Patent ID: 8578489

Claim:
A method of performing re-assembly free deep packet inspection of a data stream corresponding to a client application at a network element, the method comprising: receiving the data stream that corresponds to the client application, the data stream including a plurality of data packets communicated with the client application, each of the plurality of data packets containing a portion of a data pattern in a payload of that data packet; and performing the re-assembly free deep packet inspection on the data stream, wherein each packet is inspected by: determining, whether a corresponding data packet is out of order, and if the corresponding data packet is out of order, checking whether one or more local copies of previously received data packets is next in order, wherein a local copy determined to be next in order is compared to a corresponding portion of an attack pattern, and wherein there is no local copy next in order, and storing a local copy of the corresponding data packet, wherein the local copy is used when determined to be next in order after another one of the plurality of data packets in pattern matching to a corresponding portion of the attack pattern, and if the corresponding data packet is in-order, performing pattern matching on the payload of the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data pattern.