Abstract: Real-time enrichment for deep packet inspection is disclosed. A flow identifier iteratively accesses records generated in response to actions by a plurality of computing devices that are communicating through a same gateway router. Each record identifies a device identifier of a corresponding computing device of the plurality of computing devices. A subset of computing devices of the plurality of computing devices is identified based on a criterion. Device identifier information comprising device identifiers that identify the subset of computing devices is generated, each device identifier corresponding to one of the computing devices in the subset of computing devices. The device identifier information is provided to a deep packet inspector that monitors the gateway router and captures packets communicated through the gateway router based on the device identifiers.

Abstract: Real-time enrichment for deep packet inspection is disclosed. A flow identifier iteratively accesses records generated in response to actions by a plurality of computing devices that are communicating through a same gateway router. Each record identifies a device identifier of a corresponding computing device of the plurality of computing devices. A subset of computing devices of the plurality of computing devices is identified based on a criterion. Device identifier information comprising device identifiers that identify the subset of computing devices is generated, each device identifier corresponding to one of the computing devices in the subset of computing devices. The device identifier information is provided to a deep packet inspector that monitors the gateway router and captures packets communicated through the gateway router based on the device identifiers.