Patent ID: 8584238

Claim:
A method of performing re-assembly free deep packet inspection at a network element of a data stream that includes a file, the method comprising: receiving the data stream, the data stream including a plurality of data packets, wherein each of the plurality of data packets contains a file segment of the file that originated from an external host and destined to a protected host of a local area network (LAN), the file being transmitted in multiple file segments contained in payloads of multiple data packets of the data stream; and performing the re-assembly free deep packet inspection on the data stream by, determining, for each of the plurality of data packets, whether a corresponding data packet is out of order, and if the corresponding data packet is out of order, making and storing a local copy of the corresponding data packet, wherein the local copy is to be used in pattern matching to scan for an attack pattern, and if the corresponding data packet is in-order, performing pattern matching on the payload of the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data pattern.