Patent ID: 7673041

Claim:
A method, comprising: defining a set of S search strings comprising strings to be searched in a packet payload; storing data corresponding to the search strings in set S in at least one Ternary Content Addressable Memory (TCAM); computing hashes on at least one of the search strings in set S and sub-strings of those search strings and storing the hashes in a memory; in response to receiving a packet including a payload, performing a first pre-processing stage employing the hashes stored in the memory to identify any sub-string in the payload that might match a search string in set 5, identification of such a sub-string producing a hit; and performing a second analysis stage in response to the hit, the second analysis stage verifying an existence of an exact match of a search string in set S via use of the at least one TCAM, wherein the second analysis stage includes: identifying a portion in the packet payload in which an exact match might exist; determining a minimum length of a sub-string corresponding to the portion of packet payload to be searched; generating search string hash values by hashing each of a plurality of hash keys comprising sub-strings of a search string having a fixed length L KEY ; and determining the minimum length L SUBSTRING of the sub-string corresponding to the portion of the packet payload to be searched by use of an equation: L SUBSTRING =2 *L LONGEST −L KEY wherein L LONGEST corresponds to the length of the longest search string in set S.