A logic device for intercepting a data flow from a network source to a network destination, the logic device comprising: a data store holding a set of compliance rules and corresponding actions and state information associated with the compliance rules, the logic device characterised in that different ones of the compliance rules stored in the data store are associated with different data flows, a packet inspector configured to inspect the intercepted data flow and identify from the data store a compliance rule associated with the inspected data flow, wherein the compliance rule expresses a pattern over more than one packet and specifies values in payloads of data packets; a matching engine configured to, following identification of the compliance rule associated with the intercepted data flow by the packet inspector: maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of data packets of the intercepted data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the intercepted data flow; identify, using the state information, a pattern over multiple packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to, when the data flow is identified as being associated with a compliance rule, carry out an action with respect to a packet of the data flow corresponding to the compliance rule in dependence upon said pattern being identified over said multiple packets. a data store holding a set of compliance rules and corresponding actions and state information associated with the compliance rules, the logic device characterised in that different ones of the compliance rules stored in the data store are associated with different data flows, a packet inspector configured to inspect the intercepted data flow and identify from the data store a compliance rule associated with the inspected data flow, wherein the compliance rule expresses a pattern over more than one packet and specifies values in payloads of data packets; a matching engine configured to, following identification of the compliance rule associated with the intercepted data flow by the packet inspector: maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of data packets of the intercepted data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the intercepted data flow; identify, using the state information, a pattern over multiple packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to, when the data flow is identified as being associated with a compliance rule, carry out an action with respect to a packet of the data flow corresponding to the compliance rule in dependence upon said pattern being identified over said multiple packets. maintain at the data store state information associated with the identified compliance rule, wherein the state information is derived from the specified values in payloads of data packets of the intercepted data flow; update the state information associated with the identified compliance rule in response to receiving a packet of the intercepted data flow; identify, using the state information, a pattern over multiple packets of the data flow which matches the pattern expressed by the identified compliance rule; and a packet filter configured to, when the data flow is identified as being associated with a compliance rule, carry out an action with respect to a packet of the data flow corresponding to the compliance rule in dependence upon said pattern being identified over said multiple packets.