# US 2021/0344648 A1 · Selective offloading of packet flows with flow state management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344648 A1 - Document ID: US20210344648A1 - Status: Published application - Kind: A1 - Application number: 17/374,468 - Filed: 2021-07-13 - Published: 2021-11-04 - Earliest claimed: 2016-07-27 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Pradeep Patel; Jonathan A. Kunder; Ashish K. Dey; Andrew E. Ossipov; Jianxin Wang - Web page: https://patentgrep.com/patent/US20210344648A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0245: {Filtering by information in the payload} - G06F 16/9017: {using directory or table look-up (use of a directory or look-up table in file systems G06F16/13)} - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/101: {Access control lists [ACL]} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A first packet of a packet flow is received at a classifying network device. The first packet is forwarded from the classifying network device to a firewall network device. An indication that the packet flow is to be offloaded is received at the classifying network device. Data is stored at the classifying network device indicating that the packet flow is to be offloaded. A non-control packet of the packet flow is received at the classifying network device. A determination is made that the non-control packet belongs to the packet flow by comparing data contained in the non-control packet to the stored data. The non-control packet of the packet flow is directed to a processing entity in response to the determining. A control packet of the packet flow is received at the classifying network device. The control packet of the packet flow is directed to the firewall network device. ## Claims ### Claim 1 A method comprising: obtaining a first packet of a packet flow at a classifying device; providing the first packet to a firewall device; obtaining, at the classifying device, an indication from the firewall device that non-control packets of the packet flow are to be provided to a processing entity and control packets of the packet flow are to be provided to the firewall device; storing, at the classifying device, data that indicates that the non-control packets of the packet flow are to be provided to the processing entity; obtaining one or more non-control packets of the packet flow at the classifying device; determining, by comparing data contained in the one or more non-control packets of the packet flow to the data stored at classifying device, that the one or more non-control packets of the packet flow are to be provided to the processing entity; providing the one or more non-control packets of the packet flow to the processing entity in response to the determining; obtaining a control packet of the packet flow at the classifying device; and providing the control packet of the packet flow to the firewall device. ### Claim 2 (depends on 1) The method of claim 1, wherein providing the control packet of the packet flow to the firewall device comprises providing the control packet of the packet flow to the firewall device to maintain a flow state of the packet flow at the firewall device. ### Claim 3 (depends on 2) The method of claim 2, further comprising storing data maintaining the flow state of the packet flow at the firewall device. ### Claim 4 (depends on 3) The method of claim 3, further comprising providing, to the firewall device from the classifying device, data updating the flow state of the packet flow. ### Claim 5 (depends on 1) The method of claim 1, further comprising: obtaining at the classifying device an indication from the firewall device that non-control packets of the packet flow should no longer be provided to the processing entity; obtaining a non-control packet of the packet flow at the classifying device; and providing the non-control packet of the packet flow to the firewall device. ### Claim 6 (depends on 5) The method of claim 5, wherein the indication from the firewall device that the non-control packets of the packet flow should no longer be provided to the processing entity is obtained at the classifying device in response to predetermined criteria evaluated by the firewall device, wherein the predetermined criteria comprise one or more of a reputation change of a source device of the packet flow, a posture change of the source device of the packet flow, and/or timing of receipt of the packet flow. ### Claim 7 (depends on 1) The method of claim 1, wherein: the firewall device applies services to the first packet via software instructions stored at the firewall device; and the processing entity applies services to the one or more non-control packets via hardware of the processing entity. ### Claim 8 (depends on 7) The method of claim 7, wherein the hardware of the processing entity executes packet rewrite instructions. ### Claim 9 (depends on 1) The method of claim 1, further comprising: obtaining a non-control packet of the packet flow at the classifying device; determining at the classifying device that an amount of data contained in the non-control packet exceeds a predetermined threshold; and providing the non-control packet to the firewall device in response to determining that the amount of data contained in the non-control packet exceeds the predetermined threshold. ### Claim 10 An apparatus comprising: one or more memories; one or more network interfaces configured to enable network communications; and one or more processors, wherein the one or more processors are configured to perform operations on behalf of a classifying device, the operations comprising: obtaining, via the one or more network interfaces, a first packet of a packet flow at the classifying device; providing, via the one or more network interfaces, the first packet to a firewall device; obtaining, via the one or more network interfaces, an indication from the firewall device that non-control packets of the packet flow are to be provided to a processing entity and control packets of the packet flow are to be provided to the firewall device; storing, in the one or more memories, data that indicates that the non-control packets of the packet flow are to be provided to the processing entity; obtaining, via the one or more network interfaces, one or more non-control packets of the packet flow at the classifying device; determining, by comparing data contained in the one or more non-control packets of the packet flow to the data stored in the one or more memories, that the one or more non-control packets of the packet flow are to be provided to the processing entity; providing, via the one or more network interfaces, the one or more non-control packets of the packet flow to the processing entity in response to the determining; obtaining, via the one or more network interfaces, a control packet of the packet flow at the classifying device; and providing, via the one or more network interfaces, the control packet of the packet flow to the firewall device. