# US 2014/0153435 A1 · Tiered deep packet inspection in network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0153435 A1 - Document ID: US20140153435A1 - Status: Published application - Kind: A1 - Application number: 14/235,112 - Filed: 2011-08-31 - Published: 2014-06-05 - Earliest claimed: 2011-08-31 - Inventors: James Rolette; Bruce E. LaVigne; Joseph A. Curcio - Web page: https://patentgrep.com/patent/US20140153435A1 ## CPC - H04L 41/5054: Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L 43/062: related to network traffic - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Packet inspection in a network device includes a first stage circuit to monitor packets being switched by a network interface in the network device. The first stage circuit includes at least one pattern matcher to identify selected flows in the packets satisfying first criteria and to divert the selected flows from standard processing in the network interface. A second stage circuit receives the selected flows, performs deep packet inspection on the selected flows to identify further selected flows satisfying a second criteria, and controls the network interface to apply alternative processing to the further selected flows and allow the selected flows other than the further selected flows to rejoin the standard processing. ## Claims ### Claim 1 An apparatus to provide packet inspection in a network device, comprising: a first stage circuit to monitor packets being switched by a network interface in the network device, the first stage circuit including at least one pattern matcher to identify selected flows in the packets satisfying first criteria and to divert the selected flows from standard processing in the network interface; and a second stage circuit to receive the selected flows, to perform deep packet inspection on the selected flows to identify further selected flows satisfying a second criteria, and to control the network interface to apply alternative processing to the further selected flows and allow the selected flows other than the further selected flows to rejoin the standard processing. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the first stage circuit is in a forwarding path of the network interface. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the second stage circuit includes at least one deep packet inspection circuit to perform the deep packet inspection of the selected flows. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the at least one pattern matcher matches the packets against at least one of byte patterns, packet patterns, or regular expressions. ### Claim 5 (depends on 1) The apparatus of claim 1, the at least one pattern matcher matches the flows against patterns, the first criteria including a match with at least one of the patterns, and wherein the deep packet inspection includes tests, the second criteria including a match with test criteria. ### Claim 6 A network device, comprising: ports to receive and transmit packet flows; at least one switch node to switch packets among the ports, each of the at least one switch node including a packet filter to identify selected packet flows satisfying first criteria, each of the at least one switch node diverting the selected packet flows from being switched based on standard policy; at least one other switch node to receive the selected packet flows; and at least one network processor, coupled to the at least one other switch node, to perform deep packet inspection on the selected packet flows to identify further selected packet flows satisfying second criteria, and to allow switching of the selected packet flows other than the further selected packet flows based on the standard policy, and process the further selected packet flows based on alternative policy. ### Claim 7 (depends on 6) The network device of claim 6, wherein the alternative policy data dictates to block switching of the further selected packet flows among the ports. ### Claim 8 (depends on 6) The network device of claim 6, wherein the alternative policy data dictates to redirect or mirror the further selected packet flows to at least one specified port of the ports. ### Claim 9 (depends on 6) The network device of claim 6, wherein the at least one network processor includes a plurality of network processors, each of the plurality of network processors to perform a portion of the deep packet inspection. ### Claim 10 (depends on 6) The network device of claim 6, wherein the at least one network processor includes a plurality of network processors, each of the plurality of network processors to perform the deep packet inspection on a portion of the selected packet flows. ### Claim 11 (depends on 6) The network device of claim 6, wherein the packet filter includes at least one pattern matcher to match the packet flows against patterns, the first criteria including a match with at least one of the patterns, and wherein the deep packet inspection includes a plurality of tests, the second criteria including a match with test criteria. ### Claim 12 A method of packet inspection in a network device, comprising: processing packets in a forwarding path of a switch to identify selected flows in the packets satisfying a first criteria; diverting the selected flows from standard processing in the switch; performing deep packet inspection on the selected flows to identify further selected flows satisfying a second criteria; applying alternative processing to the further selected flows in the switch; and allowing the selected flows other than the further selected flows to rejoin the standard processing in the switch. ### Claim 13 (depends on 12) The method of claim 12, wherein the step of processing the packets comprises: matching the packets against patterns; and identifying any of the packets that match a threshold number of the patterns as the selected flows. ### Claim 14 (depends on 3) The method of claim 3, wherein the patterns include at least one of byte patterns, packet patterns, or regular expressions. ### Claim 15 (depends on 12) The method of claim 12, wherein the step of performing the deep packet inspection comprises: applying the selected flows against deep packet inspection tests; and identifying any of the selected flows that match a threshold number of the deep packet inspection tests as the further selected flows.