US5787253A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Apparatus and method of analyzing internet activity
Assignee: SILKSTREAM Corp
•
Filing: 1996-05-28
•
Granted: 1998-07-28
•
Expires: 2016-05-28
Abstract
Abstract An internet activity analyzer includes a network interface controller, a packet capturing module, a packet analysis module, and a data management module. The network interface controller is connected to a transmission medium for a network segment and is arranged to receive the stream of data packets passing along the medium. The packet stream is filtered to remove undesired packet data and is stored in a raw packet data buffer. The packet data is decoded at the internet protocol layer to provide information such as timing and sequencing data regarding the exchange of packets between nodes and the packet data for exchanges between multiple nodes may be recompiled into concatenated raw transaction data which may be coherently stored in a raw transaction data buffer. An application level protocol translator translates the raw transaction data and stores the data in a translated transaction data buffer. The translated data provides high level information regarding the transactions between nodes which is used to monitor or compile statistics regarding network or internetwork activity. The data management module communicates with the packet capturing module and the packet analyzer and, particularly, the data in the raw packet, decoded packet, raw transaction, and translated transaction data buffers to provide real time and stored analytical information concerning internet activity.
Inventors
- 👤 Timothy David McCreery
- 👤 Mahboud Zabetian
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 23:24
CPC Classifications
H; H04; H04L; H04L43/00; H04L43/08; H04L43/0876; H04L43/0882; H04L43/18; H04L69/00; H04L69/16; H04L69/161; H04L9/00; H04L9/40; H04L43/04; H04L43/045
Claims Analysis
Total Claims: 34
Claim 1
Independent Claim
179 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data, wherein the packet capturing module produces the raw packet data by retrieving a predetermined address, comparing the predetermined address to the internet protocol source address for a current packet, comparing the predetermined address to the internet protocol destination address for the current packet, and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 2
Independent Claim
179 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data, wherein the packet capturing module produces the raw packet data by retrieving a predetermined address, comparing the predetermined address to the internet protocol source address for a current packet, comparing the predetermined address to the internet protocol destination address for the current packet, and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 3
Independent Claim
189 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data, wherein the packet capturing module produces the raw packet data by retrieving a predetermined port address, comparing the predetermined port address to the transmission control protocol source port address for a current packet, comparing the predetermined port address to the transmission control protocol destination port address for the current packet, and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 4
Independent Claim
189 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data, wherein the packet capturing module produces the raw packet data by retrieving a predetermined port address, comparing the predetermined port address to the transmission control protocol source port address for a current packet, comparing the predetermined port address to the transmission control protocol destination port address for the current packet, and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 5
Independent Claim
184 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data, the packet analyzing module comprising: a packet decoder, for accessing the raw packet data and producing the decoded packet data; and a decoded packet recompiler, in communication with the packet decoder, for accessing the decoded packet data, segregating the packets from the decoded packet data into separate transactions between nodes, sequencing the packets corresponding to each separate transaction, and concatenating the data in each separate transaction to produce the transaction data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 6
Independent Claim
184 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data and for producing transaction data from the decoded packet data, the packet analyzing module comprising: a packet decoder, for accessing the raw packet data and producing the decoded packet data; and a decoded packet recompiler, in communication with the packet decoder, for accessing the decoded packet data, segregating the packets from the decoded packet data into separate transactions between nodes, sequencing the packets corresponding to each separate transaction, and concatenating the data in each separate transaction to produce the transaction data; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 7
Dependent Claim
46 words
The apparatus of claim 3, wherein the transaction data includes a first transaction and a second transaction, the first transaction comprising packets exchanged between a first node and a second node and the second transaction comprising packets exchanged between a third node and a fourth node.
Claim 8
Independent Claim
247 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data, for producing transaction data from the decoded packet data, and for producing translated transaction data from the transaction data, the packet analyzing module comprising: a packet decoder, for accessing the raw packet data and producing the decoded packet data; a decoded packet recompiler, in communication with the packet decoder, for accessing the decoded packet data, segregating the packets from the decoded packet data into separate transactions between nodes, sequencing the packets corresponding to each separate transaction, and concatenating the data in each separate transaction to produce the transaction data; and an application protocol translator, in communication with the decoded packet recompiler, for producing the translated transaction data by accessing the transaction data, scanning the transaction data for a field corresponding to a selected application protocol, determining a value associated with the field, and storing the field and the associated value; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data, the transaction data, and the translated transaction data to provide an indication of internet usage.
