US 11,722,587 B2
Network recorders with computer data packet truncation
Stephen Frank Donnelly, Auckland (NZ); Jeremy Stringer, Auckland (NZ); and Stuart Wilson, Auckland (NZ)
Assigned to Endace Technology Limited, Hamilton (NZ)
Filed by Endace Technology Limited, Auckland (NZ)
Filed on Nov. 6, 2021, as Appl. No. 17/520,632.
Application 17/520,632 is a continuation of application No. 16/163,545, filed on Oct. 17, 2018, granted, now 11,172,055.
Claims priority of provisional application 62/573,800, filed on Oct. 18, 2017.
Prior Publication US 2022/0060570 A1, Feb. 24, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 69/22 (2022.01); H04L 9/40 (2022.01); H04L 1/00 (2006.01); H04L 43/02 (2022.01); H04L 47/36 (2022.01); H04L 69/04 (2022.01); H04L 43/08 (2022.01); H04L 41/142 (2022.01); H04L 43/12 (2022.01); H03M 7/30 (2006.01)
CPC H04L 69/22 (2013.01) [H03M 7/30 (2013.01); H04L 1/0007 (2013.01); H04L 41/142 (2013.01); H04L 43/02 (2013.01); H04L 43/08 (2013.01); H04L 43/12 (2013.01); H04L 47/365 (2013.01); H04L 63/0428 (2013.01); H04L 69/04 (2013.01)] 5 Claims
OG exemplary drawing
 
1. A network recorder in a computer network, the network recorder comprising:
a storage device;
a motherboard in communication with the storage device;
one or more daughter-cards coupled to the motherboard, each of the one or more daughter-cards including
an input port adapted to receive a plurality of computer data packets communicated between the computer network and a wide area network;
a packet analyzer coupled to the input port to receive the plurality of computer data packets, the packet analyzer adapted to identify header fields and a starting point of payload data in the plurality of computer data packets;
an entropy calculator coupled to the packet analyzer adapted to receive the starting point of the payload data in the plurality of computer data packets, the entropy calculator adapted to examine the payload data of the plurality of the computer data packets to respectively generate an entropy estimate for each of the plurality of computer data packets; and
a comparator coupled to the entropy calculator adapted to receive the entropy estimate for each of the plurality of computer data packets, the comparator adapted to compare each entropy estimate with an entropy truncation threshold to generate an entropy exceed signal to indicate that the payload data of a computer data packet can be truncated to conserve storage space; and
a processor coupled to the comparator, the processor adapted to compress at least some of the payload data of the plurality of computer data packets that is not truncated.