Abstract 5 n7 A protocol analyzer, for use in monitoring packet sequences passing through a data network, includes context filter means comprising storage means 18 having permanently stored therein a set of state sequences corresponding substantially to a protocol carried by the network, and means for detecting (17) and indicating (20) when the sequence of packets diverges from a valid sequence of the stored set. The packet types are passed through a FIFO store (16) as they are matched against the stored sequences of states, so that on a violation, the sequence of packet types leading up to the violation can be extracted from the FIFO store and displayed. The context (or behavioural) filter thus filters out packet sequences conforming to the system protocols, so that only packets violating those protocols are displayed. An inverse mode can be provided in which only packet sequences conforming to the protocols are shown. A modest degree of user programmability can be added, to allow the user to effectively "tweak" the protocol tables. Two levels of operation can also be provided, giving "strong" filtering detecting only strictly protocol-violating sequences, or "weak" filtering giving automatic detection of permitted but unusual sequences as well.
A protocol analyzer, for use in monitoring packet sequences passing through a data network, including context filter means comprising storage means having permanently stored therein a set of state sequences corresponding substantially to a protocol carried by the network, and means for detecting and indicating when the sequence of packets monitored by the analyzer diverges from a valid sequence of the stored set.
Claim 2
Dependent Claim
63 words
A protocol analyzer, for use in monitoring packet sequences passing through a data network, including context filter means comprising storage means having permanently stored therein a set of state sequences corresponding substantially to a protocol carried by the network, and means for detecting and indicating when the sequence of packets monitored by the analyzer diverges from a valid sequence of the stored set.
Claim 3
Dependent Claim
18 words
A protocol analyzer according to claim 1 including means for showing only packet sequences conforming to the protocols.
Claim 4
Dependent Claim
45 words
A protocol analyzer according to either previous claim including means for showing the complete sequence of all packets, in a manner distinct from that used for indicating when the sequence of packets monitored by the analyzer diverges from a valid sequence of the stored set.
Claim 5
Dependent Claim
53 words
A protocol analyzer according to any previous claim including a FIFO store through which the packet types are passed as they are matched against the stored sequences of states, and means operative on a violation to extract from the FIFO store and display the sequence of packet types leading up to the violation.
Claim 6
Dependent Claim
23 words
A protocol analyzer according to any previous claim including means programmable by the user to modify the sequences detected by the context filter.
Claim 7
Dependent Claim
41 words
A protocol analyzer according to any previous claim wherein the set of state sequences stored in the storage means is subdivided into a plurality of subsets, and the context filter is settable to detect violations of desired subsets or combinations thereof.