String search scheme in a distributed architecture
First Claim
1. A network electronic device for searching for predetermined strings, the device comprising:
- a first processor including a classification engine to be coupled to receive a network packet via a network and to perform a first stage search on data contained in the network packet, wherein the classification engine generates a first stage search report that indicates multiple potential strings of interest if the data contained within the network packet has a first block matching a corresponding first block of at least one of the predetermined strings, wherein the first stage search report includes a field to indicate how many potential strings of interest were identified in the data during the first stage search, and wherein the first stage search report further includes entries for each potential string of interest for identifying each block of data that matches a corresponding block of data of the at least one of the predetermined strings; and
a policy processor coupled to perform a second stage search on the data contained in the network packet in response to the first stage search report, wherein the second stage search compares a second block of the potential string of interest to a corresponding second block of the at least one predetermined string to determine whether a match exists.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods and apparatuses for searching network data for one or more predetermined strings are disclosed. In one embodiment, the string search is a multi-stage search where the stages of the search are performed by different hardware components. In one embodiment in a first search stage, a first processor performs a comparison of blocks of incoming data to determine whether the blocks potentially represent the beginning of one of the predetermined strings. If a potential predetermined string is identified, a second processor performs a further search to determine whether the string matches one of the predetermined strings. Because the first processor searches only for the beginning of the predetermined strings, the first stage comparison can be performed quickly, which improves network performance as compared to more detailed searching. The second stage is performed by second processor, which allows the first processor to search for potential matching strings. Because many strings do not match the one or more predetermined strings, the more detailed search performed by the second processor is performed selectively, which increases network performance as compared to more detailed searches on all network data.
-
Citations
16 Claims
-
1. A network electronic device for searching for predetermined strings, the device comprising:
-
a first processor including a classification engine to be coupled to receive a network packet via a network and to perform a first stage search on data contained in the network packet, wherein the classification engine generates a first stage search report that indicates multiple potential strings of interest if the data contained within the network packet has a first block matching a corresponding first block of at least one of the predetermined strings, wherein the first stage search report includes a field to indicate how many potential strings of interest were identified in the data during the first stage search, and wherein the first stage search report further includes entries for each potential string of interest for identifying each block of data that matches a corresponding block of data of the at least one of the predetermined strings; and a policy processor coupled to perform a second stage search on the data contained in the network packet in response to the first stage search report, wherein the second stage search compares a second block of the potential string of interest to a corresponding second block of the at least one predetermined string to determine whether a match exists. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
Specification