# US 10,484,516 B2 · Filtering apparatus, method, and recording medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,516 B2 - Document ID: US10484516B2 - Status: Granted - Kind: B2 - Application number: 15/537,289 - Filed: 2015-12-14 - Published: 2017-12-07 - Granted: 2019-11-19 - Earliest claimed: 2014-12-19 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Masaaki Teshigawara - Web page: https://patentgrep.com/patent/US10484516B2 ## CPC - H04L 69/22: Parsing or analysis of headers - H04L 45/74: Address processing for routing - H04L 69/166: IP fragmentation; TCP segmentation - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention enables packet data to be filtered without distinguishing between non-fragmented packets and fragmented packets. This invention is characterized in that: when received packet data is a fragmented packet but is not a lead fragmented packet, header information of the lead fragmented packet, which has the same fragmented packet identification information as that of the packet data, is given to the packet data as a pseudo-header; the header information of the packet data is used as a key and a filter table is searched in which a filter condition about the header information corresponds to a process implemented when the filter condition is satisfied; the process corresponding to the filter condition satisfied by the header information of the packet data is determined as a process performed for the packet data; and the determined process is performed on the packet data. ## Claims ### Claim 1 A filtering apparatus comprising: an information processing device having an input that receives packet data; the information processing device configured to implement a pseudo header attaching function of attaching header information of a leading fragment packet having same fragment packet identification information as the packet data to the packet data as a pseudo header when the received packet data is a fragment packet, and the received packet data is not a leading fragment packet; the information processing device including a filter having a first input connected to receive package data input including the header information and a second input connected to a filter table, the filter configured to search the filter table, in which a filter criterion relating to the header information and a process to be performed when the filter criterion is satisfied are associated with each other by using the header information of the packet data as a key, and configured to determine the process associated with the filter criterion to be satisfied by the header information of the packet data, as a process to be performed with respect to the packet data; and the information processing device including a processor having a first input connected to the output of the filter to receive the packet data from the filter, the processor configured to delete the attached pseudo header from the packet data received in the packet data from the filter, and configured to perform the determined process with respect to the packet data. ### Claim 2 (depends on 1) The filtering apparatus according to claim 1, wherein the filter further stores the header information, and the process associated with the filter criterion in a flow table when the header information of the packet data satisfies the filter criterion, searches the flow table by using the header information of the packet data as a key before the filter table is searched, determines the process associated with the header information as a process to be performed with respect to the packet data when the header information of the packet data exists in the flow table, and searches the filter table when the header information of the packet data does not exist in the flow table. ### Claim 3 (depends on 1) The filtering apparatus according to claim 1, wherein the pseudo header attaching function stores the header information of the packet data as the pseudo header to be attached to another fragment packet having same fragment packet identification information when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 4 (depends on 1) The filtering apparatus according to claim 1, wherein the pseudo header attaching function stores the header information of the packet data, and attaches the stored header information to another fragment packet having same fragment packet identification information as the pseudo header when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 5 (depends on 3) The filtering apparatus according to claim 3, wherein the pseudo header attaching function stores the packet data until the header information is stored when the packet data is a fragment packet, and is not a leading fragment packet, and when the header information relating to fragment packet identification information of the packet data is not stored, and attaches the header information to the stored packet data as the pseudo header when the header information is stored. ### Claim 6 (depends on 5) The filtering apparatus according to claim 5, wherein when a predetermined time period elapses after it is confirmed that the header information of the packet data is a final fragment packet, or when a predetermined time period elapses after the packet data having the certain fragment packet identification information is received most recently, the pseudo header attaching function allows to use a storage area for the header information relating to the fragment packet identification information of the packet data, and for the packet data as a storage area relating to another fragment packet identification information. ### Claim 7 A filtering method comprising: receiving packet data; attaching header information of a leading fragment packet having same fragment packet identification information as the packet data to the packet data as a pseudo header when the packet data is a fragment packet, and is not a leading fragment packet; searching a filter table in which a filter criterion relating to the header information, and a process to be performed when the filter criterion is satisfied are associated with each other by using the header information of the packet data as a key, and determining the process associated with the filter criterion to be satisfied by the header information of the packet data as a process to be performed with respect to the packet data; and deleting the attached pseudo header from the packet data, and performing the determined process with respect to the packet data. ### Claim 8 (depends on 7) The filtering method according to claim 7, wherein the filtering method further comprises storing the header information, and the process associated with the filter criterion in a flow table when the header information of the packet data satisfies the filter criterion; searching the flow