Abstract: Methods, systems, computer-readable media, and devices for filtering captured network traffic received by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Methods, systems, computer-readable media, and devices for applying a plurality of filters to received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are also described. Applying a plurality of filters to the received captured traffic may generate a plurality of filtered captured traffic sets. In some instances, filtered captured network traffic sets that have similar target destinations may be aggregated together and transmitted toward the target destination.

Abstract: Methods, systems, computer-readable media, and devices for aggregating sets of received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Systems for aggregating captured network traffic may include a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology such that each network captured traffic distribution device is communicatively coupled via a communication link with at least one additional stacked network captured traffic distribution device, and an external device. In some embodiments, one or more of the stacked network captured traffic distribution devices, source, and/or external device may operate at locations that are geographically disperse from one another.

Abstract: Methods, systems, computer-readable media, and devices for automatically configuring a network captured traffic distribution device communicatively coupled to a stacked topology of network captured traffic distribution devices are described. The automatic configuration may include an exchange of configuration information between a first and second network captured traffic distribution device included in a stacked topology. The configuration information of a network captured traffic distribution device may also be automatically updated when, for example, a change is detected in the stacked topology or on a periodic or as needed basis.

Abstract: Methods, systems, computer-readable media, and devices for determining a target destination of captured network traffic received by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology responsively to an inserted virtual local area network (VLAN) tag are described. A target destination for a captured data packet may be determined and a VLAN tag may be inserted into the captured data packet responsively to the determined target destination. The data packet may then be transmitted to an intervening network captured traffic distribution device positioned between the network captured traffic distribution device and the target destination. Once received by the intervening network captured traffic distribution device, the target destination of the received data packet may be determined based on the inserted VLAN tag. The received data packet may then be transmitted toward the target destination.

Abstract: Systems, apparatus, and methods for modifying a captured data packet included in a traffic flow of captured data packets are described. A captured data packet may be analyzed in order to, for example, locate a predefined segment of data included in the received captured data packet, determine a type of data included in the data packet, and determine content included in the data packet. The data packet may then be modified based upon the analysis. Exemplary modifications include deleting a portion of the data included in the data packet, truncating the data packet, and modifying data included in the predefined segment.

Abstract: Methods, systems, computer-readable media, and devices for determining an optimum route for the transmission of a received traffic flow of captured data packets from a network captured traffic distribution device, through a stacked topology of network captured traffic distribution devices, to a target destination are provided. A plurality of routes through a stacked topology may be determined and analyzed according to one or more criterion. An optimum route may then be selected based upon the analysis. On some occasions, the determination of an optimum route may incorporate information regarding operating conditions for the stacked topology.

Abstract: A network filtering device receives an instruction to deploy filtering resources (e.g., of a filtering system, etc.) to filter captured network traffic in a communication network according to at least one criterion. Notably, the instruction is received from a user via an interface communicatively coupled to the filtering system. The network filtering device further analyzes the received instruction and projects, responsive to the analysis, an amount of filtering resources required to filter the captured traffic according to the received instruction. The network filtering device also provides the projected amount to the user via the interface.

Abstract: Systems, devices, and methods for finding a captured data packet including a data pattern of interest are herein provided. The captured data packet may be included in the traffic flow of data packets received at a network captured traffic distribution device and may be found by scanning the payload portions of data packets included in the traffic flow to find a data packet including a data content pattern of interest. An egress port of the network captured traffic distribution device associated with a found data packet may be determined based upon the data pattern of interest detected in the payload portion of the found data packet and the found data packet may then be transmitted to its assigned egress port.

Abstract: Systems, apparatus, and methods for inserting information into a captured data packet included in a traffic flow of captured data packets are herein disclosed. Exemplary information inserted into a capture data packet includes a data segment, a time stamp, port stamp, a virtual local area network (VLAN) tag, Gateway General Packet Radio Service (GPRS) Tunneling Protocol (GTP) information, and multi-protocol label switching (MPLS) information.

Abstract: Data packets received at network traffic distribution device are analyzed to determine whether they include unwanted information, and, if so, the network traffic distribution device removes the unwanted information and then transmits the data packets, absent the unwanted information, to an assigned egress port (e.g., a monitor port communicatively coupled to a monitoring device). The flow of data packets may be received at the network traffic distribution device from a mirror port resident on a source of the captured data packets and/or a traffic capture point located along a communication link between two communicating devices within a network. In addition to analyzing the data packets and removing unwanted information therefrom, the network traffic distribution device may perform additional operations on the data packets as well.

Abstract: Systems, devices, and methods for finding a captured data packet including a data pattern of interest and data packets associated with the found data packet are herein provided. A traffic flow of captured data packets may be received by a network captured traffic distribution device and may be duplicated. A traffic flow of captured data packets may be scanned for data packets including a data pattern of interest and identifying information may be determined for any found data packets. A duplicate traffic flow of captured data packets may also be scanned for data packets with identifying information that matches a found data packet. An egress port for the found data packet may be determined and both the found data packet and any data packets with identifying information matching found data packet might be transmitted to the determined egress port.

