FIELD: information security.
SUBSTANCE: group of inventions relates to information security and can be used to collect TCP session data between participants. Method comprises steps of: a) detecting transmission of network traffic over a TCP session between participants in the same computer network; b) performing mirroring of detected network traffic to obtain a copy of transmitted data on a server located in another computer network; c) collecting a TCP session from the received copy of the transmitted data using at least one heuristic rule for determining the allowable loss, including the loss of at least one network packet in network traffic, wherein TCP session collection is continued if, after tolerable loss, network packets continue to arrive.
EFFECT: providing continuous collection of TCP session data during network traffic mirroring.
16 cl, 9 dwg
