1. A method of detecting intrusions on a computer, comprising: storing an intrusion signature describing an attack on a computer; receiving a plurality of internet protocol packets, said plurality of internet protocol packets collectively containing an information sequence within a series of states; rearranging said plurality of internet protocol packets so as to place said information sequence in order; and successively examining each state of said series of states so as to correlate said information sequence to said intrusion signature.