Abstract: A method of and an apparatus for sorting data traffic based on a predetermined priority such as a bandwidth and a liveliness is provided. The method includes operations of: receiving the data flows; sorting the data flows based on bandwidth by defining a plurality of bandwidth ranges and classifying the sorted data flows according to the bandwidth ranges to which the bandwidth of each data flow belongs; and sorting the classified data flows based on liveliness representing frequency of occurrence of the data flows. The sorting of the classified data lows determines that the data flow which is recently received has the higher liveliness and sorts the data flows based on the determination. The method and apparatus facilitates selecting data flows which are possible hostile attack attempts from a vast amount of data traffic and allowing selective and intensive monitoring of the selected data flows.

Abstract: An apparatus and method for performing packet header lookup based on sequential lookup is provided. A header analyzer separates a header from a packet received via a network and outputs a lookup sequence. A unit lookup unit looks up matching the header combination rules with each field to be analyzed and input from the header analyzer based on the lookup sequence input from the header analyzer and outputs a match signal and a match address. A rule combination memory stores identification information for the header combination rules. A sequence combination memory stores lookup sequence information and sequence combination information. A rule combination unit generates match results based on the match signal input from the unit lookup unit and data read from the rule combination memory and the sequence combination memory.

Abstract: A trap matrix searches the entire contents of a data stream for a pattern that matches the pattern for a search term. In those circumstances where there is a match between patterns of the data stream and the search term, the method and system can proceed to an exact match operation. In particular, a pointer matrix and a corresponding active control matrix are generated according to a set of terms in a rule table. Data is sequenced the trap matrix according to the hierarchy of its trap elements. The trap elements perform a pattern match check between the sequenced data stream and any search term in the set of terms in the rule table. Results from a positive pattern match are preferably communicated from the matching trap element to an exact match lookup.

Abstract: A forwarding table periodically receives updates, and when the forwarding table receives a new entry in such an update, a set of entries having a valid prefix of the new entry is spanned by a correcting window. The correcting window has a correcting window size equal to the bit-length of the valid prefix. A set of target entries is identified in the correcting window such that each of the target entries in the set has a hierarchy pointer value less than the correcting window size. The entry includes a routing tag, and the routing tag is added to the routing tag field in the set of target entries. Additionally, the correcting window size is added to the hierarchy pointer field in the same set of target entries. The forwarding table can also replace prefixes that are removed in a similar manner with a replacement entry has a replacement hierarchical pointer value less than the replacement correcting window size.

Abstract: The present invention performs the series of table lookups in a radically different way than conventional systems. Specifically, the present invention performs the first table lookup conventionally to match a table entry with header information (say a first byte of header information), and assigns a first pointer to the matching first table lookup entry. For a byte, the first table lookup has 28 entries (256 entries). Then, departing from conventional systems, the present invention provides additional memory to the first pointer. The second byte of header information is stored in memory, the significant bit information of the second byte is stored in memory, and a logic operator (“=” or “<”) is stored in memory. The second table lookup has only two entries, true or false. The correct entry is matched with the information that has been stored in memory with the first pointer, and a second pointer is established.