Method and apparatus for analysing data packets

An apparatus for performing an analysis of a data packet in a datastream, the data packet including metadata and useful data, and being part of a network session comprising at least the data packet, the apparatus comprising:

• at least one function block, configured to create a unique signature of the data packet;
• a buffer store including a first memory area and a second memory area, wherein the buffer store is configured to enables a storage of the metadata in the first memory area and a storage of the useful data in a second memory area in such a way that an association between the useful data and the respective metadata is maintained, wherein a transaction number used to carry out the respective storage process is formed subject to the signature of the data packet;
• at least one function module, configured to makes it possible to carry out a search of the useful data for at least one search term, before or after storage of the data packet in the buffer store and configured to mark at least one successful search in the metadata by setting a search-identifier;
• and
• at least one session-reconstruction module, including a portion for reading metadata from the buffer store and a function block that is suitable for checking whether the metadata read is currently being processed;
• a module for setting an identifier in the metadata, stored in the buffer store, in order to indicate that the metadata read is now being processed, for reading all useful data of the network session stored in the buffer store in case a search-identifier is set in at least one data packet of the network session and or reconstructing the useful data in the original order.