In conventional communication networks, a traffic flow of data packets transmitted through the communication network may be captured and forwarded to a network tap device. The network tap device then forwards the full traffic flow of captured network traffic, as received, to an external monitoring device. This transmission of the full traffic flow of captured network traffic to external monitoring devices has many drawbacks.
For example, many external monitoring devices are specialized such that they analyze and/or monitor only specific segments of a captured data packet or types of captured traffic. Thus, these specialized external monitoring devices need to receive only relevant captured data packet segments or types of captured traffic. Receipt of the full traffic flow of captured network traffic serves to require the specialized external monitoring devices to filter out irrelevant information from the full traffic flow of captured network traffic prior to executing it's analysis and or monitoring functions. This filtering causes results in an increased burden on the resources, such as bandwidth and processing time, on both the communication network and the network tap.
Another drawback to transmission of unmodified captured traffic flows results when inappropriate information is transmitted to an external monitoring device. For example, when the external device is a telecommunications monitor attempting to monitor the quality-of-service for a telecommunicated conversation between two individuals, receipt of the all data included in the conversation may be an unnecessary use of bandwidth and, in a case where receipt of all data included in the conversation is of a violation of wire-tapping laws, illegal.
A further drawback to the transmission of unmodified captured traffic occurs because the external monitoring devices are not aware of an originating port for captured network traffic or when, either sequentially or chronologically, captured network traffic enters into the communication network and/or network tap.