System and method for efficient matching of regular expression patterns across multiple packets

1. A switch, comprising:

a flow tracker that reviews a packet in an identified flow of packets that enters the switch at an ingress pipeline, the flow tracker generating flow information for forwarding with the reviewed packet to a memory management unit in the switch; and

a signature matching engine in an auxiliary pipeline of the switch that receives the reviewed packet and the flow information from the memory management unit, the signature matching engine examining the reviewed packet using context state information that is retrieved from a state table in memory of the signature matching engine,

wherein the retrieved context state information identifies a state of examination of an expression matching state machine in examining a packet prior to the reviewed packet in the identified flow,

wherein results from the expression matching state machine are included by the signature matching engine in a response packet that is sent by the signature matching engine to an ingress pipeline of the switch.

2. The switch of claim 1 , wherein the flow tracker creates an entry in a flow tracker session table on identification of a new flow of packets.

3. The switch of claim 1 , wherein the signature matching engine saves a first match state at an end of a first packet and uses the first match state as a start match state for a second packet following the first packet.

4. The switch of claim 1 , wherein the flow information includes a flow index that identifies a particular flow of packets to which the reviewed packet is associated.

5. The switch of claim 4 , wherein the signature matching engine retrieves context state information from the state table using a flow index.

6. The switch of claim 1 , wherein the expression matching state machine is a deterministic finite state automata state machine.

7. The switch of claim 1 , wherein the auxiliary pipeline is separate from an egress pipeline in the switch.

8. A switch, comprising:

a flow tracker that reviews a packet in an identified flow of packets that enters the switch at an ingress pipeline, the flow tracker generating flow information for forwarding with the reviewed packet to a memory management unit in the switch; and

a signature matching engine in an auxiliary pipeline of the switch that receives the reviewed packet and the flow information from the memory management unit, the signature matching engine analyzing the reviewed packet using a plurality of cross signature flags that are retrieved from a state table in memory of the signature matching engine,

wherein each of the retrieved plurality of cross signature flags identifies a match result of one of a plurality of corresponding expression matching state machines in examining a prior packet in the identified flow of packets.

9. The switch of claim 8 , wherein a set of cross signature flags indicates a sequence of matches by linking the sequence of matches.

10. The switch of claim 8 , wherein the flow information includes a flow index that identifies a particular flow of packets to which the reviewed packet is associated.

11. The switch of claim 8 , wherein the expression matching state machine is a deterministic finite state automata state machine.

12. The switch of claim 8 , wherein the auxiliary pipeline is separate from an egress pipeline in the switch.

13. The switch of claim 8 , wherein results from the expression matching state machine are included by the signature matching engine in a response packet that is sent by the signature matching engine to an ingress pipeline of the switch.

14. A method, comprising:

reviewing, by a flow tracker in a switch, a packets in an identified flow of packets that enters the switch at an ingress pipeline;

forwarding, by the flow tracker, the reviewed packet and flow information to a memory management unit in the switch;

determining, by a signature matching engine in an auxiliary pipeline of the switch that receives the reviewed packet and the flow information from the memory management unit, a match to a known signature based on an analysis of a combination of packets that includes the reviewed packet and one or more prior packets that are part of the identified flow of packets, wherein the analysis of the combination of packets is facilitated by context state information that is retrieved from a state table in memory of the signature matching engine; and

sending, by the signature matching engine to an ingress pipeline of the switch, a response packet that includes results from the expression matching state machine.

15. The method of claim 14 , further comprising creating an entry in a flow tracker session table on identification of a new flow of packets.

16. The method of claim 14 , wherein the analysis of the combination of packets is facilitated by a plurality of cross signature flags for linking matches.

17. The method of claim 14 , wherein the expression matching state machine is a deterministic finite state automata state machine.

18. The method of claim 14 , wherein the auxiliary pipeline is separate from an egress pipeline in the switch.

19. The method of claim 14 , wherein the flow information includes a flow index that identifies a particular flow of packets to which the reviewed packet is associated.

20. The method of claim 19 , wherein the signature matching engine retrieves context state information from the state table using a flow index.