# US 2011/0211443 A1 · Network switch with by-pass tap > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2011/0211443 A1 - Document ID: US20110211443A1 - Status: Published application - Kind: A1 - Application number: 12/714,203 - Filed: 2010-02-26 - Published: 2011-09-01 - Earliest claimed: 2010-02-26 - Assignees: Gigamon Inc. - Inventors: Patrick Pak Tak Leong; Thomas Kwok Yin Cheung - Web page: https://patentgrep.com/patent/US20110211443A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 49/10: characterised by the switching fabric construction - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 45/24: Multipath - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network switch apparatus includes a first network port, a second network port, a first inline port, a second inline port, wherein the first and second inline ports are for communication with a pass-through device, a packet switch, and a by-pass device configured to operate in a first mode of operation, wherein in the first mode of operation, the by-pass device is configured to pass a first packet received at the first network port to the packet switch. The by-pass device is configured to switch from the first mode of operation to a second mode of operation upon an occurrence of a condition, and wherein in the second mode of operation, the by-pass device is configured to transmit a second packet received at the first network port to the second network port without passing the second packet to the packet switch. ## Claims ### Claim 1 A network switch apparatus, comprising: a first network port; a second network port; a first inline port; a second inline port, wherein the first and second inline ports are for communication with a pass-through device; a packet switch; and a by-pass device configured to operate in a first mode of operation, wherein in the first mode of operation, the by-pass device is configured to pass a first packet received at the first network port to the packet switch; wherein the by-pass device is configured to switch from the first mode of operation to a second mode of operation upon an occurrence of a condition, and wherein in the second mode of operation, the by-pass device is configured to transmit a second packet received at the first network port to the second network port without passing the second packet to the packet switch. ### Claim 2 (depends on 1) The network switch apparatus of claim 1, further comprising a logic device for detecting the condition that triggers the second mode of operation. ### Claim 3 (depends on 2) The network switch apparatus of claim 2, wherein the condition that triggers the second mode of operation comprises a failure of the packet switch. ### Claim 4 (depends on 2) The network switch apparatus of claim 2, wherein the logic device comprises a register, wherein a CPU periodically writes to the register, and the logic device is configured to close mechanical relay to connect the first and second network ports when the logic device determines that nothing is written to the register for a prescribed period. ### Claim 5 (depends on 1) The network switch apparatus of claim 1, wherein the packet switch has a first mode of operation in which the packet switch passes the first packet to the first inline port, and a second mode of operation in which the packet switch does not pass the first packet to the first inline port. ### Claim 6 (depends on 5) The network switch apparatus of claim 5, wherein packet switch is configured to switch from its first mode of operation to its second mode of operation upon a detection of a failure of the pass-through device. ### Claim 7 (depends on 6) The network switch apparatus of claim 6, further comprising a logic device for detecting the failure of the pass-through device. ### Claim 8 (depends on 7) The network switch apparatus of claim 7, wherein the logic device is configured to detect the failure of the pass-through device by analyzing packet history. ### Claim 9 (depends on 7) The network switch apparatus of claim 7, wherein the logic device is configured to detect the failure of the pass-through device by analyzing port statistics. ### Claim 10 (depends on 1) The network switch apparatus of claim 1, wherein the by-pass device comprises a mechanical relay system. ### Claim 11 (depends on 10) The network switch apparatus of claim 10, wherein the mechanical relay system has a relay component that electrically connects the first and the second network ports to form a communication path, and disconnects the packet switch from the communication path when the by-pass device is in its second mode of operation. ### Claim 12 (depends on 11) The network switch apparatus of claim 11, wherein the relay component is configured to directly electrically connect the first and the second network ports when there is no power applied to the by-pass device. ### Claim 13 (depends on 1) The network switch apparatus of claim 1, wherein the by-pass device is optical based. ### Claim 14 (depends on 1) The network switch apparatus of claim 1, further comprising a filter for filtering additional packets received from the first network port such that a first subset of the additional packets is passed to the first inline port, while a second subset of the additional packets is passed to the second network port. ### Claim 15 (depends on 1) The network switch apparatus of claim 1, further comprising additional inline ports for coupling to one or more additional pass-through devices, and a filter configured to pass additional packets received from the first network port to the pass-through device and the one or more additional pass-through devices such that all