A Short Review on Faster and More Reliable TCP Reassembly for High-Speed Networks in Deep Packet Inspection

For Network Intrusion Detection and Prevention Systems (NIDPS), Deep Packet Inspection (DPI) requires matching the payload against regular expressions and fixed strings to identify attack signatures. Such attack strings can span more than one IP fragment or TCP segment. This issue can lead to false results because strings cannot be identified this way. Therefore, to accurately identify such attack strings we need to reassemble traffic packets before string matching. Although various hardware-based solutions are provided for improvements at the TCP layer that includes reassembly too. The requirements of reassembly architectures which are suited to particular requirements of DPI systems, are reordering of segments or fragments and tracking of streams in bulk numbers. Along with this, it has to deal with ambiguities that might be present in IP fragmentation or TCP segmentation which can be done by traffic normalization or target-based reassembly. Therefore, in this paper, we present a short review of these TCP reassembly efforts. Then, we suggest solutions and approaches implement TCP reassembly for High-Speed Networks.