Data matching using flow based packet data storage

摘要

A system for matching data using flow based packet data storage includes a communications interface and a processor. A communications interface receives a packet between a source and a destination. The processor identifies a flow between the source and the destination based on the packet. The processor determines whether some of packet data of the packet indicates a potential match to data in storage using hashes. The processor then stores the data from the most likely data match and second most likely data match without a packet header in a block of memory in the storage based on the flow.

主权项

1. A system for matching data using flow based packet data storage, the system comprising:
a communications interface that receives at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information; and a processor that:
identifies a flow between the source and the destination based on the flow information in the at least one data packet;determines whether at least a portion of the data from the received at least one data packet indicates a potential match to data in storage using hashes;retrieves a list of possible data matches;uses a computed hash index to index a hash table for the data;determines match sizes of the most likely data match and second most likely data match;stores the data from the at least one data packet without a packet header in a block of memory allocated for the flow if both match sizes are small; andgenerates a retrieve instruction for the data match with the larger match size if at least one match size is not small.