KR101684456B1 - System and providing method for network inspection saving packet - Google Patents

Abstract

A network inspection system and a method for providing the same are disclosed. The network inspection system providing method includes a step in which a network inspection system receives a plurality of packets from a network, the network inspection system generates a plurality of flows formed by the plurality of packets based on the plurality of received packets Extracting at least one session formation flow forming the same session among the plurality of flows based on the information about the plurality of flows generated by the network inspection system; Identifying session information for the session based on information on at least one session forming flow, storing specific session information and corresponding initial N (N is a natural number) preceding packets included in the session, .

Description

Technical Field [0001] The present invention relates to a network inspection system for performing packet storage,

The present invention relates to a network inspection system (hereinafter referred to as a network inspection system) for performing packet storage and a method for providing the same. More particularly, the present invention relates to a method and apparatus for collecting packets on a network to generate flows and sessions step by step, perform traffic inspection using only a small amount of packets based on the generated information, reduce the storage capacity of packets, To a system and method thereof.

Existing network control and management devices are based on packet information of TCP (transport layer protocol) / UDP (user datagram protocol) or IP (Internet protocol) And Distributed Denial of Service (DDoS). However, the packet-based approach ignores information according to communication relationships of upper applications and relies solely on the information contained in each separate packet, which is a temporary information transmission unit, Due to its limitations, it is being offered in the form of a single system for independent targets such as routers for packet routing, dedicated systems to defend DDoS attacks, or DPI (Deep Packet Inspection) systems for traffic control. Among them, the DPI system adopts a method of detecting and detecting a signature of a well-known port number and payload used by a specific application or a client (for example, a P2P client), and controlling the detected packet . By detecting such signatures, it becomes possible to know which client, i.e., the application is generating and / or transmitting packets in the current network, and perform appropriate network control according to a predetermined policy.

However, the conventional DPI system has a disadvantage in that the overhead of processing is too large because the payload of all packets to be transmitted must be checked. That is, there is a problem that high-speed and expensive equipment is required to detect the payload of all packets. Moreover, if the payload is an encrypted packet, there is no way to decrypt the encryption, so it may not be able to detect the signature. In addition, there is no guarantee that a signature will be found even if it is not encrypted, and there is a problem that it is difficult to actually find all the signatures.

In order to solve such a problem, the present inventor filed a Korean patent application (Application No. 10-2011-0019891, "Network Inspection System and Method for Providing the Same").

However, there is a problem in that the session information can not be known because the preprocessor generates only the flow based on the packet, and the flow is very large compared to the session. Therefore, when a large number of packets such as a network recording system are stored, There is a problem that it takes a lot of time to carry out.

Korean Patent Application (Application No. 10-2008-0126888, "Network Control System and Network Control Method") Korean Patent Application (Application No. 10-2011-0019891, "Network Inspection System and Method for Providing the Same")

SUMMARY OF THE INVENTION It is an object of the present invention to solve the above problems and to provide a method and apparatus for performing packet inspection in real time by inspecting only the initial pre- System.

It is another object of the present invention to provide a method and system that can significantly reduce the number of packets stored for recording a network and support high-speed packet search.

According to an aspect of the present invention, there is provided a method for providing a network inspection system for solving the above technical problems, comprising the steps of: receiving a plurality of packets from a network; Generating a plurality of flows formed by the plurality of packets, the network inspection system comprising: at least one session formation forming an identical one of the plurality of flows based on information about the plurality of generated flows; Extracting a session from the network, and extracting a session from the network inspection system based on information on the at least one session formation flow extracted by the network inspection system, (N is a natural number) preceding packets and stores them .

The session information may include identification information of the at least one session forming flow forming the session.

The network inspection system providing method may further include storing flow information for each of the session forming flows.

The network inspection system providing method may further include a step in which the network inspection system performs packet inspection on the preceding packet.

And the network inspection system stores only the preceding packet.

