Protocol Analyzer Event-Present Flags for Trace Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Protocol analyzers face significant delays in searching and analyzing trace data due to slow access and transfer rates of storage devices, especially when processing large traces, which can take minutes or hours, and traditional methods require post-capture processing that further slows down the analysis.
Innovation Solution
The method involves dividing trace data into pages with separate Event-Present Flags (EP Flags) indicating the occurrence of infrequent events, allowing only relevant pages to be searched, thereby reducing the number of pages that need to be examined, and storing these flags either separately or embedded with trace data to enhance search efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional protocol analyzers search through entire trace data, then complete analysis is achieved, but search time becomes very slow (minutes or hours)
Solution Approach 1:
The trace data is divided into multiple pages, with each page containing a subset of trace records. Event Present Flags are maintained for each page to indicate whether specific events occur in that page. This segmentation allows the analyzer to search only relevant pages instead of scanning the entire trace, significantly reducing search time while maintaining analysis completeness.
Solution Approach 2:
During trace capture, Event Present Flags are pre-computed and stored for each page to indicate the presence of specific events. This preliminary action allows the analyzer to use these flags during search operations to quickly identify which pages need to be examined, eliminating the need to scan every page from scratch and reducing overall search time.
2Speed
If hardware search engines are used, then search speed is improved, but they can only operate on trace data in the buffer and cannot help with saved traces
Solution Approach 1:
The trace data is copied to storage devices for saving, and the Event Present Flags are also saved alongside the trace data. This copying approach allows the analyzer to quickly locate and search only relevant pages using the saved flags, enabling fast search operations on saved traces without requiring special hardware search engines, thus achieving both speed and versatility.
3Speed
If post-capture information gathering is performed to speed up searches, then search performance is improved, but the process becomes very time consuming (minutes or hours)
Solution Approach 1:
Event Present Flags are computed and stored during the trace capture process itself, rather than performing information gathering after capture completes. This preliminary action eliminates the need for time-consuming post-capture processing, as the flags are already ready to be used for rapid search operations on the trace data.
Solution Approach 2:
The trace analyzer continuously maintains Event Present Flags during the capture process, keeping the search optimization data ready and up-to-date. This continuous maintenance ensures that the flags are always available for immediate use in search operations, eliminating gaps and delays that would occur with batch post-capture processing.
4Speed
If Event Present Flags are stored separately from trace data, then search efficiency is improved, but trace size increases
Solution Approach 1:
Event Present Flags are stored locally with their corresponding trace pages, creating a localized structure where flags and trace data are together. This local quality approach allows efficient search operations by keeping related data close together, while the flags remain compact and proportional to the actual trace content, minimizing the overall size increase.
Data Source
AI summary
The present invention discloses a method to record trace data in a way that significantly reduces the time required to search for specific events, to create an index, to create a histogram, or to analyze the protocol. During capture, the analyzer recognizes infrequent events and sets an Event-Present Flag (“EP Flag”) indicating that a specific event has occurred. The trace is divided into pages, with a separate set of Event-Present Flags for each page indicating whether an event occurred in that page of the trace. This division of a trace into separate pages results in significant efficiencies.