# US 12,184,520 B2 · High-speed packet filtering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,520 B2 - Document ID: US12184520B2 - Status: Granted - Kind: B2 - Application number: 18/167,419 - Filed: 2023-02-10 - Published: 2023-08-24 - Granted: 2024-12-31 - Earliest claimed: 2022-02-21 - Assignees: FMAD Engineering (SNG) Pte. Ltd. - Applicants: FMAD Engineering (SNG) Pte. Ltd. - Inventors: Aaron Foo - Web page: https://patentgrep.com/patent/US12184520B2 ## CPC - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - G06F 16/2255: {Hash tables} - H04L 43/026: using flow identification - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example embodiment may involve obtaining a packet filter definition that specifies characteristics of packets; compiling the packet filter definition to instructions of low-level code; generating a hash template based on a subset of the instructions, wherein the hash template includes pairs of byte offsets and byte counts that define locations within the packets at which the characteristics are disposed; based on application of the hash template to a plurality of stored packets, creating hash table entries in a hash table, wherein the hash table entries are respectively associated with subsets of the stored packets, wherein the subsets of the stored packets have respectively unique patterns of values within their bytes at the locations defined by the pairs of byte offsets and byte counts; updating the hash table entries to refer to metadata relating to their respective subset of the stored packets; and storing the hash table and the metadata. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining a packet filter definition that specifies characteristics of packets; compiling the packet filter definition to instructions of low-level code; generating a hash template based on a subset of the instructions, wherein the hash template includes pairs of byte offsets and byte counts that define locations within the packets at which the characteristics are disposed; based on application of the hash template to a plurality of stored packets, creating hash table entries in a hash table, wherein the hash table entries are respectively associated with subsets of the stored packets, wherein the subsets of the stored packets have respectively unique patterns of values within their bytes at the locations defined by the pairs of byte offsets and byte counts; updating the hash table entries to refer to metadata relating to their respective subset of the stored packets; storing the hash table in association with the metadata; receiving a new packet filter definition; and in response to receiving the new packet filter definition, retrieving, from the hash table, particular metadata referred to by a particular hash table entry that is associated with a particular subset of stored packets, wherein the new packet filter definition matches: the locations defined by the pairs of byte offsets and byte counts, and the unique patterns of values of the particular subset of stored packets. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the packet filter definition is a textual representation of one or more values that can be present in packet headers or payloads. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the instructions of low-level code are assembly-language instructions executable by a virtual machine. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the subset of the instructions are load instructions that read from specific byte offsets within packet headers or payloads. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein generating the hash template comprises: parsing the instructions to identify the load instructions; and generating one of the pairs of byte offsets and byte counts from each of the load instructions. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the metadata referred to by the hash table entries include packet counts or byte counts for the associated subsets of stored packets. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the metadata referred to by the hash table entries includes storage addresses or per-packet timestamps for the associated subsets of stored packets. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the storage addresses are multi-dimensional. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: storing at least part of the hash template, in association with the hash table, as a representation of the packet filter definition. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the packet filter definition is stored as a packet filter representation in association with the hash table, the computer-implemented method further comprising: determining, from the packet filter representation, that the new packet filter definition matches the locations defined by the pairs of byte offsets and byte counts; based on the packet filter representation, identifying the hash table; generating, for the hash table entries, skeleton packets having the respectively unique patterns of values within bytes at the locations defined by the packet filter representation; and determining, from the skeleton packets, that the new packet filter definition matches the unique patterns of values of the particular subset of stored packets. ### Claim 11 A non-transitory computer-readable medium storing program instructions that, when executed by one or more processors of a computing system, cause the computing system to perform operations comprising: obtaining a packet filter definition that specifies characteristics of packets; compiling the packet filter definition to instructions of low-level code; generating a hash template based on a subset of the instructions, wherein the hash template includes pairs of byte offsets and byte counts that define locations within the packets at which the characteristics are disposed; based on application of the hash template to a plurality of stored packets, creating hash table entries in a hash table, wherein the hash table entries are respectively associated with subsets of the stored packets, wherein the subsets of the stored packets have respectively unique patterns of values within their bytes at the locations defined by the pairs of byte offsets and byte counts; updating the hash table entries to refer to metadata relating to their respective subset of the stored packets; storing the hash table in association with the metadata; receiving a new packet filter definition; and in response to receiving the new packet filter definition, retrieving, from the hash table, particular metadata referred to by a particular hash table entry that is associated with a particular subset of stored packets, wherein the new packet filter definition matches: the locations defined by the pairs of byte offsets and byte counts, and the unique patterns of values of the particular subset of stored packets. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the packet filter definition is a textual representation of one or more values that can be present in packet headers or payloads. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the instructions of low-level code are assembly-language instructions executable by a virtual machine. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the subset of the instructions are load instructions that read from specific byte offsets within packet headers or payloads. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein generating the hash template comprises: parsing the instructions to identify the load instructions; and generating one of the pairs of byte offsets and byte counts from each of the load instructions. ### Claim 16 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the metadata referred to by the hash table entries include packet counts or byte counts for the associated subsets of stored packets. ### Claim 17 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the metadata referred to by the hash table entries includes storage addresses or per-packet timestamps for the associated subsets of stored packets. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the storage addresses are multi-dimensional. ### Claim 19 (depends on 11) The non-transitory computer-readable medium of claim 11, further comprising: storing at least part of the hash template, in association with the hash table, as a representation of the packet filter definition. ### Claim 20 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the packet filter definition is stored as a packet filter representation in association with the hash table, the operations further comprising: determining, from the packet filter representation, that the new packet filter definition matches the locations defined by the pairs of byte offsets and byte counts; based on the packet filter representation, identifying the hash table; generating, for the hash table entries, skeleton packets having the respectively unique patterns of values within bytes at the locations defined by the packet filter representation; and determining, from the skeleton packets, that the new packet filter definition matches the unique patterns of values of the particular subset of stored packets.