Correlating network traffic to their OS processes using packet capture libraries and kernel monitoring mechanisms
US11245602B2 · kind B2 · utility
Assignee
Inventor
Key dates
| Filing date | Sep 23, 2019 |
| Grant date | Feb 8, 2022 |
| Priority date | — |
| Expiry date | Sep 23, 2039 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L61/4511
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method of monitoring and reporting of packets including their attribution to their origin processes from a user space application without installing proprietary drivers, rather using only infrastructures and capabilities supplied by the operating system (OS). The method relies on correlation between packets received from a packet capture library and a kernel monitoring mechanism that supplies an event with the process ID which is executed on the same time frame for transmitting or receiving of that traffic. The attribution between the event and the packet is based on the 4-tuple (or other exemplar) that exists on both the event and the packet where the “4-tuple” is a set of: source address, source port, destination address, destination port.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.