Packet capture deep packet inspection sensor

Abstract

Systems and processes for filtering network traffic. In one example, an event based flow record aging process may be used to identify flow records to be removed from memory to provide space for newer flow records. In this example, a new incoming network packet may trigger a determination of the flow record to be removed from memory based on the hardware time stamps of the flow records stored in memory. Determining aging flow records in this way may advantageously reduce the amount of computer resources required to manage flow record aging when compared to traditional techniques that require keeping a timer and periodically performing a cleanup process to check the freshness date of each flow record.

1 . (canceled) 
     
     
         2 . A method of performing flow record aging, the method comprising:
 storing, in a memory, a plurality of flow records;   associating time stamps with the flow records stored in the memory;   in response to receiving a packet, using the time stamps to determine the ages of the plurality of flow records stored in the memory; and   in accordance with a determination that additional space in the memory is needed to store a flow record corresponding to the received packet, removing the oldest identified flow record of the plurality of flow records from the memory.