Claim 9
Independent Claim
247 words
An apparatus for analyzing internet activity, the apparatus comprising: a packet capturing module, for accessing the packets traversing a network, the packets having source and destination addresses other than an address corresponding to the apparatus, and for filtering the packets to produce raw packet data; a packet analyzing module, in communication with the packet capturing module, for producing decoded packet data, for producing transaction data from the decoded packet data, and for producing translated transaction data from the transaction data, the packet analyzing module comprising: a packet decoder, for accessing the raw packet data and producing the decoded packet data; a decoded packet recompiler, in communication with the packet decoder, for accessing the decoded packet data, segregating the packets from the decoded packet data into separate transactions between nodes, sequencing the packets corresponding to each separate transaction, and concatenating the data in each separate transaction to produce the transaction data; and an application protocol translator, in communication with the decoded packet recompiler, for producing the translated transaction data by accessing the transaction data, scanning the transaction data for a field corresponding to a selected application protocol, determining a value associated with the field, and storing the field and the associated value; and a data management module, in communication with the packet capturing module and the packet analyzing module, for analyzing at least one of the raw packet data, the decoded packet data, the transaction data, and the translated transaction data to provide an indication of internet usage.
Claim 10
Dependent Claim
46 words
The apparatus of claim 5, wherein the transaction data includes a first transaction and a second transaction, the first transaction comprising packets exchanged between a first node and a second node and the second transaction comprising packets exchanged between a third node and a fourth node.
Claim 11
Dependent Claim
29 words
The apparatus of claim 5, wherein the data management module produces a profile of a selected site by determining the number of transactions in which the selected site participates.
Claim 12
Dependent Claim
56 words
The apparatus of claim 7, wherein the data management module produces analytical data corresponding to selected transactions that the selected site participates in, the analytical data for each selected transaction including at least one of the browser type used to access the selected site, the amount of data transferred in the transaction, and the transaction time.
Claim 13
Dependent Claim
48 words
The apparatus of claim 7, wherein the data management module accesses the addresses for nodes transacting with the selected site, uses a reverse domain name service lookup to obtain information about the nodes, and uses the information about the nodes to produce the profile of the selected site.
Claim 14
Dependent Claim
149 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data by retrieving a predetermined address; comparing the predetermined address to the internet protocol source address for a current packet; comparing the predetermined address to the internet protocol destination address for the current packet; and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address; producing decoded packet data; producing transaction data from the decoded packet data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 15
Dependent Claim
149 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data by retrieving a predetermined address; comparing the predetermined address to the internet protocol source address for a current packet; comparing the predetermined address to the internet protocol destination address for the current packet; and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address; producing decoded packet data; producing transaction data from the decoded packet data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 16
Dependent Claim
159 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data by retrieving a predetermined port address; comparing the predetermined port address to the transmission control protocol source port address for a current packet; comparing the predetermined port address to the transmission control protocol destination port address for the current packet; and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; producing decoded packet data; producing transaction data from the decoded packet data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 17
Dependent Claim
159 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data by retrieving a predetermined port address; comparing the predetermined port address to the transmission control protocol source port address for a current packet; comparing the predetermined port address to the transmission control protocol destination port address for the current packet; and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; producing decoded packet data; producing transaction data from the decoded packet data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 18
Dependent Claim
133 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data; producing decoded packet data; producing transaction data from the decoded packet data by accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 19
Dependent Claim
133 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data; producing decoded packet data; producing transaction data from the decoded packet data by accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 20
Dependent Claim
46 words
The method of claim 12, wherein the transaction data includes a first transaction and a second transaction, the first transaction comprising packets exchanged between a first node and a second node and the second transaction comprising packets exchanged between a third node and a fourth node.
Claim 21
Dependent Claim
146 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data; producing decoded packet data; producing transaction data from the decoded packet data by accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and producing translated transaction data from the transaction data; and analyzing at least one of the raw packet data, the decoded packet data, the transaction data, and the translated transaction data to provide an indication of internet usage.
