CPC H04L 43/062 (2013.01) [G06F 16/22 (2019.01); G06F 16/248 (2019.01); G06F 16/284 (2019.01); H04L 43/026 (2013.01); H04L 43/045 (2013.01); H04L 43/067 (2013.01)] | 20 Claims |
1. A method for aggregating network traffic statistics comprising:
receiving, at a network appliance, a SYN network packet;
storing, at the network appliance, header information from the SYN network packet in a
flow data table;
for each of the data packets related to the SYN network packet, storing header information of the data packets in the flow table;
In response to receiving a FIN network packet is that is associated with the SYN network packet:
accessing the flow data table for network information regarding packets that are
processed through the network appliance for related data-packets, wherein the network
information includes a network characteristic for the SYN network
packet, the data packets related to the SYN network packet, and the FIN network packet,
grouping related packets by aggregating the network information by the network characteristic and corresponding network metric, and
storing a single row for the related data packets by the network characteristic and the corresponding network metric;
after a predetermined amount of time or a predetermined number of rows is reached,
invoking an eviction policy on the flow data table, wherein the eviction policy removes the
related data packets from the flow data table; and
populating an accumulating map with the flow data table.
|