The network inspection system stores an initial M (M is a natural number greater than N) storage packets of the session, and the network inspection system can perform packet inspection only on the N preceding packets among the M storage packets .

The network inspection system may store the session information and the preceding packet only for a predetermined type of session.

The network inspection system can specify the session of the predetermined type based on the port information of the session included in at least one of the plurality of packets, the session information, or the flow information of each of the session forming proxies have.

The network inspection system providing method includes receiving a packet search request stored in the storage device, specifying session information corresponding to the packet search in response to the packet search request, And extracting a packet corresponding to the packet search request based on the specified session formation flow.

The method may be implemented by a computer program installed in the data processing apparatus.

According to another aspect of the present invention, there is provided a network inspection system including a flow generation module for generating a plurality of flows formed by a plurality of packets based on a plurality of packets received from a network, Extracting at least one session formation flow forming the same session among the plurality of flows, specifying session information for the session based on the extracted information about the at least one session formation flow, And a session generation module included in the session and storing an initial N (N is a natural number) preceding packets corresponding to the session.

The session information includes identification information of the at least one session forming flow forming the session, and the flow generating module may store flow information for each of the session forming flows.

The network inspection system may further include a packet inspection module for performing packet inspection on the preceding packet.

And the session creation module stores the session information and the preceding packet only for a predetermined type of session.

Wherein the network inspection system is configured to receive a packet search request of a packet stored by the network inspection system, to identify session information corresponding to the packet search in response to the packet search request, And a packet search module for extracting a packet corresponding to the packet search request based on the specified session formation flow.

According to the technical idea of the present invention, it is possible to generate information about a session based on a flow and a flow while checking a packet at a high speed, so that only the number of initial initial packet of a session can be checked, Can be performed.

In addition, the number of packets required for recording the network can be significantly reduced, and high-speed packet search can be supported based on the session information and the flow information.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
FIG. 1 is a diagram showing a schematic configuration of a network inspection system according to an embodiment of the present invention.
2 is a view for explaining a session, a flow, and a packet for a method of providing a network inspection system according to an embodiment of the present invention.
3 is a diagram for explaining a concept of performing a packet search according to a method of providing a network inspection system according to an embodiment of the present invention.
4 is a diagram for explaining an effect of a method of providing a network inspection system according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, terms such as "comprise," "comprising," and the like are intended to specify that there are stated features, numbers, steps, operations, elements, parts or combinations thereof, But do not preclude the presence or addition of one or more other features, steps, operations, elements, components, or combinations thereof.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component. Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

Hereinafter, the present invention will be described in detail with reference to the embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

FIG. 1 is a diagram showing a schematic configuration of a network inspection system according to an embodiment of the present invention.

Referring to FIG. 1, a network inspection system 100 according to an embodiment of the present invention includes a flow generation module 120 and a session generation module 130. The network inspection system 100 may further include a packet extraction module 110. In addition, the network inspection system 100 may further include a packet search module 140. In addition, the network inspection system 100 may further include a packet inspection module 150 and / or a DB 160.

The packet extraction module 110 may receive a plurality of packets from the network. The packet extraction module 110 may collect packets moving through a network at a predetermined location on the network. In one example, the packet extraction module 110 may be implemented on the network in a tapping mode for receiving the packets from equipment that taps packets from the network as shown in FIG. 1, but is not so limited And may be implemented on the network in an in-line mode such that the packets pass through the packet extraction module 110 and move over the network.

The packet extraction module 110 may be located at a front end and / or a rear end of a gateway existing on a predetermined local area network (LAN), for example, and may examine the network according to the technical idea of the present invention. Then, the network inspection system 100 can control the network / traffic according to the inspection result. Controlling network / traffic may mean artificial actions such as adjusting bandwidth, transmission rate, or blocking transmission for a given session, flow, and / or packet. The packet extraction module 110 may be implemented, for example, by a predetermined NIC (Network Interface Card), but is not limited thereto.

