Patent ID: 6963913

Claim:
A network data filtering method, comprising: compiling a rule and a procedure into at least one machine readable rule and at least one procedure; loading the compiled at least one rule and the compiled at least one procedure onto a device with at least one network adapter; intercepting network data passing through the at least one network adapter; interpreting the network data with respect to the loaded at least one rule; and executing at least one procedure based on the results of a comparison; wherein the loading step includes: converting the compiled at least one rule into at least one 5-tuple filtering rule; creating a tuple buffer to hold the at least one 5 -tuple filtering rule, the tuple buffer defined to have a beginning; setting a next byte pointer to the beginning of the tuple buffer; constructing a 5-tuple for a filtering rule, copying the 5-tuple to the tuple buffer at a location set by the next byte pointer, and incrementing said next byte pointer; setting a next rule tuple element to point to the next byte pointer; and repeating the constructing step while more filter rule statements exist in a compiled rules file.