Patent ID: 7809827
Filing Date: 2010-10-05
Classification: H04L

Abstract:
1. A network device comprising: a lawful intercept (LI) service card executing a communication protocol to receive, from one or more law enforcement agents (LEAs), intercept information specifying at least one destination and criteria for matching one or more packet flows; a network interface card to receive a packet from a network; a control unit to provide contents of the packet from the interface card to the LI service card, wherein the LI service card executes a flow match detection module that determines whether the contents of the packet match the criteria of the intercept information and, when the contents of the packet match the criteria of the intercept information, forwards the packet to the destination specified by the intercept information; a filter cache that caches intercept information recently received from the LEAs; a filter table that stores all of the intercept information received from the LEAs except the intercept information cached in the filter cache; and an array of reference counts addressable by a range of source IP addresses as one dimension of the array and a range of destination IP addresses as another dimension of the array, wherein each reference count indicates a number of filters specified by the intercept information capable of matching at least one address within the address ranges associated with the reference count.