Content processor
A content processor is described that is able to scan the contents of entire data packets including header and payload information. The content processor includes a queue engine operable to reorder out of order data packets and reassemble fragmented data packets. The queue engine sends the reordered and reassembled data packets to the context engine, which schedules the packets to be scanned. The packets are scanned by the content scanning engine using one or more string memories and one or more leaf string memories. The string memories are used by the content scanning engine to determine if there is a potential match between the data packet being scanned and any of the strings contained in database of known strings. If a potential match is identified, whether or not there is an exact match is determined using the leaf string memories and the leaf string compare engine. The scanning of the data packet results in a conclusion being generated by the content scanning engine. The conclusion can be an intermediate conclusion, can be an instruction to be executed by the content processor, can instruct the context engine to forward the information to a host processor for further analysis, or can be the final conclusion sent with the data packet with routing and quality of service treatment. Other uses for the conclusion are programmable in the content processor.
1. A content processor for scanning data packets on a data network, each data packet having associated contents, the content processor comprising:
a content scanning engine operable to compare the contents, including a header and a payload, of the data packets with a database of known signatures, and to produce a conclusion based on the results of the comparison;
a queue engine operable, before scanning by the content scanning engine, to reorder out of sequence data packets and to buffer data packets for scanning by the content scanning engine; and
a context engine receiving the data packets, including the reordered data packets, from the queue engine and operable to schedule the data packets to be scanned by the content scanning engine.
2. The content processor of claim 1 wherein the content scanning engine scans first to determine a potential match from the database of known signatures, and second to determine whether the potential match matches the contents of the data packet.
3. The content processor of claim 1 wherein the context engine processes the data packet in multiple blocks.
4. The content processor of claim 1 each data packet is associated with a session id generated by the content processor and referenced to a particular location in a session CAM.
5. The content processor of claim 1 wherein the context engine further includes a script engine operable to execute user defined instructions, and wherein content scanning engine is able to call the script engine based upon the generated conclusion.
6. The content processor of claim 1 wherein the content scanning engine further includes a string preprocessor operable to compress white space in the contents of the data packet.
7. The content processor of claim 1 wherein the context engine further includes a host interface operable to send information to and receive information from a microprocessor.
8. The content processor of claim 1 wherein the content scanning engine is able to scan across multiple data packets by storing state in the session memory.