The flow generation module 120 may generate a plurality of flows based on packets received by the packet extraction module 110. The packet extraction module 110 may sequentially output packets to the flow generation module 120. Then, the flow generation module 120 can generate a flow. Generating a flow may mean generating flow information as will be described later. Optionally, the flow generation module 120 may extract the packets included in the flow and store the extracted packets in the DB 160. FIG. The flow generation module 120 may store all packets corresponding to a predetermined flow. However, according to an embodiment, only a few initial packets of the session including the flow may be finally stored in the DB 160 ). ≪ / RTI >

Of course, the flow generation module 120 temporarily stores all the packets included in the flow and the corresponding flows in the DB 160, selectively stores only a part of the packets stored in the session generation module 130, It can also be deleted.

In this specification, a flow refers to a set of IP packets continuously transmitted within a limited time. Therefore, the IP flow includes the address pair (sender address, sender port number, recipient address, recipient port number), host pair (sender network address, recipient network address), AS number pair (sender AS number, recipient AS number) Lt; RTI ID = 0.0 > IP packet < / RTI > The method for forming the concept and flow for such a flow is described in detail in the above prior art document, and therefore, a detailed description thereof will be omitted herein. Further, the concept of flow and the method of generating the flow in the present specification include technical ideas and description disclosed in the above-mentioned prior art documents as references in this specification, and can be regarded as being included in the description of this specification.

An example of a 5-tuple for creating a flow of attributes of packets is available. That is, the flow processor 110 may receive packets on the network as input, generate a flow that is a contiguous set of packets, or extract some of the packets forming the flow. A condition for generating a flow or detecting a flow packet is determined by comparing the attributes (e.g., 5-Tuple (Source Address, Destination Address, Source Port, Destination Port, Protocol) Value) does not exist, a new flow is created, and if there is a packet having the same value, the flow information of the flow can be updated.

The consecutive set of packets does not necessarily mean physically consecutive packets, but may be used to mean that the attributes of packets arriving within a time-limited period of time include the same packet.

The flow information includes 5-tuple information of a packet, and includes a flow size, a duration (ST) and a finishing time (ET) of a flow, a packet count (PC) An Average Packet Size, an Average Rate, a flag (e.g., a special signal (SYN, FIN, etc.) for the protocol) and / or poll size. The flow information may be output to the DB 160 and stored. The flow generation module 120 may store flow information for a predetermined flow and packets included in the flow in the DB 160 so as to correspond to each other. It can be defined that the flow generation module 120 generates the flow. For example, the flow information and the packets included in the flow may be stored so as to be physically continuous, or may be stored in various forms that can be easily searched even if physically separated such as a table, a link, and so on.

Some of the packets thus stored may be deleted based on the session information generated by the session creation module 130. [ That is, it may be deleted except for the initial N preceding packets of the session. Therefore, according to an embodiment, only flow information is stored for a specific flow, and a packet corresponding to the specific flow may not be stored.

The session creation module 130 may be configured such that when a plurality of flows are stored in the DB 160 by the flow generation module 120, that is, when a plurality of flows are created, Can be generated. Generating a session means extracting flows forming the same session among the plurality of generated flows, generating session information including identification information on the extracted flows, and storing the generated session information in the DB 160 . And storing the session information and the preceding N preceding packets among the packets included in the session so as to correspond to the session information. The process of storing the preceding packet so as to correspond to the session information may mean a process of deleting the preceding packet from the packets already stored by the flow generation module 120. [ Or the session information and the preceding packet may be separately stored. In this case, the preceding packet may be stored in duplicate.

The concept that the session creation module 130 creates a session will be described with reference to FIG.

2 is a view for explaining a session, a flow, and a packet for a method of providing a network inspection system according to an embodiment of the present invention.

