| 摘要 |
In certain embodiments, a method includes receiving, using one or more processors, a trigger expression. The method may include processing, using the one or more processors, the trigger expression, the trigger expression comprising a first one or more terms comprising a first one or more fields, to generate a reduced trigger expression. The reduced trigger expression includes a second one or more terms comprising a second one or more fields and being logically equivalent to the trigger expression. The method may include generating, using the one or more processors, a dynamic state machine by generating a first data structure comprising each of the second one or more fields, generating, based on the first data structure, an expanded trigger expression by adding one or more additional terms for possible state transitions, and generating, based on the expanded trigger expression, a second data structure. |
| 主权项 |
1. A method, comprising:
receiving, using one or more processors, a trigger expression; processing, using the one or more processors, the trigger expression, the trigger expression comprising a first one or more terms comprising a first one or more fields, to generate a reduced trigger expression, the reduced trigger expression comprising a second one or more terms comprising a second one or more fields and being logically equivalent to the trigger expression; generating, using the one or more processors, a dynamic state machine by performing operations comprising:
generating a first data structure comprising each of the second one or more fields;generating, based on the first data structure, an expanded trigger expression by adding one or more additional terms for possible state transitions; andgenerating, based on the expanded trigger expression, a second data structure; receiving one or more first data packets; analyzing, using one or more of a plurality of bits in a plurality of actual mask and match register modules, the one or more first data packets; determining, based on analyzing the one or more first data packets using the second data structure, a trigger state; and in response to determining the trigger state, taking an action with respect to capturing data packets. |
