# US 9,438,538 B2 · Data matching using flow based packet data storage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,538 B2 - Document ID: US9438538B2 - Status: Granted - Kind: B2 - Application number: 14/859,179 - Filed: 2015-09-18 - Published: 2016-01-14 - Granted: 2016-09-06 - Earliest claimed: 2006-08-02 - Assignees: Silver Peak Systems, Inc. - Applicants: Silver Peak Systems, Inc. - Inventors: David Anthony Hughes; John Burns; Zhigang Yin - Web page: https://patentgrep.com/patent/US9438538B2 ## CPC - H04L 49/901: using storage descriptor, e.g. read or write pointers - H04L 43/062: related to network traffic - H04L 47/2483: involving identification of individual flows - H04L 49/90: Buffering arrangements - H04L 49/9047: including multiple buffers, e.g. buffer pools - H04L 49/9057: Arrangements for supporting packet reassembly or resequencing - H04L 49/9094: {Arrangements for simultaneous transmit and receive, e.g. simultaneous reading/writing from/to the storage element} - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for matching data using flow based packet data storage includes a communications interface and a processor. A communications interface receives a packet between a source and a destination. The processor identifies a flow between the source and the destination based on the packet. The processor determines whether some of packet data of the packet indicates a potential match to data in storage using hashes. The processor then stores the data from the most likely data match and second most likely data match without a packet header in a block of memory in the storage based on the flow. ## Claims ### Claim 1 A system for matching data using flow based packet data storage, the system comprising: a communications interface that receives at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information; and a processor that: identifies a flow between the source and the destination based on the flow information in the at least one data packet; determines whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage; retrieves a list of possible data matches; determines match sizes of at least two likely data matches by directly comparing packet bytes and matched data bytes; and stores the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or generates a retrieve instruction for the data match depending on the match sizes. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor moves the storage data between a fast memory and a slow memory. ### Claim 3 (depends on 1) The system of claim 1, wherein the flow comprises a session between the source and the destination. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor allocates the block of the memory for the identified flow. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor transmits the packet data. ### Claim 6 (depends on 1) The system of claim 1, wherein the block of memory allocated for the flow is allocated from a list of partially filled blocks of memory. ### Claim 7 A method for matching data using flow based packet data storage, the method comprising: receiving at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information; identifying a flow between the source and the destination based on the flow information in the at least one data packet; determining whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage; retrieving a list of possible data matches; determining match sizes at least two likely data matches by directly comparing packet bytes and matched data bytes; and storing the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or generating a retrieve instruction for the data match depending on the match sizes. ### Claim 8 (depends on 7) The method of claim 7, further comprising moving the storage data between a fast memory and a slow memory. ### Claim 9 (depends on 7) The method of claim 7, wherein the flow comprises a session between the source and the destination. ### Claim 10 (depends on 7) The method of claim 7, further comprising allocating the block of the memory for the identified flow. ### Claim 11 (depends on 7) The method of claim 7, further comprising transmitting the packet data. ### Claim 12 (depends on 7) The method of claim 7, further comprising allocating the block of memory for the identified flow from a list of partially filled blocks of memory. ### Claim 13 A non-transitory computer-readable medium having embodied thereon a program, the program executable by a processor to perform a method for matching data using flow based packet data storage, the method comprising: receiving at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information; identifying a flow between the source and the destination based on the flow information in the at least one data packet; determining whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage; retrieving a list of possible data matches; determining match sizes of at least two likely data matches by directly comparing packet bytes and matched data bytes; and storing the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or generating a retrieve instruction for the data match depending on the match sizes. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the program is further executable to direct the processor to move the storage data between a fast memory and a slow memory. ### Claim 15 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the flow comprises a session between the source and the destination. ### Claim 16 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the program is further executable to direct the processor to allocate the block of the memory for the identified flow. ### Claim 17 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the program is further executable to direct the processor to transmit the packet data. ### Claim 18 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the block of memory allocated for the flow is allocated from a list of partially filled blocks of memory.