# US 12,003,551 B1 · Lawfully intercepting traffic for analysis independent of a protocol associated with the traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,551 B1
- Document ID: US12003551B1
- Status: Granted
- Kind: B1
- Application number: 16/588,007
- Filed: 2019-09-30
- Granted: 2024-06-04
- Earliest claimed: 2019-09-30
- Assignees: Juniper Networks, Inc.
- Applicants: Juniper Networks, Inc.
- Inventors: Sheeja J S; Manoj Kumar V
- Web page: https://patentgrep.com/patent/US12003551B1

## CPC

- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04L 43/028: by filtering
- H04L 63/0263: {Rule management}
- H04L 63/164: {at the network layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/22: Parsing or analysis of headers
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A network device may receive a request to install a rule set, and may add, based on the request, information identifying the rule set to a list of rule sets associated with the network device. The network device may receive a packet destined for an endpoint device, may generate a copy of the packet, and may cause the packet to be forwarded to the endpoint device. The network device may perform deep packet inspection of the copy of the packet to identify a packet rule set associated with the copy of the packet, and may determine whether the packet rule set, associated with the copy of the packet, corresponds to the rule set. The network device may cause the copy of the packet to be forwarded to a content destination device when the packet rule set, associated with the copy of the packet, corresponds to the rule set.

## Claims

### Claim 1

A method, comprising:
receiving, by a network device, a first request to install a first rule set and a second request to install a second rule set,
wherein the first rule set and the second rule set enable the network device to capture traffic independent of protocols associated with captured traffic;
adding, by the network device and based on the first request or the second request, information identifying the first rule set and the second rule set to a list of rule sets associated with the network device;
receiving, by the network device, a packet destined for an endpoint device;
generating, by a packet forwarding component of the network device, a copy of the packet;
causing, by the packet forwarding component of the network device, the packet to be forwarded to the endpoint device;
performing, by the packet forwarding component of the network device, deep packet inspection of the copy of the packet to identify a packet rule set associated with the copy of the packet;
determining, by the packet forwarding component of the network device, whether the packet rule set, associated with the copy of the packet, corresponds to the first rule set,
wherein the packet rule set includes at least a rule identifying a bit offset of a field associated with the packet, and
wherein determining whether the packet rule set corresponds to the first rule set comprises:
determining whether one or more rules in the packet rule set and the rule set are equivalent;
causing, by a packet tapping component of the network device, the copy of the packet to be forwarded to a first content destination device when the packet rule set, associated with the copy of the packet, corresponds to the first rule set;
determining, by the network device, whether the packet rule set, associated with the copy of the packet, corresponds to the second rule set; and
causing, by the packet tapping component of the network device, the copy of the packet to be forwarded to a second content destination device when the packet rule set, associated with the copy of the packet, corresponds to the second rule set,
wherein the second content destination device is different than the first content destination device.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
preventing the copy of the packet from being forwarded to the first content destination device when the packet rule set, associated with the copy of the packet, fails to correspond to the first rule set.

### Claim 3 (depends on 1)

The method of claim 1, wherein receiving the first request to install the first rule set comprises:
receiving the first request to install the first rule set from a mediation device,
wherein the first rule set is input via a graphical user interface or a script associated with the mediation device.

### Claim 4 (depends on 1)

The method of claim 1, wherein causing the copy of the packet to be forwarded to the first content destination device includes:
causing the copy of the packet to be forwarded to the first content destination device via Internet Protocol (IP)-User Datagram Protocol (UDP) encapsulation.

### Claim 5 (depends on 1)

The method of claim 1, wherein the copy of the packet includes one or more of:
signaling information,
network management information, or
content of communications.

### Claim 6 (depends on 1)

The method of claim 1, wherein causing the copy of the packet to be forwarded to the first content destination device includes:
causing the copy of the packet to be forwarded to another network device connected to the first content destination device via an Internet protocol (IP) security tunnel.

### Claim 7 (depends on 1)

The method of claim 1, wherein receiving the first request to install the first rule set comprises:
receiving the first request to install the first rule set via a dynamic tasking control protocol (DTCP).

### Claim 8

A network device, comprising:
one or more memories; and
one or more processors to:
receive a first request to install a first rule set and a second request to install a second rule set,
wherein the first rule set and the second rule set enable the network device to capture traffic independent of protocols associated with captured traffic;
add, based on the first request or the second request, information identifying the first rule set and the second rule set to a list of rule sets associated with the network device;
receive a packet destined for an endpoint device;
generate, by a packet forwarding component of the network device, a copy of the packet;
cause, by the packet forwarding component, the packet to be forwarded to the endpoint device;
perform, by the packet forwarding component, deep packet inspection of the copy of the packet to identify a packet rule set associated with the copy of the packet;
determine, by the packet forwarding component, whether the packet rule set, associated with the copy of the packet, corresponds to the first rule set,
wherein the packet rule set includes at least a rule identifying a bit offset of a field associated with the packet, and
wherein the one or more processors, to determine whether the packet rule set corresponds to the rule set, are to:
determine whether one or more rules in the packet rule set and the first rule set are equivalent;
cause, by a packet tapping component, the copy of the packet to be forwarded to a first content destination device when the packet rule set, associated with the copy of the packet, corresponds to the first rule set; and
prevent the copy of the packet from being forwarded to the first content destination device when the packet rule set, associated with the copy of the packet, fails to correspond to the first rule set;
determine, whether the packet rule set, associated with the copy of the packet, corresponds to the second rule set; and
cause, by the packet tapping component, the copy of the packet to be forwarded to a second content destination device when the packet rule set, associated with the copy of the packet, corresponds to the second rule set,
wherein the second content destination device is different than the first content destination device.

