Apparatus, system, and method for efficiently filtering packets at network devices

A system comprising:

• a memory;
• an identification module, stored in the memory, that identify, at a packet filter within a network device, a source port of a packet within a header of the packet;
• a discard module, stored in the memory, that discards the packet based at least in part on the source port of the packet identified within the header of the packet;
• and
• a determination module, stored in the memory, that determines that the packet is a first fragment in a set of related fragments destined at least intermediately for the network device based at least in part on:
• one or more fragmentation flags within an additional header of the packet;
• and
• a fragmentation offset within the additional header of the packet;
• wherein the identification module further:
• generates, in response to determining that the packet is the first fragment included in the set of related fragments, a packet filter rule that contains criteria used to determine whether any additional packets are included in the set of related fragments;
• activates the packet filter rule within the packet filter;
• and
• monitors the packet filter for at least one additional packet destined at least intermediately for the network device based at least in part on the packet filter rule;
• wherein the determination module further determines that the additional packet is a final fragment included in the set of related fragments based at least in part on:
• a destination address of the additional packet matching a destination address of the packet;
• one or more fragmentation flags within a header of the additional packet;
• a fragmentation offset within the header of the additional packet;
• an Internet protocol identification number of the additional packet matching an Internet protocol identification number of the packet;
• and
• a source Internet protocol address of the additional packet matching a source Internet protocol address of the packet;
• wherein the discard module further discards the additional packet instead of passing the additional packet to a processing unit within the network device due to the additional packet being included in the set of related fragments;
• wherein the identification module further deactivates, in response to determining that each fragment included in the set of related fragments has been received at the packet filter, the packet filter rule within the packet filter by removing the packet filter rule from a list of currently-active rules to avoid wasting computing resources necessary to continue monitoring the packet filter for any further fragments in connection with the set of related fragments;
• and
• at least one hardware processor configured to execute the determination module, the identification module, and the discard module.

An apparatus comprising:

• at least one storage device that stores rules used by a packet filter within a network device to discard certain packets received at the network device;
• and
• at least one physical processing device communicatively coupled to the storage device, wherein the physical processing device:
• identifies, at the packet filter, a source port of a packet within a header of the packet;
• discards the packet based at least in part on the source port of the packet identified within the header of the packet and at least one rule stored within the storage device;
• determines that the packet is a first fragment included in a set of related fragments destined at least intermediately for the network device based at least in part on:
• one or more fragmentation flags within an additional header of the packet;
• and
• a fragmentation offset within the additional header of the packet;
• generates, in response to determining that the packet is the first fragment included in the set of related fragments, a packet filter rule that contains criteria used to determine whether any additional packets are included in the set of related fragments;
• activates the packet filter rule within the packet filter;
• monitors the packet filter for at least one additional packet destined at least intermediately for the network device based at least in part on the packet filter rule;
• while monitoring the packet filter, determines that the additional packet is a final fragment included in the set of related fragments based at least in part on:
• a destination address of the additional packet matching a destination address of the packet;
• one or more fragmentation flags within a header of the additional packet;
• a fragmentation offset within the header of the additional packet;
• an Internet protocol identification number of the additional packet matching an Internet protocol identification number of the packet;
• and
• a source Internet protocol address of the additional packet matching a source Internet protocol address of the packet;
• discards the additional packet instead of passing the additional packet to a processing unit within the network device due to the additional packet being included in the set of related fragments;
• and
• in response to determining that each fragment included in the set of related fragments has been received at the packet filter, deactivates the packet filter rule within the packet filter by removing the packet filter rule from a list of currently-active rules to avoid wasting computing resources necessary to continue monitoring the packet filter for any further fragments in connection with the set of related fragments.