Duplicating packets efficiently within a network security appliance
AssigneeMcAfee, Inc.
InventorSakthikumar Subramanian
Life of this patent
Estimating the term…
Abstract
A network security appliance uses a switch to switch packets between cores configured for fast path processing and slow path processing. The switch duplicates packets for delivery to the slow path processing cores, eliminating the need for the fast path processing cores to expend processor resources on packet duplication. The switch can use IEEE 802.1ad Q-in-Q VLAN tags in the packet to perform the switching and packet duplication. Slow path processing cores may also broadcast packets to other slow path processing cores via the switch.
Claims21
1-21. (canceled)
A non-transitory machine readable medium with instructions stored thereon, comprising instructions that when executed cause a network security appliance to:
- perform in a first core fast path processing on a packet received by the network security appliance;
- insert by the first core a first virtual local area network tag into the packet;
- switch the packet to a first plurality of cores based on the first virtual local area network tag;
- and
- perform slow path processing concurrently in the first plurality of cores.
A network security appliance, comprising:
- a first core;
- a first plurality of cores;
- a switch connected to the first core and the first plurality of cores;
- a first memory connected to the first core, on which is stored instructions that when executed by the first core cause the first core to:
- perform fast path processing of a packet;
- and
- send the packet to the switch addressed to a subplurality of the first plurality of cores;
- and
- a second memory connected to the first plurality of cores, on which is stored instructions that when executed by the subplurality of the first plurality of cores cause the subplurality of the first plurality of cores to:
- perform slow path processing of the packet concurrently,
- wherein the switch is configured to duplicate the packet received from the first core and send the duplicated packet to each of the subplurality of the first plurality of cores.
A method of processing packets in a network security appliance, comprising:
- receiving a packet at a network interface;
- performing fast path processing by a first core of the network security appliance;
- determining by the first core that slow path processing should be performed by a plurality of cores of the network security appliance;
- sending the packet from the first core to a switch of the network security appliance;
- duplicating the packet by the switch, sending each of the duplicated packets to a member of the plurality of cores for slow path processing;
- and
- performing slow path processing on the duplicated packet.
Dependencies are inferred from the claim text.