# US 2025/0158902 A1 · Method and system for deep packet inspection in software defined networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0158902 A1 - Document ID: US20250158902A1 - Status: Published application - Kind: A1 - Application number: 19/023,654 - Filed: 2025-01-16 - Published: 2025-05-15 - Earliest claimed: 2014-04-22 - Assignees: Orckit Corporation - Applicants: ORCKIT Corporation - Inventors: Yossi BARSHESHET; Simhon DOCTORI; Ronen SOLOMON - Web page: https://patentgrep.com/patent/US20250158902A1 ## CPC - H04L 12/6418: {Hybrid transport} - G06F 40/284: Lexical analysis, e.g. tokenisation or collocates - G06F 40/40: Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30) - G06N 3/08: Learning methods - G06T 3/4053: based on super-resolution, i.e. the output image resolution being higher than the sensor resolution - G06T 5/70: Denoising; Smoothing - G06T 11/60: Creating or editing images; Combining images with text - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L 47/2483: involving identification of individual flows - H04L 49/70: {Virtual switches} - H04L 69/161: {Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields} - H04L 45/645: Splitting route computation layer and forwarding layer, e.g. routing according to path computational element [PCE] or based on OpenFlow functionality - H04L 45/655: Interaction between route computation entities and forwarding entities, e.g. for route determination or for flow table update - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract A method for deep packet inspection (DPI) in a software defined network (SDN). The method includes configuring a plurality of network nodes operable in the SDN with at least one probe instruction; receiving from a network node a first packet of a flow, the first packet matches the at least one probe instruction and includes a first sequence number; receiving from a network node a second packet of the flow, the second packet matches the at least one probe instruction and includes a second sequence number, the second packet is a response of the first packet; computing a mask value respective of at least the first and second sequence numbers indicating which bytes to be mirrored from subsequent packets belonging to the same flow; generating at least one mirror instruction based on at least the mask value; and configuring the plurality of network nodes with at least one mirror instruction. ## Claims ### Claim 1 A method for use with a packet network that includes a network node for transporting packets between first and second entities under control of a controller that is external to the network node, the method comprising: sending, by the controller to the network node over the packet network, an instruction and a packet-applicable criterion; receiving and storing, by the network node from the controller, the instruction and the criterion; receiving, by the network node from the first entity over the packet network, a packet addressed to the second entity; checking, by the network node, if the packet satisfies the criterion; responsive to the packet satisfying the criterion, sending the packet, by the network node over the packet network, to the controller; receiving, by the controller from the network node over the packet network, in response to the sending of the packet by the network node; and analyzing, by the controller, by performing Deep Packet Inspection (DPI) using a DPI engine, the packet, wherein the network node comprises a router. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: receiving, by the network node from the first entity over the packet network, an additional packet addressed to the second entity; checking, by the network node, if the additional packet satisfies the criterion; and sending, by the network node to the second entity over the packet network, the additional packet, in response to the additional packet not satisfying the criterion. ### Claim 3 (depends on 1) The method according to claim 1, further comprising: receiving and storing, by the network node from the controller, an additional instruction and an additional criterion; receiving, by the network node from the first entity over the packet network, an additional packet addressed to the second entity; and checking, by the network node, if the additional packet satisfies the additional criterion. ### Claim 4 (depends on 3) The method according to claim 3, wherein the additional instruction is a ‘terminate’ instruction, the method further comprising blocking, by the network node, the additional packet from being sent to the second entity and from being sent to the controller. ### Claim 5 (depends on 3) The method according to claim 3, wherein the additional instruction is a ‘mirror’ instruction, the method further comprising the method further comprising sending the additional packet, by the network node, to the second entity and to the controller. ### Claim 6 (depends on 1) The method according to claim 1, wherein the instruction is probe instruction, the method further