# US 10,771,375 B2 · Routing network traffic based on destination

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,375 B2
- Document ID: US10771375B2
- Status: Granted
- Kind: B2
- Application number: 15/591,065
- Filed: 2017-05-09
- Published: 2018-11-15
- Granted: 2020-09-08
- Earliest claimed: 2017-05-09
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Himanshu Shah; Murtuza Attarwala; Linus Aranha
- Web page: https://patentgrep.com/patent/US10771375B2

## CPC

- H04L 45/22: {Alternate routing}
- H04L 43/026: using flow identification
- H04L 43/028: by filtering
- H04L 45/74: Address processing for routing
- H04L 45/745: Address table lookup; Address filtering
- H04L 61/4511: using domain name system [DNS]
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 45/125: based on throughput or bandwidth
- H04L 45/302: Route determination based on requested QoS
- H04L 45/306: {Route determination based on the nature of the carried application}
- H04L 45/308: {Route determination based on user's profile, e.g. premium users}
- H04L 45/64: using an overlay routing layer
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method may include identifying an address within a packet of a traffic flow associated with a network device. The method may also include comparing the address within the packet with a stored address, the stored address associated with a route for an alternative traffic path, where the alternative traffic path may be different from a default route of traffic passing through the network device. The method may additionally include, based on the address within the packet matching the stored address, routing the packet along the alternative traffic path instead of the default route of traffic.

## Claims

### Claim 1

A method, comprising:
identifying an address within a packet of a traffic flow associated with a network device;
comparing the address within the packet with a stored address, the stored address associated with a route for an alternative traffic path, the alternative traffic path being different from a default route of traffic passing through the network device;
based on the address within the packet matching the stored address, determining that the traffic flow is to be rerouted along the alternative traffic path instead of the default route of traffic;
receiving a Domain Name Server (DNS) query associated with the traffic flow that is determined to be rerouted along the alternative traffic path;
rewriting the DNS query to be routed through the alternative traffic path and to a DNS server associated with the alternative traffic path;
receiving a DNS response from the DNS server, a resource in the DNS response being based on the DNS query; and
rewriting the DNS response to yield a modified DNS response such that the modified DNS response appears to have been one or more of: routed along the default route of traffic or received from a default DNS server associated with the default route of traffic.

### Claim 2 (depends on 1)

The method of claim 1, further comprising determining the stored address prior to comparing the address within the packet with the stored address, wherein determining the stored address comprises:
monitoring the traffic flow to determine whether the traffic flow is associated with an application whose data is to be routed along the alternative traffic path; and
based on the traffic flow being associated with the application,
storing a destination address of the application as the stored address.

### Claim 3 (depends on 2)

The method of claim 2, wherein the monitoring is performed by a deep packet inspection engine of the network device.

### Claim 4 (depends on 3)

The method of claim 3, further comprising, associating the traffic flow with the application based on the address within the packet matching the stored address.

### Claim 5 (depends on 4)

The method of claim 4, wherein the associating the traffic flow with the application is performed before the deep packet inspection engine of the network device identifies the traffic flow as associated with the application.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving an identifier of an application whose data is to be routed along the alternative traffic path;
receiving a domain name system (DNS) query associated with the application;
identifying an Internet Protocol (IP) address in a DNS response, the DNS response received in response to the DNS query; and
storing the IP address as the stored address.

### Claim 7 (depends on 1)

The method of claim 1, wherein identifying the address within the packet of the traffic flow comprises monitoring a packet associated with establishing a transmission control protocol (TCP) session to detect a destination IP address in a header of the packet.

### Claim 8 (depends on 1)

The method of claim 1, wherein routing the packet along the alternative traffic path comprises routing the packet towards an alternative network address translation (NAT) exit point.

### Claim 9 (depends on 1)

The method of claim 1, wherein the stored address includes an IP address and an associated port.

### Claim 10 (depends on 1)

The method of claim 1, further comprising transmitting the stored address to a control device.

