Abstract: In one embodiment, a network recorder includes a storage device; a motherboard; and daughter-cards. Each of the daughter-cards includes an input port, a packet analyzer, an entropy calculator, a comparator, and a processor. The input port receives a plurality of computer data packets. The packet analyzer identifies header fields and a starting point of the payload data in the plurality of computer data packets. The entropy calculator examines the payload data of the plurality of the computer data packets to respectively generate an entropy estimate for each of the plurality of computer data packets. The comparator compares each entropy estimate with an entropy truncation threshold to generate an entropy exceed signal to indicate that the payload data of a computer data packet can be truncated to conserve storage space. The processor compresses at least some of the payload data of the plurality of computer data packets that are not truncated.

Abstract: In one embodiment, a network recorder includes a storage device; a motherboard; and daughter-cards. Each of the daughter-cards includes an input port, a packet analyzer, an entropy calculator, a comparator, and a processor. The input port receives a plurality of computer data packets. The packet analyzer identifies header fields and a starting point of the payload data in the plurality of computer data packets. The entropy calculator examines the payload data of the plurality of the computer data packets to respectively generate an entropy estimate for each of the plurality of computer data packets. The comparator compares each entropy estimate with an entropy truncation threshold to generate an entropy exceed signal to indicate that the payload data of a computer data packet can be truncated to conserve storage space. The processor compresses at least some of the payload data of the plurality of computer data packets that are not truncated.

Abstract: In one embodiment, a computer-implemented method of conserving storage space in a network recorder includes receiving a computer packet including a header and payload data; estimating entropy of the payload data in the computer packet; determining if storage of the computer packet is of value or not based on the header of the computer packet; and storing all or a portion of the computer packet into a storage device based on the estimated entropy and the value determination.

Abstract: In one embodiment, a computer-implemented method of conserving storage space in a network recorder includes receiving a computer packet including a header and payload data; estimating entropy of the payload data in the computer packet; determining if storage of the computer packet is of value or not based on the header of the computer packet; and storing all or a portion of the computer packet into a storage device based on the estimated entropy and the value determination.