Hardware support for wire-speed, stateful matching and filtration of network traffic

摘要

A packet inspection apparatus is described. In one embodiment, the packet inspection apparatus comprises a packet inspection module to compare data from one or more packets of multiple packets with one or more signatures to identify a match, and at least one network interface modules coupled to the packet inspection module. The network interface module has two ports for forwarding full-duplex traffic therebetween, where the traffic includes packets. The one or more network interface modules forward the packets to the packet inspection module and blocks one or more packets in response to an indication from the packet inspection module.