Abstract: Methods, systems, and devices for monitoring network capacity and determining network utilization are herein disclosed. A traffic flow of captured data packets received at an ingress port of a network captured traffic distribution device may be sampled at a frequency corresponding to a first time period. The sample may be analyzed to determine whether, for example, the ingress port is active during the first time period. An increment may be added to a first counter based on a determination that the ingress port is active. The increments from a predefined plurality of first time periods may be aggregated and the predefined plurality of first time periods may correspond to a second time period. A second counter value may be generated for the second time period based on the aggregate and a percent utilization of the ingress port for the second time period may be determined based on the second counter value.

Abstract: A network traffic distribution device (e.g., a network tap or similar device) is configured to receive and analyze captured network traffic data packets that include tunneling IDs (e.g., GTP tunneling IDs) and, based on that analysis, to distribute those data packets in such a way that data packets with the same tunneling IDs are distributed to a common egress port of the network traffic distribution device. In some cases, each flow of data packets with a common tunneling ID is sent to a unique external device, while in other cases, two or more traffic flows, each with packets having respective, common tunneling IDs may be provided to the same external device, either via a common egress port of the network traffic monitoring device or via separate egress ports thereof.

Abstract: Methods, systems, and devices for monitoring network capacity and determining network utilization are herein disclosed. A traffic flow of captured data packets received at an ingress port of a network captured traffic distribution device may be sampled at a frequency corresponding to a first time period. The sample may be analyzed to determine whether, for example, the ingress port is active during the first time period. An increment may be added to a first counter based on a determination that the ingress port is active. The increments from a predefined plurality of first time periods may be aggregated and the predefined plurality of first time periods may correspond to a second time period. A second counter value may be generated for the second time period based on the aggregate and a percent utilization of the ingress port for the second time period may be determined based on the second counter value.

Abstract: Systems, devices, and methods for finding a captured data packet including a data pattern of interest are herein provided. The captured data packet may be included in the traffic flow of data packets received at a network captured traffic distribution device and may be found by scanning the payload portions of data packets included in the traffic flow to find a data packet including a data content pattern of interest. An egress port of the network captured traffic distribution device associated with a found data packet may be determined based upon the data pattern of interest detected in the payload portion of the found data packet and the found data packet may then be transmitted to its assigned egress port.

Abstract: Systems, devices, and methods for finding a captured data packet including a data pattern of interest and data packets associated with the found data packet are herein provided. A traffic flow of captured data packets may be received by a network captured traffic distribution device and may be duplicated. A traffic flow of captured data packets may be scanned for data packets including a data pattern of interest and identifying information may be determined for any found data packets. A duplicate traffic flow of captured data packets may also be scanned for data packets with identifying information that matches a found data packet. An egress port for the found data packet may be determined and both the found data packet and any data packets with identifying information matching found data packet might be transmitted to the determined egress port.

Abstract: Systems, apparatus, and methods for inserting information into a captured data packet included in a traffic flow of captured data packets are herein disclosed. Exemplary information inserted into a capture data packet includes a data segment, a time stamp, port stamp, a virtual local area network (VLAN) tag, Gateway General Packet Radio Service (GPRS) Tunneling Protocol (GTP) information, and multi-protocol label switching (MPLS) information.

Abstract: Systems, apparatus, and methods for modifying a captured data packet included in a traffic flow of captured data packets are described. A captured data packet may be analyzed in order to, for example, locate a predefined segment of data included in the received captured data packet, determine a type of data included in the data packet, and determine content included in the data packet. The data packet may then be modified based upon the analysis. Exemplary modifications include deleting a portion of the data included in the data packet, truncating the data packet, and modifying data included in the predefined segment.

Abstract: A network traffic distribution device (e.g., a network tap or similar device) is configured to receive and analyze captured network traffic data packets that include tunneling IDs (e.g., GTP tunneling IDs) and, based on that analysis, to distribute those data packets in such a way that data packets with the same tunneling IDs are distributed to a common egress port of the network traffic distribution device. In some cases, each flow of data packets with a common tunneling ID is sent to a unique external device, while in other cases, two or more traffic flows, each with packets having respective, common tunneling IDs may be provided to the same external device, either via a common egress port of the network traffic monitoring device or via separate egress ports thereof.

Abstract: Data packets received at network traffic distribution device are analyzed to determine whether they include unwanted information, and, if so, the network traffic distribution device removes the unwanted information and then transmits the data packets, absent the unwanted information, to an assigned egress port (e.g., a monitor port communicatively coupled to a monitoring device). The flow of data packets may be received at the network traffic distribution device from a mirror port resident on a source of the captured data packets and/or a traffic capture point located along a communication link between two communicating devices within a network. In addition to analyzing the data packets and removing unwanted information therefrom, the network traffic distribution device may perform additional operations on the data packets as well.