Abstract: In one embodiment, a network architecture includes a plurality of application monitoring modules for monitoring network traffic data in a plurality of network segments. Network monitoring modules include a staging area that receives network traffic data from a packet capture and analysis engine and an indexing area that stores the data in meta-flow tuples with associated measures divided into time interval buckets. Index tables store dimension-based sorted pointers to the storage locations in the data buckets. HyperLock queries collect time aggregated results for measure based operators with respect to a queried dimension. For each value of the queried dimension, the time interval buckets are traversed compiling a partial result that is finally stored in a stack as the time aggregated value. The stored sorted pointers are used to determine the starting location in each bucket with respect to the next value of the queried dimension.

Abstract: According to one embodiment, a network architecture includes a plurality of application monitoring modules for monitoring network traffic data that store the data in meta-flow tuples with associated measures. The meta-flow tuples include a protocol dimension with a value corresponding to a leaf node in a protocol identifier array. The protocol identifier array represents a protocol tree structure based on a set of nodes with pointers to parent, sibling, and child nodes corresponding to the protocol tree. The pointers include protocol identifier values that correspond to memory offset values with respect to the array. For queried protocol dimensions, the protocol identifier array is used to traverse the protocol tree from the leaf node in the meta-flow to a matching node matching the queried protocol. If the queried protocol is found in the protocol lineage of the meta-flow, the measures for the meta-flow are used to satisfy the query.