Patent ID: 8526318
Filing Date: 2013-09-03
Classification: H04L

Abstract:
1. A method of identifying payload of a data packet in a TCP stream, comprising: inspecting the TCP stream to obtain the data packet in the TCP stream; calculating a payload signature according to information in a header of the data packet in the TCP stream, the header comprising a TCP header and a pseudo header, wherein the TCP header comprises a checksum, wherein the checksum is generated based on fields in the TCP header, the payload, and the pseudo header; wherein calculating the payload signature comprises removing from the checksum portions of the checksum which correspond to the TCP header and the pseudo header, and obtaining the payload signature; wherein removing from the checksum portions of the checksum which correspond to the TCP header and the pseudo header further comprises bitwise-negating the checksum subsequent to subtracting 1 therefrom, obtaining value A, obtaining value B by adding complement of fields except the checksum in the TCP header and of fields in the pseudo header in the unit of 16 bits, adding 1 to value B subsequent to bitwise-negating value B, obtaining resultant value B′, and adding value A and value B′; comparing the payload signature with a pre-stored file signature; and determining the payload of the data packet in the TCP stream as belonging to a file corresponding to the pre-stored file signature, in response to a match between payload signatures of multiple data packets and the pre-stored file signature.