### Claim 11

A non-transitory computer-readable medium that includes computer-readable instructions stored thereon that when executed by a processor, cause the processor to:
identify an address within a packet of a traffic flow associated with a network device;
compare the address within the packet with a stored address, the stored address associated with a route for an alternative traffic path, the alternative traffic path being different from a default route of traffic passing through the network device;
based on the address within the packet matching the stored address, determining that the traffic flow is to be rerouted along the alternative traffic path instead of the default route of traffic;
receive a Domain Name Server (DNS) query associated with the traffic flow that is determined to be rerouted along the alternative traffic path;
rewrite the DNS query to be routed through the alternative traffic path and to a DNS server associated with the alternative traffic path;
receive a DNS response from the DNS server, a resource in the DNS response being based on the DNS query; and
rewrite the DNS response to yield a modified DNS response such that the modified DNS response appears to have been one or more of: routed along the default route of traffic or received from a default DNS server associated with the default route of traffic.

### Claim 12 (depends on 11)

The computer-readable medium of claim 11, further comprising instructions, that when executed by the processor, cause the processor to
determine the stored address prior to comparing the address within the packet with the stored address based on instructions that when executed by the processor, cause the processor to:
monitor the traffic flow to determine whether the traffic flow is associated with an application whose data is to be routed along the alternative traffic path; and
based on the traffic flow being associated with the application,
store a destination address of the application as the stored address.

### Claim 13 (depends on 12)

The computer-readable medium of claim 12, further comprising instructions, that when executed by the processor, cause the processor to associate the traffic flow with the application based on the address within the packet matching the stored address before a deep packet inspection engine of the network device identifies the traffic flow as associated with the application.

### Claim 14 (depends on 11)

The computer-readable medium of claim 11, further comprising instructions, that when executed by the processor, cause the processor to:
receive an identifier of an application whose data is to be routed along the alternative traffic path;
receive a domain name system (DNS) query associated with the application;
identify an internet protocol (IP) address in a DNS response, the DNS response received in response to the DNS query; and
store the IP address as the stored address.

### Claim 15 (depends on 11)

The computer-readable medium of claim 11, further comprising instructions, that when executed by the processor, cause the processor to: identify the address within the packet of the traffic flow comprises an operation to monitor a packet associated with establishing a transmission control protocol (TCP) session.

### Claim 16 (depends on 11)

The computer-readable medium of claim 11, further comprising instructions, that when executed by the processor, cause the processor to: route the packet along the alternative traffic path comprises an operation to route the packet towards an alternative network address translation (NAT) exit point.

### Claim 17 (depends on 11)

The computer-readable medium of claim 11, wherein the stored address includes an IP address and an associated port.

### Claim 18 (depends on 11)

The computer-readable medium of claim 11, further comprising instructions, that when executed by the processor, cause the processor to:
transmit the stored address to a control device.

### Claim 19

A system, comprising:
one or more processors; and
one or more non-transitory computer-readable media storing an address, and that include computer-readable instructions stored thereon that when executed by the one or more processors, cause the one or more processors to:
identify an address within a packet of a traffic flow associated with a network device;
compare the address within the packet with a stored address, the stored address associated with a route for an alternative traffic path, the alternative traffic path being different from a default route of traffic passing through the network device;
based on the address within the packet matching the stored address, determining that the traffic flow is to be rerouted along the alternative traffic path instead of the default route of traffic;
receive a Domain Name Server (DNS) query associated with the traffic flow that is determined to be rerouted along the alternative traffic path;
rewrite the DNS query to be routed through the alternative traffic path and to a DNS server associated with the alternative traffic path;
receive a DNS response from the DNS server, a resource in the DNS response being based on the DNS query; and
rewrite the DNS response to yield a modified DNS response such that the modified DNS response appears to have been one or more of: routed along the default route of traffic or received from a default DNS server associated with the default route of traffic.

### Claim 20 (depends on 19)

The system of claim 19, further comprising instructions, that when executed by the one or more processors, cause the one or more processors to:
determine the stored address prior to comparing the address within the packet with the stored address based on instructions that when executed by the one or more processors, cause the processor one or more processors to:
monitor the traffic flow to determine whether the traffic flow is associated with an application whose data is to be routed along the alternative traffic path; and
based on the traffic flow being associated with the application,
store a destination address of the application as the stored address.