Active packet content analyzer for communications network
View Patent ↗An active packet inspection device for a communications network, comprises a first terminal and a second terminal each adapted to couple the appliance in-line in the network and communicate data packets with network devices. A packet processor is coupled to the first terminal and second terminal and configured to normalize the data packets. A network search engine coupled to the packet processor and the memory, and configured to compare the data packets with the stored signatures, and when a match is found and other specified conditions are met, to perform an action identified in an associated rule. In one aspect, the network search engine includes a network search engine controller and a network search engine table including a memory configured to store a plurality of replicated signatures. Advantages of the invention include the ability to perform deep packet inspections actively on a communications network at high-speed.
1. An active packet content analyzer for a communications network, the active packet content analyzer comprising:
a first terminal and a second terminal each couple the analyzer in-line in the network and communicate data packets with network devices;
a packet processor coupled to the first terminal and second terminal and configured to normalize the data packets; and
a network search engine coupled to the packet processor and the memory, and configured to compare the data packets with the stored signatures, and when a match is found, to perform an action identified in an associated rule,
wherein the network search engine includes multiple entries for each stored signature, where each signature is replicated a number of times and staggered with respect to one another, and
search time is reduced in proportion to the number of replicated stored signatures.
2. The active packet content analyzer of claim 1 , wherein:
the network search engine includes 16 entries for each stored signature, where each signature is replicated 16 times and staggered with respect to one another.
3. The active packet content analyzer of claim 1 , wherein:
the network search engine includes a network search engine controller and a network search engine table including a memory configured to store the signatures.
4. The active packet content analyzer of claim 3 , wherein:
the network search engine table includes 16 entries for each stored signature, where each signature is replicated 16 times and staggered with respect to one another.
5. The active packet content analyzer of claim 3 , wherein:
the actions taken by the analyzer based on a signature match and associated rule include at least one of alert on match, drop on match, log on match and replace on match.
6. The active packet content analyzer of claim 1 , wherein:
the actions taken by the analyzer based on a signature match and associated rule include at least one of alert on match, drop on match, log on match and replace on match.
7. The active packet content analyzer of claim 1 , wherein:
the actions taken by the deep packet content analyzer based on a signature match other conditions match, and associated rule include at least one of alert on match, drop on match, log on match and replace on match.
8. The active packet content analyzer of claim 1 , further comprising:
a user interface to an administrative computer,
wherein the administrative computer is configured to communicate with the network search engine to upload rules to the network search engine.
9. A method of monitoring a communications network using an active packet content analyzer coupled in-line in the network, the active deep packet content analyzer including a packet processor and network search engine, the method comprising the steps of:
receiving data packets;
normalizing the data packets;
comparing the data packets with the stored signatures;
when a match is found, performing an action identified in an associated rule; and
storing multiple entries for each stored signature, where each signature is replicated a number of times and staggered with respect to one another, wherein search time is reduced in proportion to the number of replicated stored signatures.
10. The method of claim 9 wherein:
the network search engine includes 16 entries for each stored signature, where each signature is replicated 16 times and staggered with respect to one another.
11. The method of claim 9 , wherein the network search engine includes a network search engine controller and a network search engine table.
12. The method of claim 11 , wherein:
the network search engine table includes 16 entries for each stored signature, where each signature is replicated 16 times and staggered with respect to one another.
13. The method of claim 11 wherein:
the step of performing an action identified in an associated rule includes at least one of alert on match, drop on match, log on match and replace on match.
14. The method of claim 9 , wherein:
the step of performing an action identified in an associated rule includes at least one of alert on match, drop on match, log on match and replace on match.
15. The method of claim 9 , further comprising the step of:
communicating with the network search engine to upload rules to the network search engine.