Referring to FIGS. 1 and 2, when a session S is formed between predetermined devices, the session S may be composed of at least one flow F. FIG. Also, the at least one flow may each comprise at least one packet (P).

According to the technical idea of the present invention, the network inspection system 100 can collect packets via one point on a predetermined network. Which may be performed by the packet extraction module 110. [

And the network inspection system 100 may generate a flow based on the packet attributes (e.g., 5 tuples, etc.) of the packets being collected. The flow generation method is as described above. The generation of such a flow can be performed by the flow generation module 120. [ Each flow may consist of only one packet or a plurality of packets. Also, the flow size may be different for each flow.

Meanwhile, when the flow is generated as described above, the session creation module 130 can create a session.

The session creation module 130 can confirm the flow information stored in the DB 160 to create a session. The flows included in the same session may have a common characteristic. Therefore, the session creation module 130 can search for flows having the common property among the flows stored in the DB 160. [ Also, the temporal priority of each flow can be grasped based on the flow information (e.g., information such as S.T and E.T included in the flow information). The session creation module 130 may grasp the best flow and the last flow of the session based on the flag information included in the flow information of each session formation flow.

Accordingly, the session creation module 130 may extract at least one flow included in a specific session, that is, a session formation flow. The session formation flow may be one flow or may include a plurality of flows.

As described above, the network inspection system 100 according to the technical idea of the present invention does not generate only a flow but creates a session based on the generated flow is performed by the initial N (N is a natural number) It is because all important characteristics can be grasped. Thus, compared to storing and inspecting all of the packets for which the prior art collects are collected and for examining (e.g., DPI) a certain number of pre-packets for each flow, The desired information can be checked. Generally, it is known that there is not much difference in the quality of the inspection compared to inspecting all the packets included in the session in the case of inspecting packets in the initial five or more sessions.

Of course, it is also possible to store all the packets of the session according to the judgment of the service subject.

In addition, according to the technical idea of the present invention, when the network inspection system 100 provides a network recording service, it is possible to store only a small number of packets compared to the prior art. Therefore, there is an effect that a gain for storage can be generated.

Also, when a flow is generated from a packet and a session is created using the generated flow as in the technical idea of the present invention, high-speed packet search can be performed even when a particular service user searches for a packet. That is, the network inspection system 100 may store all the collected packets instead of storing only the first N preceding packets of the session. In this case, the session information generated by creating the session may be searched for first, It is possible to perform a down-drill search at a high speed by searching for a corresponding session, searching a flow corresponding to a desired packet from the searched session, and searching for a packet based on the searched flow. In the worst case, only a flow can be searched after the number of flows. However, if a session is formed, the search is performed only as many times as the number of sessions in the worst case, It is possible to search for flows and packets corresponding to the packets. Of course, this effect is still present even if only the initial N preceding packets are stored. Also, a service user who desires to search for a packet may know session information, but may not know information about a flow. Therefore, when a session is created as in the technical idea of the present invention, efficient and fast packet searching is enabled in the network recording service.

According to an embodiment, the session generation module 130 included in the network inspection system 100 may store M packets, that is, storage packets, rather than N preceding packets among collected packets. Even in this case, the network inspection system 100 can perform packet inspection on only the preceding packet. Also, by storing M stored packets, it is possible to increase the likelihood that desired packets are searched for not only packet inspection but also packet search. M may be adaptively set according to the type of service, the demand of the service user, or the type of application in which the session is used.

Referring again to FIG. 1, the session generation module 130 may generate a session based on a plurality of flows generated by the flow generation module 120. That is, session information can be generated.

The session information may include at least an index (identification information) of each of at least one flow included in the session, that is, a session forming flow. Also, various pieces of information indicating the characteristics of the session may be further included in the session information.

Through the generation of the session information, high-speed packet searching can be performed as described above, and it is also possible to specify only the initial N initial packets of the session through the generation of the session.

The conceptual structure in which the packets of the present invention are stored will now be described with reference to FIG.

