In the current generation of Narus’ system, the processing systems run on commodity Linux servers and re-assemble network sessions as they’re captured, mining them for metadata, file attachments, and other application data and then indexing and dumping that information to a searchable database.

via Building a panopticon: The evolution of the NSA’s XKeyscore | Ars Technica.