System and method for classifying network packets with packet content
View Patent ↗Packets are classified by content across a packet flow by sequencing packets according to packet flows through a content engine. A sequencer tracks packet flows, sending and buffering out-of-order packets to have missing packets resent. A regular expression engine determines matches of regular expressions and subexpressions with regular expressions encoded as non-deterministic finite automata with field programmable gate arrays and subexpression matches computed with a hash and determined by a hash look-up table. A tag module establishes a classification tag for a packet based on the packet's content by matching the tag with the regular expression and subexpressions of the packet.
1. A method of claim for classifying packets based on content, the method comprising:
identifying packet flows, said packet flows comprising a TCP stream;
determining if a packet is out of order;
transmitting the out of order packet to its client to have missing packets resent;
buffering the out-of-order packet until the missing packet is received;
making the packet flow associated with the missing packet available for content searching;
searching packet content across the identified packet flows to find one or more predetermined regular expressions;
computing a hash for predetermined strings of the regular expressions to find one or more subexpressions; and
using a tag map to:
perform a mapping between said regular expressions and said subexpressions; and
generate a modified tag corresponding to matches between predetermined expressions and subexpressions; and
tagging packets with said modified tags.
2. A system for sequencing packet streams for content classification, the system comprising:
an enqueue engine that receives the streams and reads the stream identification of stream packets to determine if a packet is out of order;
a stream tracker interfaced with the enqueue engine that associates packets to streams based upon the stream identification read by the enqueue engine;
a dequeue engine interfaced with the stream tracker and operable to forward packets for classification based on the packets' stream identification; and
a packet buffer interfaced with the enqueue engine for storing packets, wherein the enqueue engine is operable to:
transmit an out-of-order packet so that missing packets can be resent;
mark the out-of-order packet as sent; and
buffer the out-of-order packet.
3. The system of claim 2 wherein the dequeue engine is further operable to receive a stream identification, forward the next packet of the stream associated with the stream identification if the stream tracker indicates the next packet is ready, and forward the next packet of a second stream if the next packet of the associated stream is not ready.
4. The system of claim 3 wherein the dequeue engine updates the stream tracker to indicate when a packet is forwarded for classification.