Real-time network monitoring and security

Abstract

There is provided a hardware device for monitoring and intercepting data packetized data traffic at full line rate. In preferred high bandwidth embodiments, full line rate corresponds to rates that exceed 100 Mbytes/s and in some cases 1000 Mbytes/s. Monitoring and intercepting software, alone, is not able to operate on such volumes of data in real-time. A preferred embodiment comprises: a data delay buffer () with multiple delay outputs (); a search engine logic () for implementing a set of basic search tools that operate in real-time on the data traffic; a programmable gate array (); an interface () for passing data quickly to software sub-systems; and control means for implementing software control of the operation of the search tools. The programmable gate array () inserts the data packets into the delay buffer (), extracts them for searching at the delay outputs and formats and schedules the operation of the search engine logic (). One preferred embodiment uses an IP co-processor as the search engine logic.