# US 11,310,149 B1 · Routing bidirectional flows in a stateless routing service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,149 B1 - Document ID: US11310149B1 - Status: Granted - Kind: B1 - Application number: 17/033,221 - Filed: 2020-09-25 - Granted: 2022-04-19 - Earliest claimed: 2020-09-25 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Bashuman Deb; Dheerendra Talur; Milind Madhukar Kulkarni; Justin Davies - Web page: https://patentgrep.com/patent/US11310149B1 ## CPC - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 12/46: Interconnection of networks - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 45/74: Address processing for routing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided to enable packets of network traffic to be routed to a network appliance. Bidirectional flows of network traffic can be routed to the same network appliance based on flow information of the corresponding packets. A network device may intercept the packet corresponding to a first flow and route the packet to a specific network appliance based on the first flow information. The network device may generate a direction agnostic tuple value based on data groups of the first flow information. The network device may propagate the direction agnostic tuple value across availability zones to a second network device in a different availability zone to store the direction agnostic tuple value for use for subsequent packets. The second network device can receive a second packet and transmit the second packet to the same network appliance based on the direction agnostic tuple value. ## Claims ### Claim 1 A system, comprising: a fleet of network appliances implemented across a first availability zone and a second availability zone, each of the first availability zone and the second availability zone representing an isolated network environment; a first network device within the first availability zone and configured to: receive a first packet from a device within the first availability zone and addressed to a second device within the second availability zone, the first packet including a plurality of symmetrical field values, identify a direction agnostic tuple value for the first packet, the direction agnostic tuple value including a set of field values, from the plurality of symmetrical field values, that are ordered, within the direction agnostic tuple value, without regard to symmetrical position within the plurality of symmetrical field values, select a network appliance, from the fleet of network appliances, to which to route packets associated with the direction agnostic tuple value, memorialize selection of the network appliance within a routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance, propagate the routing rule to a second network device associated with the second availability zone, and route the first packet to the network appliance, wherein the second network device is configured to: receive a second packet from the second device, wherein the second packet is responsive to the first packet and is addressed to the device within the first availability zone, the second packet including a second plurality of symmetrical field values symmetrically mirroring the plurality of symmetrical field values, derive from the second plurality of symmetrical field values the direction agnostic tuple value, identify the routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance, and responsive to identifying the routing rule, route the second packet to the network appliance. ### Claim 2 (depends on 1) The system of claim 1, wherein the fleet of network appliances is distributed across availability zones, wherein the network appliance is within a first availability zone, wherein selecting the network appliance within the first availability zone is based at least in part on receiving the first packet from a device within the first availability zone. ### Claim 3 (depends on 1) The system of claim 1, wherein the direction agnostic tuple value is based at least at part on one or more of: a group of internet protocol addresses of the first packet, a group of ports of the first packet, or a protocol of the first packet. ### Claim 4 (depends on 1) The system of claim 1, wherein the first network device propagates the routing rule to the second network device associated with the second availability zone prior to routing the first packet to the network appliance. ### Claim 5 A computer-implemented method comprising: receiving a first packet from a first device associated with a first party addressed to a second device associated with a second party, the first packet including a plurality of symmetrical field values; identifying a direction agnostic tuple value for the first packet, the direction agnostic tuple value including a set of field values, from the plurality of symmetrical field values, that are ordered, within the direction agnostic tuple value, without regard to symmetrical position within the plurality of symmetrical field values; selecting a network appliance to which to route packets associated with the direction agnostic tuple value; memorializing selection of the network appliance within a routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance; propagating the routing rule to the second device; routing the first packet to the network appliance; receiving a second packet from the second device addressed to the first device, the second packet including a second plurality of symmetrical field values symmetrically mirroring the plurality of symmetrical field values; deriving from the second plurality of symmetrical field values the direction agnostic tuple value; identifying the routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance; and responsive to identifying the routing rule, routing the second packet to the network appliance. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein selecting the network appliance to which to route packets associated with the direction agnostic tuple value comprises selecting a group of network appliances associated with a gateway, wherein the routing rule indicates that packets associated with the direction agnostic tuple value are to be routed to the group of network appliances through the gateway, and wherein routing the first packet to the network appliance comprises routing the first packet to the gateway. ### Claim 7 (depends on 5) The computer-implemented method of claim 5, wherein selecting the network appliance comprises selecting the network appliance from a group of network appliances, wherein the group of network appliances is distributed across availability zones. