1. A computer readable medium storing software instructions which, when executed by a processor, cause the processor to perform a method for analyzing packets, the method comprising: comparing an input string representing a received packet with a pattern defined by a regular expression containing one or more back-references (backref-regex) via a single pass of a non-deterministic finite automation (NFA) corresponding to the backref-regex (backref-NFA) to determine whether the input string matches the pattern, the input string comprising a plurality of characters, wherein the comparing comprising: selecting sequentially characters of the input string until a determination as to whether the input string matches the pattern is made, wherein: for each selected character, the comparing further comprises updating a configurations-set associated with the character, the configuration-set comprising one or more configurations, wherein: the updating is based on the one or more configurations, the character, and the backref-NFA, each configuration is associated with a particular NFA-state of the backref-NFA and adapted to indicate as to whether a particular back-reference of the backref-NFA is being matched; and the updated configurations-set is associated with a next selected character when the input string contains an unselected character.