Dynamic tcp stream processing with modification notification

A method comprising:

• during a duplex TCP session established between a first TCP endpoint and a second TCP endpoint,
• inspecting TCP packets received from the first TCP endpoint;
• extracting a TCP sequence number from a selected TCP packet;
• identifying a TCP session associated with the selected TCP packet;
• determining whether content in the selected TCP packet complies with a rule;
• when the selected TCP packet complies with the rule,
• allowing the selected TCP packet to reach the second TCP endpoint;
• when the selected TCP packet does not comply with the rule,
• determining a rejection reason data value;
• preventing at least a portion of the selected TCP packet from reaching the second TCP endpoint;
• removing at least a portion of the selected TCP packet to form a modified TCP packet;
• setting a delta value to a value that depends on the size of the portion thus removed;
• applying the delta value to a per-session TCP accumulator associated with the TCP session;
• adjusting a TCP sequence number of the modified TCP packet by a value that depends on a size of the per-session TCP accumulator;
• sending the modified TCP packet to the second TCP endpoint;
• generating a response packet having a value indicating a reason for the rejection;
• and
• sending the response packet to the first TCP endpoint.

An apparatus comprising:

• a fixed logic cut-through device having a first network interface and a second network interface operating independently of one another, the fixed logic cut-through device enabling one or more TCP packet streams to travel between the first and second network interfaces;
• a packet inspection device, for inspecting the TCP packet stream to
• extract a TCP sequence number from a selected TCP packet;
• identifying a session associated with the selected TCP packet;
• determining whether the selected TCP packet contains content that does not comply with a rule;
• when the selected TCP packet does not comply,
• preventing at least a portion of the selected TCP packet from reaching the second network interface;
• a controller, comprising fixed logic and one or more programmable data processors, the controller for:
• receiving the selected TCP packet and a rejection reason data value from the packet inspection device;
• storing as a per-session TCP sequence marker a value based on the sequence number of the selected TCP packet;
• trimming the rejected content from the TCP packet to form a modified TCP packet;
• writing the modified packet to a memory shared with the fixed-cut through device for sending the modified packet over the second network interface;
• setting a per-session delta value to a value that depends on the size of the trimmed content;
• adjusting the TCP sequence number of the modified TCP packet according to a value in a per-session TCP accumulator;
• extracting a sequence number and a session identifier of TCP packets subsequently arriving over the second network interface;
• if a subsequently arriving TCP packet over the second network interface has an ACK sequence number equal to or greater than the associated session's TCP sequence marker, then applying the associated per-session delta value to the TCP accumulator associated with the session;
• adjusting the ACK sequence number of the subsequently arriving packet over the second network interface by the value of the TCP accumulator associated with the session;
• and
• generating a response packet for sending over the first network interface, the response packet comprising a value indicating a reason for the rejection.