Cisco Technology, Inc.

William Nelson

Rina Panigrahy

Anh Tien Nguyen

Methods and apparatus are disclosed for regular expression matching, especially for, but not limited to high-speed applications such as in a packet switching system (e.g., a router). One implementation includes a matching mechanism for processing each character of a plurality of input characters to progressively generate keyword indications of matched keywords as matched keywords are identified, and for generating one or more matching indications of matched base expressions and non-keyword expressions. These indications are received by a matched regular expression detection mechanism which generates one or more matched regular expression indications based on said one or more keyword indications and said one or more matching indications. In one implementation, the matched regular expression detection mechanism maintains a keyword data structure, which is updated as matched keyword indications are received to ensure they are matched in a proper order. One implementation uses a bitmap to track the matched keywords and AND-SHIFT-OR operations to efficiently update the bitmap.

Methods and apparatus for regular expression matching

Methods and apparatus which facilitate the handling of data between platforms interconnected by any of a variety of network environments are disclosed. In general terms, the present invention represents an improvement over conventional packet parsing and searching mechanisms. The parse mechanism sequentially analyzes each character of the packet data and passes relevant characters to the search mechanism as soon as each character is reached. Preferably, the characters of each data field are parsed character-by-character. In one implementation, prior to searching a relevant data field, the parser initializes the appropriate search mechanism based on at least the data field type (e.g., the cookie field or URL field of an HTTP request). Each character of the relevant data is then passed sequentially to the search mechanism, where a search state are obtained for each passed character. Accordingly, the parser passes each character of the relevant data fields to the search mechanism. Since the parser passes the well-defined fields of standard protocols, such as HTTP and FTP, parsing may be efficiently performed without referencing memory (e.g., parsing is implemented in micro-code). When the parser reaches the end of the relevant data field, the parser may then cause the search mechanism to output search results associated with the search state of the last searched character. Alternatively, the parser may initiate another search for another data field, which is subsequently parsed and searched character-by-character as recited above for the first field.

Packet data analysis with efficient and flexible parsing capabilities

Disclosed is an apparatus employing an efficient buffering scheme for analyzing the Layer 7 content in packet data sent from a first node to a second node within a computer network. The apparatus includes a first device having a buffer and one or more first processors. The apparatus also includes a second device having one or more second processors. The first device is a physically separate device from the second device. The second processor of the second device is configured to manage the buffer of the first device, and the first processor is also configured to analyze packet data accessed from the buffer.

Growing community of inventors

Los Altos, CA, United States of America

William Nelson