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the one or more processors are further configured to provide the control packet of the packet flow to the firewall device by providing the control packet of the packet flow to the firewall device to maintain a flow state of the packet flow at the firewall device. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the one or more processors are further configured to provide, via the one or more network interfaces, data to the firewall device updating the flow state of the packet flow. ### Claim 13 (depends on 10) The apparatus of claim 10, wherein the one or more processors are further configured to perform, on behalf of the classifying device, operations comprising: obtaining, via the one or more network interfaces, an indication from the firewall device that non-control packets of the packet flow should no longer be provided to the processing entity; obtaining, via the one or more network interfaces, a non-control packet of the packet flow at the classifying device; and providing, via the one or more network interfaces, the non-control packet of the packet flow to the firewall device. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the indication from the firewall device that the non-control packets of the packet flow should no longer be provided to the processing entity is obtained at the classifying device in response to predetermined criteria evaluated by the firewall device, wherein the predetermined criteria comprise one or more of a reputation change of a source device of the packet flow, a posture change of the source device of the packet flow, and/or timing of receipt of the packet flow. ### Claim 15 (depends on 10) The apparatus of claim 10, wherein the one or more processors are further configured to perform, on behalf of the classifying device, operations comprising: obtaining, via the one or more network interfaces, a non-control packet of the packet flow at the classifying device; determining at the classifying device that an amount of data contained in the non-control packet exceeds a predetermined threshold; and providing, via the one or more network interfaces, the non-control packet to the firewall device in response to determining that the amount of data contained in the non-control packet exceeds the predetermined threshold. ### Claim 16 One or more tangible non-transitory computer readable mediums containing instructions, wherein the instructions, when executed, cause one or more processors to: obtain a first packet of a packet flow at a classifying device; provide the first packet to a firewall device; obtain, at the classifying device, an indication from the firewall device that non-control packets of the packet flow are to be provided to a processing entity and control packets of the packet flow are to be provided to the firewall device; store, at the classifying device, data that indicates that the non-control packets of the packet flow are to be provided to the processing entity; obtain one or more non-control packets of the packet flow at the classifying device; determine, by comparing data contained in the one or more non-control packets of the packet flow to the data stored at classifying device, that the one or more non-control packets of the packet flow are to be provided to the processing entity; provide the one or more non-control packets of the packet flow to the processing entity in response to the determining; obtain a control packet of the packet flow at the classifying device; and provide the control packet of the packet flow to the firewall device. ### Claim 17 (depends on 16) The one or more tangible non-transitory computer readable mediums of claim 16, wherein the instructions operable to provide the control packet of the packet flow to the firewall device comprise instructions operable to provide the control packet of the packet flow to the firewall device to maintain a flow state of the packet flow at the firewall device. ### Claim 18 (depends on 17) The one or more tangible non-transitory computer readable mediums of claim 17 further comprising instructions that cause the one or more processors to provide, to the firewall device from the classifying device, data updating the flow state of the packet flow. ### Claim 19 (depends on 16) The one or more tangible non-transitory computer readable mediums of claim 16 further comprising instructions that cause the one or more processors to: obtain, at the classifying device, an indication from the firewall device that non-control packets of the packet flow should no longer be provided to the processing entity; obtain a non-control packet of the packet flow at the classifying device; and provide the non-control packet of the packet flow to the firewall device. ### Claim 20 (depends on 16) The one or more tangible non-transitory computer readable mediums of claim 16 further comprising instructions that cause the one or more processors to: obtain a non-control packet of the packet flow at the classifying device; determine at the classifying device that an amount of data contained in the non-control packet exceeds a predetermined threshold; and provide the non-control packet to the firewall device in response to determining that the amount of data contained in the non-control packet exceeds the predetermined threshold.