Claim 22
Dependent Claim
146 words
For use with an internet activity analyzer capable of being coupled to a network transmission medium, a method of analyzing internet activity, the method comprising: accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; filtering the packets to produce raw packet data; producing decoded packet data; producing transaction data from the decoded packet data by accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and producing translated transaction data from the transaction data; and analyzing at least one of the raw packet data, the decoded packet data, the transaction data, and the translated transaction data to provide an indication of internet usage.
Claim 23
Dependent Claim
49 words
The method of claim 14, wherein the step of producing translated transaction data comprises: accessing the transaction data; scanning the transaction data for a field corresponding to a selected application protocol; determining a value associated with the field; and retaining an association between the field and the determined value.
Claim 24
Dependent Claim
46 words
The method of claim 15, wherein the transaction data includes a first transaction and a second transaction, the first transaction comprising packets exchanged between a first node and a second node and the second transaction comprising packets exchanged between a third node and a fourth node.
Claim 25
Dependent Claim
26 words
The method of claim 16, further comprising: producing a profile of a selected site by determining the number of transactions in which the selected site participates.
Claim 26
Dependent Claim
53 words
The method of claim 17, wherein analytical data corresponding to selected transactions that the selected site participates in is produced, the analytical data for each selected transaction including at least one of: the browser type used to access the selected site, the amount of data transferred in the transaction, and the transaction time.
Claim 27
Dependent Claim
45 words
The method of claim 17, further comprising: accessing the addresses for nodes transacting with the selected site; using a reverse domain name service lookup to obtain information about the nodes; and using the information about the nodes to produce the profile of the selected site.
Claim 28
Independent Claim
158 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data, wherein the means for filtering the packets to produce raw packet data includes routines for retrieving a predetermined address; comparing the predetermined address to the internet protocol source address for a current packet; comparing the predetermined address to the internet protocol destination address for the current packet; and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address ; means for producing decoded packet data; means for producing transaction data from the decoded packet data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 29
Independent Claim
158 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data, wherein the means for filtering the packets to produce raw packet data includes routines for retrieving a predetermined address; comparing the predetermined address to the internet protocol source address for a current packet; comparing the predetermined address to the internet protocol destination address for the current packet; and retaining the current packet where one of the internet protocol source and destination addresses for the current packet matches the predetermined address ; means for producing decoded packet data; means for producing transaction data from the decoded packet data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 30
Independent Claim
167 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data, wherein the means for filtering the packets to produce raw packet data includes routines for retrieving a predetermined port address; comparing the predetermined port address to the transmission control protocol source port address for a current packet; comparing the predetermined port address to the transmission control protocol destination port address for the current packet; and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; means for producing decoded packet data; means for producing transaction data from the decoded packet data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 31
Independent Claim
167 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data, wherein the means for filtering the packets to produce raw packet data includes routines for retrieving a predetermined port address; comparing the predetermined port address to the transmission control protocol source port address for a current packet; comparing the predetermined port address to the transmission control protocol destination port address for the current packet; and retaining the current packet where one of the transmission control protocol source and destination port addresses for the current packet matches the predetermined port address; means for producing decoded packet data; means for producing transaction data from the decoded packet data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 32
Independent Claim
136 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data; means for producing decoded packet data; means for producing transaction data from the decoded packet data, wherein the means for producing transaction data includes routines for accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 33
Independent Claim
136 words
An apparatus for analyzing internet activity, the apparatus comprising: means for accessing the packets traversing the network, the packets having source and destination addresses other than an address corresponding to the internet activity analyzer; means for filtering the packets to produce raw packet data; means for producing decoded packet data; means for producing transaction data from the decoded packet data, wherein the means for producing transaction data includes routines for accessing the decoded packet data; segregating the packets from the decoded packet data into separate transactions between nodes; sequencing the packets corresponding to each separate transaction; and concatenating the data in each separate transaction to produce the transaction data; and means for analyzing at least one of the raw packet data, the decoded packet data and the transaction data to provide an indication of internet usage.
Claim 34
Dependent Claim
46 words
The apparatus of claim 22, wherein the transaction data includes a first transaction and a second transaction, the first transaction comprising packets exchanged between a first node and a second node and the second transaction comprising packets exchanged between a third node and a fourth node.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-07-27 | 2002-01-26 | 2002-07-28 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-07-27 | 2006-01-26 | 2006-07-28 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-07-27 | 2010-01-26 | 2010-07-28 | $7700.00 | Window Closed / Lapsed |