3 is a diagram for explaining a concept of performing a packet search according to a method of providing a network inspection system according to an embodiment of the present invention.

Referring to FIG. 3, the session generation module 130 may generate a predetermined session as described above. The session information generated through the creation of the session may include at least the identification information of the session formation flow included in the session, as shown in FIG.

The session information may further include information on the 5-tuple of the session, the start time (S.T), the end time (E.T), the packet count (P, C), the session size (S)

The packet search module 140 included in the network inspection system 100 may first search for a session corresponding to the packet search request in response to a packet search request received from a terminal (not shown) of the service user . It is a matter of course that at least one information included in the session information may be included in the packet search request. For example, a sender address, a recipient address, and time information may be included in the packet search request.

Then, the packet search module 140 searches the flow information of each of the session forming flows included in the session information to search for a flow corresponding to the packet search request. When the flow corresponding to the packet search request is searched, the packet search module 140 can easily search the DB 160 for a packet corresponding to the packet search request. Of course, when the network inspection system 100 stores only the preceding packet according to the embodiment, there may be no packet corresponding to the packet search request. In addition, when storing all the packets, a packet corresponding to the packet search request may be guaranteed to be searched.

As a result, the technical idea of the present invention has an effect that a flow can be generated from a packet, a session can be created from a flow, and a high-speed search can be performed in descending order of session, flow, and packet when a packet is searched.

Referring again to FIG. 1, the packet inspection module 150 may perform packet inspection on the preceding packets of each session, as described above. The method of performing packet inspection may be various, and for example, a conventional DPI (Deep Packet Inspection) or the like may be used. It is a matter of course that the inspection result of the packet inspection module 150 can be stored in the DB 160. In addition, the packet inspection module 150 may inspect only the preceding packet, and the packet inspection for the session may be completed in real time before the end of the session. Accordingly, the network inspection system 100 (E.g., blocking, bandwidth adjustment, etc.) for the session.

Meanwhile, according to the technical idea of the present invention, the network inspection system 100 may be used in a network recording service as described above. Conventionally, all the collected packets have to be stored for network recording. However, according to the technical idea of the present invention, by storing only the initial N first packets of a session by forming a session, important information can be stored do. Of course, M storage packets may be stored according to the service requirement. Even in this case, there is a saving effect of storage compared to collecting / storing the whole packet.

Also, according to the technical idea of the present invention, the network inspection system 100 may store only packets corresponding to a predetermined type of session. For example, the network inspection system 100 can perform network recording only on predetermined sessions such as HTTP, TCP session, and the like.

The function of performing the network recording only for the predetermined session may be performed by the flow generation module 120 or may be generated by the session generation module 130. [ For example, the flow generation module 120 may generate a flow for only a packet corresponding to a predetermined session among the packets collected by the packet extraction module 110. Alternatively, the flow generation module 120 may generate a flow for all packets, and then delete a flow not corresponding to a predetermined session among the flows generated by the session generation module 130 from the DB 160 .

Whether the session corresponds to the predetermined session can be grasped based on the port information of the packets. That is, the port number may be bound according to the type of the session, and it may be determined based on the port number whether it is a packet or a flow corresponding to a predetermined session.

According to an embodiment, the packet extraction module 110 may transmit only a packet corresponding to a predetermined session to the flow generation module 120.

In any case, the network inspection system 100 may perform network recording only for a predetermined session.

As a result, according to the technical idea of the present invention, the absolute amount of packets to be stored can be reduced compared with the conventional network recording, and network recording can be performed only for a desired session.

This can be conceptually shown in FIG.

4 is a diagram for explaining an effect of a method of providing a network inspection system according to an embodiment of the present invention.

Referring to Figure 4, the horizontal axis of the rectangle represents the session size conceptually and the vertical axis represents the sessions conceptually. Therefore, the rectangle 10 shown in FIG. 4 may mean the amount of packets stored in the case of storing all the collected packets.

