A network interface device for communicating between a data processing system and a network (105; 205), the network interface device comprising a logic device (100; 200) for intercepting a data flow from a network source (104; 106) to a network destination, the data processing system comprising the network source (104; 206), the logic device (100; 200) comprising: a host interface over which packets of the data flow are received from the network source (104; 206); a network interface over which packets of the data flow permitted through the logic device (100; 200) are transmitted onto the network (105; 205); a data store holding a set of compliance rules and corresponding actions and state information associated with the compliance rules; a packet inspector configured to inspect the data flow and identify from the data store a compliance rule associated with the data flow, wherein the compliance rule expresses a pattern over packets of the data flow and specifies values in payloads of packets of the data flow; a matching engine configured to, following identification of the compliance rule associated with the data flow by the packet inspector: maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of packets of the data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the data flow; identify, using the state information, a pattern over packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to when the data flow is identified as being associated with a compliance rule, carry out an action with respect to the data flow corresponding to the compliance rule in dependence upon said pattern being identified over packets of the data flow, wherein the corresponding actions comprise an action of redirecting the data flow to a control engine, wherein the data store comprises an interface configured to receive updates to the compliance rules and corresponding actions in the data store from the control engine, wherein the updates are authenticated using at least one key accessible to the logic device (100; 200), wherein the logic device (100; 200) is configured to decrypt the updates from the control engine. a host interface over which packets of the data flow are received from the network source (104; 206); a network interface over which packets of the data flow permitted through the logic device (100; 200) are transmitted onto the network (105; 205); a data store holding a set of compliance rules and corresponding actions and state information associated with the compliance rules; a packet inspector configured to inspect the data flow and identify from the data store a compliance rule associated with the data flow, wherein the compliance rule expresses a pattern over packets of the data flow and specifies values in payloads of packets of the data flow; a matching engine configured to, following identification of the compliance rule associated with the data flow by the packet inspector: maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of packets of the data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the data flow; identify, using the state information, a pattern over packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to when the data flow is identified as being associated with a compliance rule, carry out an action with respect to the data flow corresponding to the compliance rule in dependence upon said pattern being identified over packets of the data flow, maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of packets of the data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the data flow; identify, using the state information, a pattern over packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to when the data flow is identified as being associated with a compliance rule, carry out an action with respect to the data flow corresponding to the compliance rule in dependence upon said pattern being identified over packets of the data flow, wherein the corresponding actions comprise an action of redirecting the data flow to a control engine, wherein the data store comprises an interface configured to receive updates to the compliance rules and corresponding actions in the data store from the control engine, wherein the updates are authenticated using at least one key accessible to the logic device (100; 200), wherein the logic device (100; 200) is configured to decrypt the updates from the control engine.