State processor for pattern matching in a network monitor device

• US 20040199630A1
• Filed: 04/20/2004
• Published: 10/07/2004
• Est. Priority Date: 06/30/1999
• Status: Active Grant

• Current Assignee: Packet Intelligence LLC (Packet Intelligence Holdings LLC)
• Original Assignee: Hifn, Inc. (Maxlinear Incorporated)
• Inventors: Dietz, Russell S., Koppenhaver, Andrew A., Sarkissian, Haig A.
• Granted Patent: US 7,299,282 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 49/101 using crossbar or matrix
• CPC Class Codes: H04L 49/20 Support for services
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A processor for processing contents of packets passing through a connection point on a computer network. The processor includes a searching apparatus having one or more comparators for searching for a reference string in the contents of a packet, and processes contents of all packets passing through the connection point in real time. In one implementation, the processor is programmable and has an instruction set that includes an instruction for invoking the searching apparatus to search for a specified reference string in the packet starting at an unknown location within a range of the packet.

Claims

1-6. -6 (Cancelled)

7. A processor configured to process contents of packets passing through a connection point on a computer network, the processor comprising:

(a) a buffer for receiving at least some of the contents of each packet passing through the connection point;

(b) a memory containing one or more instructions of an instruction set for the state processor;

(c) an arithmetic logic unit (ALU) coupled to the buffer;

(d) a control block coupled to the ALU and to the instruction memory for decoding instructions; and

(e) a program counter coupled to the instruction memory and to the ALU for indicating the next state processor instruction in the memory to process,

wherein the ALU includes a searching apparatus comprising one or more comparators for searching for a reference string in the contents of a packet.

8. A processor according to claim 7, wherein the state processor processes contents of all packets passing through the connection point in real time.

9. A processor according to claim 7, wherein the instruction set includes an instruction for invoking the searching apparatus of the ALU to search for a specified reference string in the packet starting at an unknown location within a range of the packet.

10. A processor according to claim 7, wherein the searching apparatus searches for any of a set of reference strings in the contents of a packet, and wherein the instruction set includes an instruction for invoking the searching apparatus to search for any of a set of specified reference strings in the packet starting at an unknown location within a range of the packet.

11-26. -26. (Cancelled)