Patent ID: 7577758

Claim:
A packet inspection apparatus comprising: a packet inspection module to compare data words from one or more packets of a plurality of packets with a plurality of packet signatures in parallel to identify a match, wherein each packet signature is composed of a plurality of token and value pairs, wherein each token in the plurality of token and value pairs specifies a portion of the packet to inspect and each value in the plurality of token and value pairs specifies a range of values constituting a partial match for the token, the packet inspection module comprising a plurality of hardware comparison units that each compare at least one respective signature rule, corresponding to at least one of the packet signature values, to a data word and a reduction network that logically ORs a signal output from each of the plurality of comparison units, the reduction network logically ORing the comparison unit output signals in accordance with at least one packet signature plurality of tokens, and outputting an indication if any of the plurality of comparison units achieve a match to its respective at least one signature rule; and at least one network interface module coupled to the packet inspection module, the at least one network interface module having two ports for forwarding full-duplex traffic therebetween, the traffic including the plurality of packets, the at least one network interface module forwarding the plurality of packets to the packet inspection module and blocking one or more of the plurality of packets received at one of the two ports from being forwarded out the other of the two ports in response to the indication from the packet inspection module.