### Claim 9 (depends on 8)

The network device of claim 8, wherein the first request prevents identification of a mediation device associated with generation of the first request.

### Claim 10 (depends on 8)

The network device of claim 8, wherein the first rule set includes one or more of:
a rule identifying a field bit offset associated with a received packet,
a rule identifying a length of a field associated with the received packet,
a rule identifying a value of the field associated with the received packet,
a rule identifying an operator of the field associated with the received packet, or
a rule identifying an inter-rule set operator of the field associated with the received packet.

### Claim 11 (depends on 8)

The network device of claim 8, wherein causing the copy of the packet to be forwarded to the first content destination device causes the first content destination device to analyze the copy of the packet.

### Claim 12 (depends on 8)

The network device of claim 8, wherein the first rule set is associated with capturing packets received via one or more of:
a multiprotocol label switching (MPLS) tunnel,
an Internet protocol (IP)-in-IP tunnel,
an MPLS over generic routing encapsulation (GRE) tunnel,
a Dual-Stack Lite (DS-Lite) tunnel,
an MPLS over user datagram protocol (UDP) tunnel,
a Layer 3 virtual private network (L3VPN) tunnel, or
a Layer 2 virtual private network (L2VPN) tunnel.

### Claim 13 (depends on 8)

The network device of claim 8, the copy of the packet includes one or more of:
signaling information,
network management information, or
content of communications.

### Claim 14 (depends on 8)

The network device of claim 8, wherein the first rule set is associated with capturing packets received via a first type of tunneled traffic and a second type of tunnel.

### Claim 15

A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a network device, cause the one or more processors to:
receive a first request to install a first rule set and a second request to install a second rule set,
wherein the first rule set and the second rule set enable the network device to capture traffic independent of protocols associated with captured traffic;
add, based on the first request and the second request, information identifying the first rule set and the second rule set to a list of rule sets associated with the network device;
receive a packet destined for an endpoint device;
generate, by a packet forwarding component of the network device, a copy of the packet;
cause, by the packet forwarding component, the packet to be forwarded to the endpoint device;
perform, by the packet forwarding component, deep packet inspection of the copy of the packet to identify a packet rule set associated with the copy of the packet;
determine, by the packet forwarding component, whether the packet rule set, associated with the copy of the packet, corresponds to the first rule set,
wherein the packet rule set includes at least a rule identifying a bit offset of a field associated with the packet, and
wherein the one or more instructions, that cause the one or more processors to determine whether the packet rule set corresponds to the first rule set, cause the one or more processors to:
determine whether one or more rules in the packet rule set and the first rule set are equivalent; and
selectively perform a first action or a second action based on whether the packet rule set, associated with the copy of the packet, corresponds to the first rule set,
wherein the first action includes causing, by a packet tapping component, the copy of the packet to be forwarded to a first content destination device when the packet rule set, associated with the copy of the packet, corresponds to the first rule set, and
wherein the second action includes preventing the copy of the packet from being forwarded to the first content destination device when the packet rule set, associated with the copy of the packet, fails to correspond to the first rule set;
determine, whether the packet rule set, associated with the copy of the packet, corresponds to the second rule set; and
cause, by the packet tapping component, the copy of the packet to be forwarded to a second content destination device when the packet rule set, associated with the copy of the packet, corresponds to the second rule set,
wherein the second content destination device is different than the first content destination device.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to receive the second request to install the second rule set, cause the one or more processors to:
receive the second request to install the second rule set from a mediation device,
wherein the first rule set is input via a graphical user interface or a script associated with the mediation device.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to cause the copy of the packet to be forwarded to the first content destination device, cause the one or more processors to one or more of:
cause the copy of the packet to be forwarded to the first content destination device via Internet Protocol (IP)-User Datagram Protocol (UDP) encapsulation; or
cause the copy of the packet to be forwarded to another network device connected to the first content destination device via an Internet protocol (IP) security tunnel.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the first rule set includes one or more of:
a rule identifying a field bit offset associated with a received packet,
a rule identifying a length of a field associated with the received packet,
a rule identifying a value of the field associated with the received packet,
a rule identifying an operator of the field associated with the received packet, or
a rule identifying an inter-rule set operator of the field associated with the received packet.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the first rule set is associated with capturing packets received via one or more of:
a multiprotocol label switching (MPLS) tunnel,
an Internet protocol (IP)-in-IP tunnel,
an MPLS over generic routing encapsulation (GRE) tunnel,
a Dual-Stack Lite (DS-Lite) tunnel,
an MPLS over user datagram protocol (UDP) tunnel,
a Layer 3 virtual private network (L3VPN) tunnel, or
a Layer 2 virtual private network (L2VPN) tunnel.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the first rule set is associated with capturing packets received via a first type of tunneled traffic and a second type of tunnel.