Managing and controlling user applications with network switches

A method for processing data packets in a computer network, comprising:

• configuring a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receiving a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determining if there is a match between the data packet and one or more packet policies that specify a second packet policy to be applied to the matching data packets, the second packet policy having one or more policy action fields;
• and
• if there is a matching packet policy specifying a second packet policy, processing the data packet based on the policy action fields of the second packet policy.

A method for processing data packets in a computer network, comprising:

• configuring a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receiving a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determining if there is a match between the data packet and one or more packet policies, that assign a quality of service (QoS) metric to matching data packets;
• if there is a matching packet policy assigning a QoS metric to the data packet, determining a priority for the data packet based on the assigned QoS metric;
• and
• routing the data packet using a Layer 2-3 switch based on the priority.

A method for processing data packets in a computer network, comprising:

• configuring a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receiving a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model, the data packet being part of a network flow representing access to a specific website;
• determining if there is a match between the data packet and one or more of the packet policies, the matching packet policies authorizing access to the specific website;
• if there is a matching packet policy authorizing access to the specific website, routing the data packet using a Layer 2-3 switch;
• and
• if there is no matching packet policy authorizing access to the specific website, blocking the data packet.

A method for processing data packets in a computer network, comprising:

• configuring a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receiving a data packet at a particular port of the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determining if there is a match between the data packet and one or more of the packet policies, each packet policy blocking matching data packets received at the particular port from utilizing the computer network;
• if there is a matching packet policy blocking the data packet, blocking the data packet;
• and
• if there is no matching packet policy blocking the data packet, processing the data packet.

A method for processing data packets in a computer network, comprising:

• configuring a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receiving a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determining if there is a match between the data packet and one or more of the packet policies, each packet policy specifying that surveillance is to performed on the data packet;
• if there is a matching packet policy specifying surveillance, mirroring the data packet to a specified location;
• and
• processing the data packet using the multilayer switch.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determine if there is a match between the data packet and one or more of the packet policies, each packet policy authorizing matching data packets to use the computer network;
• if there is a matching packet policy authorizing the data packet, route the data packet using a Layer 2-3 switch;
• and
• if there is no matching packet policy authorizing the data packet, block the data packet.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determine if there is a match between the data packet and one or more packet policies that specify a second packet policy to be applied to the matching data packets, the second packet policy having one or more policy action fields;
• and
• if there is a matching packet policy specifying a second packet policy, process the data packet based on the policy action fields of the second packet policy.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determine if there is a match between the data packet and one or more packet policies, that assign a quality of service (QoS) metric to matching data packets;
• if there is a matching packet policy assigning a QoS metric to the data packet, determine a priority for the data packet based on the assigned QoS metric;
• and
• route the data packet using a Layer 2-3 switch based on the priority.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model, the data packet being part of a network flow representing access to a specific website;
• determine if there is a match between the data packet and one or more of the packet policies, the matching packet policies authorizing access to the specific website;
• if there is a matching packet policy authorizing access to the specific website, route the data packet using a Layer 2-3 switch;
• and
• if there is no matching packet policy authorizing access to the specific website, block the data packet.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at a particular port of the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determine if there is a match between the data packet and one or more of the packet policies, each packet policy blocking matching data packets received at the particular port from utilizing the computer network;
• if there is a matching packet policy blocking the data packet, block the data packet;
• and
• if there is no matching packet policy blocking the data packet, process the data packet.

A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause data processing equipment to:

• configure a multilayer switch to process data packets at wire-speed based on one or more user defined packet policies, each user defined packet policy specifying information for one or more of Layers 4 through 7;
• receive a data packet at the multilayer switch, the data packet including information from one or more of Layers 2 through 7 of the OSI model;
• determine if there is a match between the data packet and one or more of the packet policies, each packet policy specifying that surveillance is to performed on the data packet;
• if there is a matching packet policy specifying surveillance, mirror the data packet to a specified location;
• and
• process the data packet using the multilayer switch.