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the network appliance is within a first availability zone, wherein selecting the network appliance within the first availability zone is based at least in part on the first device corresponding to the first availability zone. ### Claim 9 (depends on 5) The computer-implemented method of claim 5, wherein receiving the first packet from the first device comprises receiving the first packet by a first gateway associated with the first device, wherein receiving the second packet from the second device comprises receiving the second packet by a second gateway associated with the second device. ### Claim 10 (depends on 5) The computer-implemented method of claim 5, wherein the first device is associated with a first availability zone, wherein the second device is associated with a second availability zone. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, further comprising: storing the routing rule in memory of the first device; and storing the routing rule in memory of the second device. ### Claim 12 (depends on 5) The computer-implemented method of claim 5, further comprising: receiving a third packet from the second device addressed to a third device associated with a third party, the first packet including a third plurality of symmetrical field values; identifying a second direction agnostic tuple value for the second packet, the second direction agnostic tuple value including a second set of field values from the third plurality of symmetrical field values that are ordered, within the second direction agnostic tuple value, without regard to symmetrical position within the third plurality of symmetrical field values; determining a second routing rule for the third packet is not stored; selecting a second network appliance to which to route packets associated with the second direction agnostic tuple value; memorializing selection of the second network appliance within a second routing rule indicating that packets associated with the second direction agnostic tuple value are to be routed to the second network appliance; propagating the routing rule to the second device; and routing the third packet to the second network appliance. ### Claim 13 (depends on 5) The computer-implemented method of claim 5, wherein the set of field values include one or more of a set of internet protocol addresses or a set of ports. ### Claim 14 (depends on 5) The computer-implemented method of claim 5, wherein propagating the routing rule to the second device occurs prior to routing the first packet to the network appliance. ### Claim 15 A system, comprising: a data store storing computer executable instructions, and one or more computing devices configured to: receive a first packet, the first packet including a plurality of symmetrical field values; identify a direction agnostic tuple value for the first packet, the direction agnostic tuple value including a set of field values from the plurality of symmetrical field values that are ordered, within the direction agnostic tuple value, without regard to symmetrical position within the plurality of symmetrical field values; select a network appliance to which to route packets associated with the direction agnostic tuple value; memorialize selection of the network appliance within a routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance; route the first packet to the network appliance; receive a second packet, wherein the second packet is responsive to the first packet, the second packet including a second plurality of symmetrical field values symmetrically mirroring the plurality of symmetrical field values; derive, from the second plurality of symmetrical field values, the direction agnostic tuple value; identify the routing rule indicating that packets associated with the direction agnostic tuple value are to be routed to the network appliance; and based at least in part on the routing rule, route the second packet to the network appliance. ### Claim 16 (depends on 15) The system of claim 15, wherein the one or more computing devices are further configured to propagate the routing rule across multiple availability zones. ### Claim 17 (depends on 15) The system of claim 15, wherein selecting the network appliance to which to route packets associated with the direction agnostic tuple value comprises selecting a group of network appliances associated with a gateway, wherein the routing rule indicates that packets associated with the direction agnostic tuple value are to be routed to the group of network appliances through the gateway, and wherein routing the first packet to the network appliance comprises routing the first packet to the gateway. ### Claim 18 (depends on 15) The system of claim 15, wherein the network appliance corresponds to a group of network appliances distributed across availability zones. ### Claim 19 (depends on 15) The system of claim 15, wherein the one or more computing devices are further configured to: receive a third packet, the first packet including a third plurality of symmetrical field values; determine a second routing rule for the third packet is not stored; identify a second direction agnostic tuple value for the third packet, the second direction agnostic tuple value including a second set of field values from the third plurality of symmetrical field values that are ordered, within the second direction agnostic tuple value, without regard to symmetrical position within the third plurality of symmetrical field values; select a second network appliance to which to route packets associated with the second direction agnostic tuple value; memorialize selection of the second network appliance within a second routing rule indicating that packets associated with the second direction agnostic tuple value are to be routed to the second network appliance; and route the third packet to the second network appliance. ### Claim 20 (depends on 15) The system of claim 15, wherein the set of field values include one or more of a set of internet protocol addresses or a set of ports.