ExtraHop Networks, Inc. Patent applications |
Patent application number | Title | Published |
20150036501 | TRIGGER BASED RECORDING OF FLOWS WITH PLAY BACK - The various embodiments provide selective real-time monitoring of one or more flows of packets over a network, real-time buffering of packets for the one or more monitored flows, real-time recording of packets for one or more monitored flows and its corresponding buffered packets based on initiation of at least one trigger, and real-time analysis of the one or more recorded flows of packets regarding at least the occurrence of the at least one trigger. One or more flows of packets may be selected for monitoring by an administrator or an automated process based on different factors. In at least one of the various embodiments, the one or more monitored flows of packets are tagged and threaded so that they are separately accessible in a ring buffer. | 02-05-2015 |
20150019867 | RESYNCHRONIZATION OF PASSIVE MONITORING OF A FLOW BASED ON HOLE DETECTION - Embodiments are directed towards resynchronizing the processing of a monitored flow based on hole detection. A network monitoring device (NMD) may be employed to passively monitor flows of packets for a session between endpoints. The NMD may receive copies of the monitored flow and perform processes on the monitored flow. In some situations, some copies of packets may not be fully processed by the NMD, creating a hole in the processing. If a hole is detected in the monitored flow and the processing of the monitored flow is desynchronized, then the NMD may suspend processing until it is resynchronized or for a remainder of the session. If the processing is desynchronized, then the NMD may resynchronize the processing by resuming the processing of the monitored flow at a downstream position of the monitored flow based on the detected hole. | 01-15-2015 |
20140280908 | DE-DUPLICATING OF PACKETS IN FLOWS AT LAYER 3 - Embodiments are directed towards receiving packets communicated over at least one network, determining layer 3 header information for the received packets, normalizing the determined layer 3 header information for each received packet, employing a determined value based on the normalized layer 3 header information to detect each received packet that is a duplicate, disregarding duplicate packets, and enabling monitoring and analysis of at least selected flows that include packets that are determined to be non-duplicated. Also, if the determined layer 3 header information indicates that the received packet is fragmented, that packet is de-fragmented at least in accordance with a fragment offset. Additionally, normalization may include at least one of masking at least one value in the layer 3 header information, or rolling back changes in the layer 3 header information. | 09-18-2014 |
20140280907 | AUTOMATED PASSIVE DISCOVERY OF APPLICATIONS - Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions. | 09-18-2014 |
20140269777 | RESYNCHRONIZATION OF PASSIVE MONITORING OF A FLOW BASED ON HOLE DETECTION - Embodiments are directed towards resynchronizing the processing of a monitored flow based on hole detection. A network monitoring device (NMD) may be employed to passively monitor flows of packets for a session between endpoints. The NMD may receive copies of the monitored flow and perform processes on the monitored flow. In some situations, some copies of packets may not be fully processed by the NMD, creating a hole in the processing. If a hole is detected in the monitored flow and the processing of the monitored flow is desynchronized, then the NMD may suspend processing until it is resynchronized or for a remainder of the session. If the processing is desynchronized, then the NMD may resynchronize the processing by resuming the processing of the monitored flow at a downstream position of the monitored flow based on the detected hole. | 09-18-2014 |
20140269276 | TRIGGER BASED RECORDING OF FLOWS WITH PLAY BACK - The various embodiments provide selective real-time monitoring of one or more flows of packets over a network, real-time buffering of packets for the one or more monitored flows, real-time recording of packets for one or more monitored flows and its corresponding buffered packets based on initiation of at least one trigger, and real-time analysis of the one or more recorded flows of packets regarding at least the occurrence of the at least one trigger. One or more flows of packets may be selected for monitoring by an administrator or an automated process based on different factors. In at least one of the various embodiments, the one or more monitored flows of packets are tagged and threaded so that they are separately accessible in a ring buffer. | 09-18-2014 |