The network inspection system 100 according to the technical idea of the present invention can store only N preceding packets (or M storage packets) instead of storing all the packets included in a specific session, The amount of the effect can be reduced.

In addition, since the network inspection system 100 according to the technical idea of the present invention can store only a predetermined kind of session rather than storing packets for all the sessions, ), There is an effect that the packet can not be stored at all.

As described above, according to the technical idea of the present invention, it is possible to perform high-speed packet search by selectively storing only packets that are significant to the packet inspection while reducing the absolute amount of stored packets. At the same time, high-speed packet search can be performed through drill-down search in the order of session information and flow information as described above.

The method of providing a network inspection system according to an embodiment of the present invention may be implemented in the form of computer readable program instructions and stored in a computer readable recording medium. May also be stored in a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software.

Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk and a magnetic tape, optical media such as CD-ROM and DVD, a floptical disk, And hardware devices that are specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. The above-mentioned medium may also be a transmission medium such as a light or metal wire, wave guide, etc., including a carrier wave for transmitting a signal designating a program command, a data structure and the like. The computer readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner.

Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is intended that the present invention covers the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. .

Claims (15)

The network inspection system comprising: receiving a plurality of packets from a network;
Generating a plurality of flows formed by the plurality of packets based on the plurality of packets received by the network inspection system;
Extracting at least one session formation flow that forms the same session among the plurality of flows based on the information about the plurality of flows generated by the network inspection system; And
The priority of the at least one session forming flow and the identification of the session forming flow based on the start time, the end time, or the flag information included in the flow information of the at least one session forming flow extracted by the network checking system (N is a natural number) preceding packets included in the session, which are determined based on the specific session information and the priority, and stores the same in the DB The method comprising the steps of:
delete The method of claim 1,
Further comprising storing flow information for each of the session forming flows.
The method of claim 1,
Further comprising the step of the network inspection system performing packet inspection of the preceding packet.
The network inspection system according to claim 1,
And only the preceding packet is stored.
The network inspection system according to claim 1,
Storing the initial M (M is a natural number greater than N) storage packets of the session,
Wherein the network inspection system performs packet inspection only on the N preceding packets among the M storage packets.
The network inspection system according to claim 1,
And stores the session information and the preceding packet only for a predetermined type of session.
8. The network inspection system according to claim 7,
And specifying the session of the predetermined kind based on port information of the session included in at least one of the plurality of packets, the session information, and the flow information of each of the session forming proxies.
4. The method of claim 3,
Receiving a search request for packets stored in the DB;
Wherein the packet search server is configured to specify session information corresponding to the packet search in response to the packet search request, specify a session formation flow corresponding to the packet search based on the specified session information, And extracting a packet corresponding to the request.
A computer program installed in a data processing apparatus and stored in a computer-readable storage medium for performing the method of any one of claims 1 to 9.
A flow generation module for generating a plurality of flows formed by the plurality of packets based on a plurality of packets received from a network;
Extracting at least one session formation flow forming the same session among the plurality of flows based on the information about the generated plurality of flows, extracting at least one of the flows included in the extracted flow information of the at least one session formation flow Identifying session information for the session including the priority of the at least one session forming flow and the identification information of the session forming flow based on a start time, an end time, or flag information, (N is a natural number) preceding packets of the session included in the session, if the determination result is determined based on the first packet.
delete 12. The network inspection system according to claim 11,
And a packet inspection module for performing packet inspection on the preceding packet.
12. The method of claim 11,
And stores the session information and the preceding packet only for a predetermined type of session.
12. The network inspection system according to claim 11,
Receiving a packet search request of a packet stored by the network inspection system, specifying session information corresponding to the packet search request in response to the packet search request, and transmitting the packet search request corresponding to the packet search request Further comprising a packet search module for specifying a session formation flow and extracting a packet corresponding to the packet search request based on the specified session formation flow.

Images