of the pass-through devices collectively can handle at least 10G communication without a need to randomly drop packets. ### Claim 16 (depends on 1) The network switch apparatus of claim 1, wherein the pass-through device comprises an intrusion prevention system. ### Claim 17 (depends on 1) The network switch of claim 1, wherein the network switch is configured to add a label to the first packet before passing the first packet to the first inline port, and remove the label from the first packet before transmitting the first packet to the second network port. ### Claim 18 (depends on 1) The network switch apparatus of claim 1, further comprising a housing for containing the by-pass device and the packet switch. ### Claim 19 (depends on 1) The network switch apparatus of claim 1, further comprising an instrument port for connection to a non-pass through device. ### Claim 20 (depends on 19) The network switch apparatus of claim 19, wherein the non-pass through device comprises a sniffer, an IDS, or a forensic recorder, and the pass through device comprises an IPS, and wherein the network switch apparatus further comprises a logic device for comparing performance of the non-pass through device and performance of the pass through device. ### Claim 21 A network switch apparatus, comprising: a first network port; a second network port; a first inline port; a second inline port, wherein the first and second inline ports are for communication with a pass-through device; a packet switch; and a by-pass device; wherein in a first mode of operation, the packet switch and the first and second inline ports are involved in packet transmission between the first and the second network ports; wherein in a second mode of operation, the first and second inline ports are not involved in the packet transmission between the first and the second network ports; and wherein in a third mode of operation, the packet switch and the first and second inline ports are not involved in the packet transmission between the first and the second network ports. ### Claim 22 (depends on 21) The network switch apparatus of claim 21, wherein the first mode of operation is switched to the second mode of operation when a failure of the pass-through device has occurred. ### Claim 23 (depends on 22) The network switch apparatus of claim 22, further comprising a logic device for detecting the failure of the pass-through device. ### Claim 24 (depends on 23) The network switch apparatus of claim 23, wherein the logic device is configured to detect the failure of the pass-through device by analyzing packet history. ### Claim 25 (depends on 23) The network switch apparatus of claim 23, wherein the logic device is configured to detect the failure of the pass-through device by analyzing port statistics. ### Claim 26 (depends on 21) The network switch apparatus of claim 21, wherein the first mode of operation is switched to the third mode of operation when a failure of the network switch has occurred. ### Claim 27 (depends on 26) The network switch apparatus of claim 26, further comprising a logic device for detecting the failure of the network switch or a CPU that is coupled to the logic device. ### Claim 28 (depends on 27) The network switch apparatus of claim 27, wherein the logic device comprises a register, wherein a CPU periodically writes to the register, and the logic device is configured to close mechanical relay to connect the first and second network ports when the logic device determines that nothing is written to the register for a prescribed period. ### Claim 29 (depends on 21) The network switch apparatus of claim 21, wherein the by-pass device comprises a mechanical relay system. ### Claim 30 (depends on 29) The network switch apparatus of claim 29, wherein the mechanical relay system has a relay component that electrically connects the first and the second network ports to form a communication path, and disconnects the packet switch from the communication path in the third mode of operation. ### Claim 31 (depends on 30) The network switch apparatus of claim 30, wherein the relay component is configured to directly electrically connect the first and the second network ports when there is no power applied to the by-pass device. ### Claim 32 (depends on 21) The network switch apparatus of claim 21, wherein the by-pass device is optical based. ### Claim 33 (depends on 21) The network switch apparatus of claim 21, further comprising a filter for filtering additional packets received from the first network port such that a first subset of the additional packets is passed to the first inline port, while a second subset of the additional packets is passed to the second network port. ### Claim 34 (depends on 21) The network switch apparatus of claim 21, further comprising additional inline ports for coupling to one or more additional pass-through devices, and a filter configured to pass additional packets received from the first network port to the pass-through device and the one or more additional pass-through devices such that all of the pass-through devices collectively can handle at least 10G communication without a need to randomly drop packets. ### Claim 35 (depends on 21) The network switch apparatus of claim 21, wherein the pass-through device comprises an intrusion prevention system. ### Claim 36 (depends on 21) The network switch apparatus of claim 21, wherein the network switch is configured to add a label to the first packet before passing the first packet to the first inline port, and remove the label from the first packet before transmitting the first packet to the second network port. ### Claim 37 (depends on 21) The