Abstract: A network intrusion detection system for detection of an intrusion through the analysis of data units on a network connection is described herein. The network intrusion detection system provides enhanced memory performance through an interrupt handling routine that minimises calls to the operating system, and mitigates the performance overhead of copying data units from one memory location to another. Data units received from an external network are placed into a ring buffer for in place analysis to reduce data transfer overhead.