1. A method of monitoring signatures in a network packet payload comprising: monitoring a data stream on the network for a signature of a predetermined length; testing said network signature for membership in one of a plurality of Bloom filters; and testing for a false positive on said membership.