Direct cache access for network input/output devices

A method comprising:

• running a first network security application on a first central processing unit (CPU) of a plurality of CPUs of a network security appliance;
• running a second network security application on a second CPU of the plurality of CPUs;
• defining, by a network interface controller (NIC) of the network security appliance, a first direct cache access (DCA) control for a first I/O device queue of a plurality of I/O device queues of the NIC corresponding to the first CPU, wherein the first DCA control specifies a first set of one or more portions of an Internet Protocol (IP) packet queued on the first I/O device queue that are to be copied to a cache of the first CPU responsive to transfer of the IP packet from the first I/O device queue to a memory accessible by the plurality of CPUs;
• defining, by the NIC, a second DCA control for a second I/O device queue of the plurality of I/O device queues corresponding to the second CPU, wherein the second DCA control specifies a second set of one or more portions of an IP packet queued on the second I/O device queue that are to be copied to a cache of the second CPU responsive to transfer of the IP packet from the second I/O device queue to the memory;
• receiving, by the NIC, an IP packet;
• identifying, by the NIC, boundaries of portions of the received IP packet by parsing the received IP packet;
• and
• facilitating parallel processing of appropriate portions of the received IP packet by the first network security application and the second network security application by:
• queuing, by the NIC, the received IP packet on the first I/O device queue;
• queuing, by the network I/O device, the received IP packet on the second I/O device queue;
• copying, by a controller associated with the memory, the first set of one or more portions of the received IP packet to the cache of the first CPU based on the first DCA control before, instead of or concurrently with transfer of the received IP packet from the first I/O device queue to the memory;
• and
• copying, by the controller, the second set of one or more portions of the received IP packet to the cache of the second CPU based on the second DCA control before, instead of or concurrently with transfer of the received IP packet from the second I/O device queue to the memory.