Real-time network monitoring and security

摘要

A method and apparatus are provided for analysing data packets being carried over a network. A hardware search engine logic performs a bit-wise comparison of one or more bit patterns stored in a bit pattern memory array with bit sequences contained in data packets received at a network interface. A matching bit pattern identifies a data packet as actionable. Software-implemented processing may then be carried out on those data packets identified as actionable. A multi-tap delay buffer may also be provided to take data packets received at the network interface and to output them with different lengths of delay. Further hardware-based bit pattern matching or further software-based processing may then be carried out on data packets being output from the delay buffer according to the results of bit pattern matching or software-based processing of received data packets output from the buffer at an earlier tap.