table by using the header information of the packet data as a key before the filter table is searched; determining the process associated with the header information as a process to be performed with respect to the packet data when the header information of the packet data exists in the flow table; and searching the filter table when the header information of the packet data does not exist in the flow table. ### Claim 9 A non-transitory computer readable recording medium recorded with a filtering program which causes a computer to implement: a receiving function of receiving packet data; a pseudo header attaching function of attaching header information of a leading fragment packet having same fragment packet identification information as the packet data to the packet data as a pseudo header when the packet data is a fragment packet, and is not a leading fragment packet; a filtering function of searching a filter table in which a filter criterion relating to the header information, and a process to be performed when the filter criterion is satisfied are associated with each other by using the header information of the packet data as a key, and determining the process associated with the filter criterion to be satisfied by the header information of the packet data as a process to be performed with respect to the packet data; and a processing function of deleting the pseudo header attached by the pseudo header attaching function from the packet data, and performing the process determined by the filtering function with respect to the packet data. ### Claim 10 (depends on 9) The non-transitory computer readable recording medium recorded with the filtering program according to claim 9, wherein the filtering function further stores the header information, and the process associated with the filter criterion in a flow table when the header information of the packet data satisfies the filter criterion, searches the flow table by using the header information of the packet data as a key before the filter table is searched, determines the process associated with the header information as a process to be performed with respect to the packet data when the header information of the packet data exists in the flow table, and searches the filter table when the header information of the packet data does not exist in the flow table. ### Claim 11 (depends on 7) The filtering method according to claim 7, wherein the filtering method comprises storing the header information of the packet data as the pseudo header to be attached to another fragment packet having same fragment packet identification information when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 12 (depends on 7) The filtering method according to claim 7, wherein the filtering method comprises storing the header information of the packet data, and attaching the stored header information to another fragment packet having same fragment packet identification information as the pseudo header when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 13 (depends on 11) The filtering method according to claim 11, wherein the filtering method comprises storing the packet data until the header information is stored when the packet data is a fragment packet, and is not a leading fragment packet, and when the header information relating to fragment packet identification information of the packet data is not stored, and attaching the header information to the stored packet data as the pseudo header when the header information is stored. ### Claim 14 (depends on 13) The filtering method according to claim 13, wherein the filtering method comprises allowing to use a storage area for the header information relating to the fragment packet identification information of the packet data, and for the packet data as a storage area relating to another fragment packet identification information, when a predetermined time period elapses after it is confirmed that the header information of the packet data is a final fragment packet, or when a predetermined time period elapses after the packet data having the certain fragment packet identification information is received most recently. ### Claim 15 (depends on 9) The non-transitory computer readable recording medium recorded with the filtering program according to claim 9, wherein the pseudo header attaching function stores the header information of the packet data as the pseudo header to be attached to another fragment packet having same fragment packet identification information when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 16 (depends on 9) The non-transitory computer readable recording medium recorded with the filtering program according to claim 9, wherein the pseudo header attaching function stores the header information of the packet data, and the stored header information is attached to another fragment packet having same fragment packet identification information as the pseudo header when the packet data is a fragment packet, and is a leading fragment packet. ### Claim 17 (depends on 15) The non-transitory computer readable recording medium recorded with the filtering program according to claim 15, wherein the pseudo header attaching function stores the packet data until the header information is stored when the packet data is a fragment packet, and is not a leading fragment packet, and when the header information relating to fragment packet identification information of the packet data is not stored, and attaches the header information to the stored packet data as the pseudo header when the header information is stored. ### Claim 18 (depends on 17) The non-transitory computer readable recording medium recorded with the filtering program according to claim 17, wherein when a predetermined time period elapses after it is confirmed that the header information of the packet data is a final fragment packet, or when a predetermined time period elapses after the packet data having the certain fragment packet identification information is received most recently, the pseudo header attaching function allows to use a storage area for the header information relating to the fragment packet identification information of the packet data, and for the packet data as a storage area relating to another fragment packet identification information. ### Claim 19 (depends on 1) The filtering apparatus according to claim 1, wherein the filter is configured to search the filter table and determine the process associated with the filter criterion without distinguishing non-fragment packets from fragment packets. ### Claim 20 (depends on 7) The method of claim 7, wherein, in step of said searching the filter table and determining the process associated with the filter criterion are done without distinguishing non-fragment packets from fragment packets.