Patent ID: 7401145

Claim:
In a system coupled between a protection network and an external network, for detecting intrusion states between the protection and external networks and preventing the intrusion, an in-line mode network intrusion detecting and preventing system comprising: a first network processor unit for monitoring an externally received PDU (packet data unit), collecting various statistical data according to a metering rule, selectively discarding or passing the received PDU according to a packet preventing rule, and generating a duplicate of the PDU according to a sensing rule; a second network processor unit for performing pattern matching on the payloads using at least one attack signature received from a personal computer; and the personal computer for generating or updating a packet preventing rule for preventing the intrusion detected by the second network processor unit, and providing the packet preventing rule to the first network processor unit; a line interface including: a first gigabit Ethernet port coupled to a gigabit PHY (physical layer) device; and a second gigabit Ethernet port coupled to the gigabit PHY device, wherein the gigabit PHY device is coupled to the first network processor.