US Patent 8958318 Event-based capture of packets from a network flow

An apparatus and method for event-based data capture from network flows are provided. At a network device, a network flow is received that comprises a plurality of packets each comprising control information and data. The network flow is monitored for the occurrence of at least one predetermined triggering event. In response to detecting the triggering event, at least a portion of one or more of the packets received after the triggering event is captured, and the captured portion is exported to an analysis server. The network device may comprise any device configured to forward flows of packets such as, for example, switches, routers, firewalls, etc.