Methods and apparatus for processing data in a network

摘要

A first described method comprises receiving a stream of data packets over a network interface 11 representing different flows. A Field Programmable Gate Array (FPGA) 12 is used to perform variable position keyword and/or signature matching 17 in the packets indicative of the presence of an application protocol of interest or application protocol event of interest. The results of the keyword or signature matching are communicated to software 21. A determination is made based on the results that a flow is of interest and extracting flow information for the flow. Software packets belonging to a flow of interest or related flows are then processed differently 25,27 from packets of other flows. A second method relates to load balancing in a FPGA by cycling between a subset of generated signature or checksum values. A third method relates to analysing packets to determine flows of interest and for flows of interest extracting the source IP address and forwarding packets for further monitoring according to whether they contain the extracted source IP address. A fourth method relates to generating statistics 19 for a plurality of packets in a particular flow and comparing them 21 to expected values for a flow of a known type to determine a degree of match.