Distributed packet flow inspection and processing

A packet processing device suitable for installation in a network to thereby provide therein an intrusion prevention system, the packet processing device comprising:

• a port to receive data packets;
• a data packet inspector to inspect the data packets;
• and
• a data packet filter to filter the data packets in response to the inspection of the data packets by the data packet inspector,
• wherein the data packet inspector is to identify filtering operations previously applied on the data packets by another packet processing device,
• based on the identified previous filtering operations, the data packet filter is to apply a filtering operation, different from the identified previous filtering operations, on the data packets, and
• wherein the data packet filter is further to add a tag to the data packets to indicate the filtering operation applied to the data packets.

A method for processing data packets by a packet processing device, the method comprising:

• receiving a data packet;
• identifying, by the packet processing device, filtering operations previously performed on the data packet by another packet processing device, including inspecting an address field of the data packet and using network topology information in conjunction with the address in the address field to identify the previous filtering operations;
• and
• based on the identified previous filtering operations, applying a filtering operation, different from the identified previous filtering operations, on the data packet.

A packet processing device suitable for installation in a network to thereby provide therein an intrusion prevention system, the packet processing device comprising:

• a port to receive data packets;
• a data packet inspector to inspect the data packets;
• and
• a data packet filter to filter the data packets in response to the inspection of the data packets by the data packet inspector,
• wherein the data packet inspector is to inspect a field of the data packets to identify filtering operations previously applied on the data packets by another packet processing device, wherein the field contains a value signifying the previous filtering operations applied on the data packets, and
• based on the identified previous filtering operations, the data packet filter is to apply a filtering operation, different from the identified previous filtering operations, on the data packets.