Reason is that I have a timeout up to when the searched string should be found otherwise it's an error. Reaction time should be as short as possible so I have to scan as often as I receive sth. therefore doing the search less often will not work (see the short example I posted I do the search only as often as absolutely necessary but not more) and searching after the text has been grown by a certain amount of characters is also not practicable because it can happen that I receive a short package containing the expression but the necessary receive size has not been reached yet. So another timeout would be necessary for such cases what enlarges the reaction time more than necessary.

In most cases the search string I'm looking for is only contained once and most of the time the scanned text even doesn't contain a prefix of it but it's possible that it takes two TCP packages to receive the text (e.g. I'm looking for "ABC" and receive "XXA" in the first and "BCYYY" in the second package) and it's necessary that I don't miss any pattern so the only optimization possibility I see is cutting the "head" away. Given benchmark shows me that this works! That is because the whole text can become quite large and can be received within several packages, isn't it`?