CPC H04L 43/045 (2013.01) [H04L 43/028 (2013.01); H04L 43/062 (2013.01); H04L 43/067 (2013.01)] | 21 Claims |
1. A computer-implemented method comprising:
receiving, by a server and from a client device, a query for network traffic playback data of multiple network devices;
extracting, by the server, data from the query that characterizes prior network traffic for the multiple network devices;
obtaining, by the server, network traffic data associated with the multiple network devices;
generating, by the server, the network traffic playback data using (i) state value pairs of the network traffic data having values that differ by at least a particular amount and (ii) the extracted data from the query by:
for each given network device among one or more of the multiple network devices:
obtaining, by the server, a first data element from the network traffic data associated with the given network device, wherein the first data element specifies, for the given network device, a first timestamp and at least a first next state value indicative of a state of the given network device at a first time represented by the first timestamp;
determining, by the server, that the first data element includes (i) the first next state value and (ii) a first prior state value that differs from the first next state value by at least a particular amount, wherein the first prior state value is indicative of a first prior state of the given network device prior to the first time represented by the first timestamp; and
in response to determining that the first data element includes (i) the first next state value and (ii) the first prior state value that differs from the first next state value by at least a particular amount, appending, by the server, the first data element to the network traffic playback data;
filtering, by the server, the network traffic playback data using the extracted data from the query; and
providing, by the server, the filtered network traffic playback data to the client device, wherein inclusion, in the first data element, of the first prior state value indicative of the first prior state of the given network device prior to the first time represented by the first timestamp enables reverse visual playback of the playback data.
|