A content search system determines whether an input string matches a negative regular expression that includes a negative pattern and an optional positive pattern. If the input string matches the positive pattern and does not match the negative pattern, a match between the input string and the negative regular expression is indicated. The positive pattern and the negative pattern may be compared to the input string in a single pass of the input string. The content search system may be implemented in a content addressable memory (CAM) device. The negative regular expression may specify a particular portion of the input string, such as a range of characters or bytes of a data packet, in which the negative pattern should not match for a match between the negative regular expression and the input pattern to be indicated.