Patent ID: 7551567

Claim:
A method of interpreting an application layer message at a network element, the method comprising the computer-implemented steps of: switching a state of the network element between a sampling state and a processing state; while the state of the network element is the sampling state, performing: receiving a group of data packets at the network element, wherein each data packet in the group of data packets comprises a separate packet header group and a separate payload portion; inspecting payload portions of data packets in the data packet group to determine application layer messages that are collectively contained in one or more of the payload portions; for each particular message classification in a set of message classifications, determining a separate message subset of the application layer messages that satisfy all criteria associated with the particular message classification, thereby producing one or more message subsets; and for each particular message subset in the message subsets, determining a separate set of characteristics that are possessed by every packet header group that was contained in a data packet that also contained at least a portion of an application layer message that is in the particular message subset, thereby producing one or more characteristic sets; and while the state of the network element is the processing state, performing: receiving, at the network element, a first data packet that comprises a first packet header group and a first payload portion; determining whether the first packet header group possesses all of the characteristics contained in any of the characteristic sets; if the first packet header group possesses all of the characteristics contained in any characteristic set in the characteristic sets, then inspecting the first payload portion to determine at least a portion of a first application layer message that is contained therein; and if the first packet header group does not possess all of the characteristics contained in at least one of the characteristic sets, then sending the first data packet toward a destination without inspecting the first payload portion.