High-speed packet filtering

A non-transitory computer-readable medium storing program instructions that, when executed by one or more processors of a computing system, cause the computing system to perform operations comprising:

• obtaining a packet filter definition that specifies characteristics of packets;
• compiling the packet filter definition to instructions of low-level code;
• generating a hash template based on a subset of the instructions, wherein the hash template includes pairs of byte offsets and byte counts that define locations within the packets at which the characteristics are disposed;
• based on application of the hash template to a plurality of stored packets, creating hash table entries in a hash table, wherein the hash table entries are respectively associated with subsets of the stored packets, wherein the subsets of the stored packets have respectively unique patterns of values within their bytes at the locations defined by the pairs of byte offsets and byte counts;
• updating the hash table entries to refer to metadata relating to their respective subset of the stored packets;
• storing the hash table in association with the metadata;
• receiving a new packet filter definition;
• and
• in response to receiving the new packet filter definition, retrieving, from the hash table, particular metadata referred to by a particular hash table entry that is associated with a particular subset of stored packets, wherein the new packet filter definition matches:
• the locations defined by the pairs of byte offsets and byte counts, and the unique patterns of values of the particular subset of stored packets.