Abstract: A method, apparatus, and computer-readable medium for analyzing network data streams with parsers generated using script based parsers is provided. The script based parsers are used to analyze the captured frames of a network data stream and identify conversations in the frames. The script based parsers are written in a language that describes network protocols. A script interpreter interprets script to build a parser in the memory of a computing device. A parsing engine uses the protocol parsers stored in memory to parse frames. A capture engine captures frames for parsing and frames are organized into conversations. The parsing of frames is optimized by substituting data structure sizes for data structures that are not of interest in a particular parser.

Abstract: A system and method facilitating network diagnostics and self-healing is provided. The invention includes a data stream monitor component adapted to selectively copy protocol specific subset(s) of raw network data and provide the subset(s) of data to a diagnostics engine. The invention further includes a diagnostic engine adapted to facilitate network diagnostics and/or self-healing. The invention further provides for protocol state compressor(s) to analyze the protocol specific subset(s) of data to abstract and/or analyze relevant information about the specific protocol without having to strictly process the protocol or preserve protocol state variable(s) in order to analyze the state of the specific protocol. Based upon this analysis, the protocol state compressor(s) can generate event(s) for undesirable state(s) (e.g., error(s) and/or failure(s)) and/or congested state(s) for use by the event correlator/inference engine.