network switch apparatus of claim 21, further comprising a housing for containing the by-pass device and the packet switch. ### Claim 38 (depends on 21) The network switch apparatus of claim 21, further comprising an instrument port for connection to a non-pass through device. ### Claim 39 (depends on 38) The network switch apparatus of claim 38, wherein the non-pass through device comprises a sniffer, an IDS, or a forensic recorder, and the pass through device comprises an IPS, and wherein the network switch apparatus further comprises a logic device for comparing performance of the non-pass through device and performance of the pass through device. ### Claim 40 A network switch apparatus, comprising: a first network port; a second network port; a first inline port; a second inline port, wherein the first and second inline ports are for communication with a pass-through device; an instrument port for connection to a non-pass through device; and a packet switch for transmitting a packet received at the first network port to the non-pass through device via the instrument port, and to the pass through device via the first inline port. ### Claim 41 (depends on 40) The network switch apparatus of claim 40, wherein the non-pass through device comprises a sniffer, an IDS, or a forensic recorder, and the pass through device comprises an IPS, and wherein the network switch apparatus further comprises a logic device for comparing performance of the non-pass through device and performance of the pass through device. ### Claim 42 A network switch apparatus, comprising: a first network port for communication with a first node; a second network port for communication with a second node; a first inline port; a second inline port, wherein the first and second inline ports are for communication with a pass-through device; and a processing module configured for transmitting a first subset of packets received from the first node at the first network port to the pass-through device via the first inline port, and passing a second subset of the packets received from the first node at the first network port to the second node via the second network port, in accordance with a predefined logical scheme. ### Claim 43 (depends on 42) The network switch apparatus of claim 42, wherein the second inline port is configured to receive the first subset of the packets from the pass-through device after the pass-through device has processed the first subset of the packets, and wherein the processing module is configured to pass the first subset of the packets to the second node via the second network port. ### Claim 44 (depends on 42) The network switch apparatus of claim 42, further comprising: a third inline port; and a fourth inline port, wherein the third and fourth inline ports are for communication with an additional pass-through device. ### Claim 45 (depends on 44) The network switch apparatus of claim 44, wherein the processing module is configured for transmitting a third subset of the packets received from the first node at the first network port to the additional pass-through device via the third inline port. ### Claim 46 (depends on 44) The network switch apparatus of claim 44, wherein the processing module is configured to examine the packets, and determine whether to send at least some of the packets to the pass-through device or the additional pass-through device based on a result of the examination of the packets. ### Claim 47 (depends on 44) The network switch apparatus of claim 44, wherein the processing module is configured to pass the packets to the second instrument port, the first inline port, and the third inline port, such that the pass-through device and the additional pass-through device collectively can handle communication without a need to randomly drop packets. ### Claim 48 (depends on 42) The network switch apparatus of claim 42, wherein the pass-through device comprises an IPS. ### Claim 49 A network switch apparatus, comprising: a first network port for receiving packets from a first node; an inline port for communication with a pass-through device; one or more additional inline ports for communication with one or more additional pass-through devices, respectively; and a processing module configured for transmitting a subset of the packets received from the first node at the first network port to the pass-through device via the inline port, and passing a remaining of the packets received from the first node at the first network port to the one or more additional pass-through devices via the respective one or more additional inline ports, in accordance with a predefined logical scheme. ### Claim 50 (depends on 49) The network switch apparatus of claim 49, wherein the processing module is configured to examine the packets, and determine how to distribute the packets to the pass-through device and the one or more additional pass-through devices based on a result of the examination of the packets. ### Claim 51 (depends on 49) The network switch apparatus of claim 49, further comprising: a second instrument port for communication with a second node; wherein the processing module is configured to receive the packets from the pass-through device and the one or more additional pass-through devices, and pass the packets to the second instrument port. ### Claim 52 (depends on 49) The network switch apparatus of claim 49, wherein the pass-through device and the one or more additional pass-through devices collectively can handle communication without a need to randomly drop packets. ### Claim 53 (depends on 49) The network switch apparatus of claim 49, wherein the pass-through device comprises an IPS.