Abstract: Graphically representing network frame capture sessions, network frame data, network conversations and network state data using network protocol parsers formed from a network protocol script and enabling interaction with the network frames, conversations, scripts, and parsers is disclosed. Capture session frame data and capture session context data are stored in a file that can be used to reconstruct the capture session on computing devices other than the computing device involved in the network frame capture and not connected to the network involved in the network frame capture. Dynamically representing the execution of network protocol scripts; enabling the setting of breakpoints in, and single stepping through, network protocol scripts; and modifying protocol scripts and applying the modifications while the protocol scripts are being used are supported.

Abstract: A method, apparatus, and computer-readable medium for analyzing network data streams with parsers generated using script based parsers is provided. The script based parsers are used to analyze the captured frames of a network data stream and identify conversations in the frames. The script based parsers are written in a language that describes network protocols. A script interpreter interprets script to build a parser in the memory of a computing device. A parsing engine uses the protocol parsers stored in memory to parse frames. A capture engine captures frames for parsing and frames are organized into conversations. The parsing of frames is optimized by substituting data structure sizes for data structures that are not of interest in a particular parser.