| 摘要 |
<p>The method involves storing metadata (MD) in memory area (FS-1), and user data (UD) in memory area (FS-2), such that association between user data and metadata is maintained. The metadata is read from the buffer store (FS). If the data packet (D) is currently not being processed, the associated user data is read from buffer store, and a flag is set in metadata stored in buffer store. If all metadata and user data are read from network session, and search for search term is successful in user data, the network session is reconstructed by providing user data into their original order. Independent claims are included for the following: (1) apparatus for analysis of data packets comprising metadata and user data.</p> |
