Tiered deep packet inspection in network devices

A network device, comprising:

• ports to receive and transmit packet flows;
• at least one switch node to switch packets among the ports, each of the at least one switch node including a packet filter to identify selected packet flows satisfying first criteria, each of the at least one switch node diverting the selected packet flows from being switched based on standard policy;
• at least one other switch node to receive the selected packet flows;
• and
• at least one network processor, coupled to the at least one other switch node, to perform deep packet inspection on the selected packet flows to identify further selected packet flows satisfying second criteria, and to allow switching of the selected packet flows other than the further selected packet flows based on the standard policy, and process the further selected packet flows based on alternative policy.

A method of packet inspection in a network device, comprising:

• processing packets in a forwarding path of a switch to identify selected flows in the packets satisfying a first criteria;
• diverting the selected flows from standard processing in the switch;
• performing deep packet inspection on the selected flows to identify further selected flows satisfying a second criteria;
• applying alternative processing to the further selected flows in the switch;
• and
• allowing the selected flows other than the further selected flows to rejoin the standard processing in the switch.