Patent ID: 7293020

Claim:
A method comprising: receiving a packet of data via a network at one or more classification engines; performing a first stage search at the one or more classification engines on the packet of data, wherein the first stage search identifies multiple potential strings of interest having a first portion matching a corresponding portion of one or more predetermined strings; generating a first stage search report indicating multiple potential strings of interest and a location of the multiple potential strings of interest within the packet of data; performing a second stage search via a policy processor on the packet of data, wherein the second stage search compares subsequent portions of the multiple potential strings of interest indicated in the first stage search report to the one or more predetermined strings to determine whether a match exists; and generating a message to a network management device to indicate that at least one of the multiple potential strings of interest is a string of interest if a match exists between the subsequent portions of at least one multiple potential string of interest and the one or more predetermined strings, wherein the first portion of the potential string of interest comprises a two-byte block of data from the received packet of data and the subsequent portions of the potential string of interest comprise at least one byte of data from the received packet of data other than the two-byte block of data.