comprising sending, by the controller to the network node over the packet network, the packet, in response to the DPI analysis. ### Claim 7 (depends on 6) The method according to claim 6, further comprising storing the received packet or a portion thereof, by the controller, in a memory. ### Claim 8 (depends on 7) The method according to claim 7, wherein a field of the packet comprises of multiple consecutive bytes, and wherein the instruction comprises identification of the consecutive bytes in the packet. ### Claim 9 (depends on 8) The method according to claim 8, further for use with an application server that communicates with the controller, wherein the analyzing comprises sending the packet, by the controller, to the application server, and analyzing the packet by the application server. ### Claim 10 (depends on 8) The method according to claim 8, wherein the analyzing comprises applying security or data analytic application. ### Claim 11 (depends on 8) The method according to claim 8, wherein the analyzing comprises applying security application that comprises firewall or intrusion detection functionality. ### Claim 12 (depends on 8) The method according to claim 8, wherein the packet comprises distinct header and payload fields, and wherein the analyzing comprises checking or comparing a part of, or whole of, the payload field. ### Claim 13 (depends on 1) The method according to claim 1, wherein the packet comprises distinct header and payload fields and the header comprises one or more flag bits, and wherein the packet-applicable criterion is that one or more of the flag bits is set. ### Claim 14 (depends on 13) The method according to claim 13, wherein the packet is a Transmission Control Protocol (TCP) packet, and wherein the one or more flag bits comprises comprise a SYN flag bit, an ACK flag bit, a FIN flag bit, an RST flag bit, or any combination thereof. ### Claim 15 (depends on 1) The method according to claim 1, wherein the packet comprises distinct header and payload fields, the header comprises at least addresses of the first and second entities, and wherein the packet-applicable criterion is that the first entity address, the second entity address, or both match a predetermined address or addresses. ### Claim 16 (depends on 15) The method according to claim 15, wherein the addresses are Internet Protocol (IP) addresses. ### Claim 17 (depends on 1) The method according to claim 1, wherein the packet network comprises a Wide Area Network (WAN). ### Claim 18 (depends on 1) The method according to claim 1, wherein the packet network comprises a Local Area Network (LAN). ### Claim 19 (depends on 1) The method according to claim 1, wherein the packet network comprises the Internet, a Metropolitan Area Network (MAN), an Internet Service Provider (ISP) backbone, a datacenter network, or an inter-datacenter network. ### Claim 20 (depends on 1) The method according to claim 1, wherein the first entity is a server device and the second entity is a client device, or wherein the first entity is a client device and the second entity is a server device. ### Claim 21 (depends on 20) The method according to claim 20, wherein the server device comprises a web server, and wherein the client device comprises a smartphone, a tablet computer, a personal computer, a laptop computer, or a wearable computing device. ### Claim 22 (depends on 20) The method according to claim 20, wherein at least part of the communication between the network node and the controller is based on, or uses, a standard protocol. ### Claim 23 (depends on 22) The method according to claim 22, wherein the standard protocol is according to, based on, or compatible with, an OpenFlow protocol version 1.3.3 or 1.4.0. ### Claim 24 (depends on 23) The method according to claim 23, wherein the instruction comprises a Type-Length-Value (TLV) structure. ### Claim 25 (depends on 1) The method according to claim 1, wherein the packet is a Transmission Control Protocol (TCP) packet that comprises source and destination TCP ports, a TCP sequence number, and a TCP sequence mask fields, and wherein the packet-applicable criterion is that the source TCP port, the destination TCP port, the TCP sequence number, the TCP sequence mask, or any combination thereof, matches a predetermined value or values. ### Claim 26 (depends on 1) The method according to claim 1, wherein the network node comprises a switch or a bridge. ### Claim 27 (depends on 1) The method according to claim 1, wherein the packet network is an Internet Protocol (IP) network, and the packet is an IP packet. ### Claim 28 (depends on 27) The method according to claim 27, wherein the packet network is a Transmission Control Protocol (TCP) over IP network, and the packet is an TCP/IP packet. ### Claim 29 (depends on 1) The method according to claim 1, wherein the packet network supports a Software Defined Network (SDN), the packet is routed as part of a data plane and the network node communication with the controller serves as a control plane.