lost, and the captured data can be seamlessly integrated with the main capture process.

Inventive Principle:

Principle #10Preliminary action

2Loss of time

If packet accumulation and flow condition registration are performed sequentially in a single unit, then the processing logic remains simple, but the time lag before capturing starts increases

Engineering Contradiction:

Improvetime lag before capturingVSAvoidcapturing function unit structure

Core Design Contradiction:

Loss of timeVSDevice complexity

Solution Approach 1:

The capturing function unit is divided into two independent segments: a first capturing function unit that processes packets after flow condition registration, and a second capturing function unit that processes packets during the time lag period. This segmentation allows each unit to handle specific time periods independently, ensuring no packet omission while maintaining manageable complexity through functional separation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The two capturing function units operate in parallel to ensure continuous packet capture without interruption. While the first unit handles post-registration packets, the second unit simultaneously captures packets during the time lag period, creating a seamless continuous capture process that eliminates gaps in data collection.

Inventive Principle:

Principle #20Continuity of useful action

3Loss of information

If packets are captured only after flow condition registration is complete, then the processing logic remains simple, but packets during the registration period are lost

Engineering Contradiction:

Improvepacket data loss during time lagVSAvoidcapturing function unit structure

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The capturing function unit is divided into two independent segments: a first capturing function unit that processes packets after flow condition registration, and a second capturing function unit that processes packets during the time lag period. This segmentation allows each unit to handle specific time periods independently, ensuring no packet omission while maintaining manageable complexity through functional separation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The second capturing function unit performs preliminary action by accumulating packets during the time lag period before the first capturing function unit starts processing. This preliminary capture ensures that packets arriving during the initialization phase are not lost, and the captured data can be seamlessly integrated with the main capture process.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20240356825A1Packet capture device and method

Publication Date: 2024.10.24 NT T INC

AI summary

A packet capturing device includes: a normal capturing function unit that accumulates packets that match conditions of a target flow registered in a flow table in response to an instruction to start capturing from outside and converts the accumulated packets into a captured file, from among packets flowing through a network that is a monitoring target; and a short-term capturing function unit that accumulates the packets received from the network during a period needed by the conditions of the target flow to be registered in the flow table from arrival of the instruction to start capturing and converts the accumulated packets into a captured file