Abstract: A method and high availability cluster configuration for capture of data packets propagating in an external network into the cluster through a wired-tap connection between the cluster and at least one router of the external network. Captured packets are supplied with popularity tags and striped over high-access-rate non-transitory storage media belonging to a capture pool of serving nodes that are specially provisioned and selected by the master node. The captured packets are either devolved or demoted to low-access-rate non-transitory storage media of at least two serving nodes not including any backup master based on popularity metrics contained their tags. The demotion, devolution as well as determination of popularity metrics and setting of a popularity threshold are managed by a distributed management protocol.

Abstract: A method and high availability cluster configuration for capture of data packets propagating in an external network into the cluster through a wired-tap connection between the cluster and at least one router of the external network. Captured packets are supplied with popularity tags and striped over high-access-rate non-transitory storage media belonging to a capture pool of serving nodes that are specially provisioned and selected by the master node. The captured packets are either devolved or demoted to low-access-rate non-transitory storage media of at least two serving nodes not including any backup master based on popularity metrics contained their tags. The demotion, devolution as well as determination of popularity metrics and setting of a popularity threshold are managed by a distributed management protocol.