# US 8,782,787 B2 · Distributed packet flow inspection and processing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,787 B2
- Document ID: US8782787B2
- Status: Granted
- Kind: B2
- Application number: 12/911,912
- Filed: 2010-10-26
- Published: 2011-04-28
- Granted: 2014-07-15
- Earliest claimed: 2009-10-28
- Assignees: Hewlett-Packard Development Company, L.P.
- Applicants: Marc Willibeek-LeMair; Brian C. Smith
- Inventors: Marc Willibeek-LeMair; Brian C. Smith
- Web page: https://patentgrep.com/patent/US8782787B2

## CPC

- H04L 43/028: by filtering
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/161: {Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields}
- H04L 69/22: Parsing or analysis of headers
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Distribution of network processing load among a set of packet processing devices is improved by employing means for eliminating, controlling, or otherwise affecting redundant packet processing operations. In one embodiment, at least two packet processing devices are present, both capable of processing data packets flowing therethrough, such as, inspecting, detecting, and filtering data packets pursuant to one or more filters from a filter set. Redundancy is controlled by providing or enabling either or both of the packet processing devices with capability for detecting during its said inspection of said data packets that, for example, one or more filters had been previously executed on said data packets by the other packet processing device, and then not executing the previously-executed filters on said data packets.

## Claims

### Claim 1

A network comprising:
a first packet processing device to apply a first filtering operation on a data packet; and
a second packet processing device to
receive the data packet from the first packet processing device,
determine filtering operations previously performed on the data packet,
identify the first filtering operation as a filtering operation previously performed on the data packet,
based on the identification of the first filtering operation, apply a second filtering operation, different from the first filtering operation, on the data packet, and
add a tag to the data packet to indicate the second filtering operation applied on the data packet.

### Claim 2 (depends on 1)

The network of claim 1, wherein determine filtering operations previously performed on the data packet includes inspect a field of the data packet, wherein said field contains a value signifying the first filtering operation.

### Claim 3 (depends on 2)

The network of claim 2, wherein said value is encrypted.

### Claim 4 (depends on 2)

The network of claim 2, wherein said value signifies an entry or entries in a data structure, wherein said entry or entries correlate with the first filtering operation.

### Claim 5 (depends on 2)

The network of claim 2, wherein said value identifies the first packet processing device as the device that previously executed the first filtering operation on the data packet.

### Claim 6 (depends on 1)

The network of claim 1, wherein determine filtering operations previously performed on the data packet includes:
inspect an address field of the data packet; and
use network topology information in conjunction with the address in the address field to identify the previous filtering operations.

### Claim 7 (depends on 1)

The network of claim 1, further comprising:
a management agent to assign the first filtering operation to the first packet processing device and assign the second filtering operation to the second packet processing device.

### Claim 8 (depends on 7)

The network of claim 7, wherein the second packet processing device is further to
determine whether the first filtering operation has been performed on the data packet,
if the first filtering operation has been performed on the data packet, apply only the second filtering operation on the data packet, and
if the first filtering operation has not been performed on the data packet, apply both the first and second filtering operations on the data packet.

### Claim 9 (depends on 1)

The network of claim 1, wherein said second packet processing device is to apply the second filtering operation only if said second packet processing device detects that said second filtering operation had not previously been executed on said data packet.

### Claim 10

A packet processing device suitable for installation in a network to thereby provide therein an intrusion prevention system, the packet processing device comprising:
a port to receive data packets;
a data packet inspector to inspect the data packets; and
a data packet filter to filter the data packets in response to the inspection of the data packets by the data packet inspector,
wherein the data packet inspector is to identify filtering operations previously applied on the data packets by another packet processing device,
based on the identified previous filtering operations, the data packet filter is to apply a filtering operation, different from the identified previous filtering operations, on the data packets, and
wherein the data packet filter is further to add a tag to the data packets to indicate the filtering operation applied to the data packets.

### Claim 11 (depends on 10)

The packet processing device of claim 10, wherein, to identify filtering operations previously applied on the data packets, said data packet inspector is to inspect an address field of the data packets and use network topology information in conjunction with the address in the address field to identify the previous filtering operations.

### Claim 12 (depends on 10)

The packet processing device of claim 10, wherein said data packet inspector is to inspect a field of the data packets, wherein said field contains a value signifying said previous filtering operations.

### Claim 13 (depends on 12)

The packet processing device of claim 12, wherein said value is encrypted.

### Claim 14 (depends on 12)

The packet processing device of claim 12, wherein said value signifies an entry or entries in a data structure, wherein said entry or entries correlate with said previous filtering operations.

### Claim 15 (depends on 12)

The packet processing device of claim 12, wherein said value identifies the another packet processing device as the device that previously executed said filtering operations on the data packets.

### Claim 16

A method for processing data packets by a packet processing device, the method comprising:
receiving a data packet;
identifying, by the packet processing device, filtering operations previously performed on the data packet by another packet processing device, including inspecting an address field of the data packet and using network topology information in conjunction with the address in the address field to identify the previous filtering operations; and
based on the identified previous filtering operations, applying a filtering operation, different from the identified previous filtering operations, on the data packet.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
adding a tag to the data packets to indicate the filtering operation applied on the data packet.

### Claim 18

A packet processing device suitable for installation in a network to thereby provide therein an intrusion prevention system, the packet processing device comprising:
a port to receive data packets;
a data packet inspector to inspect the data packets; and
a data packet filter to filter the data packets in response to the inspection of the data packets by the data packet inspector,
wherein the data packet inspector is to inspect a field of the data packets to identify filtering operations previously applied on the data packets by another packet processing device, wherein the field contains a value signifying the previous filtering operations applied on the data packets, and
based on the identified previous filtering operations, the data packet filter is to apply a filtering operation, different from the identified previous filtering operations, on the data packets.

### Claim 19 (depends on 18)

The packet processing device of claim 18, wherein the value is encrypted.

### Claim 20 (depends on 18)

The packet processing device of claim 18, wherein the value signifies an entry or entries in a data structure, wherein the entry or entries correlate with the previous filtering operations.

### Claim 21 (depends on 18)

The packet processing device of claim 18, wherein the value identifies the another packet processing device as the device that previously executed the filtering operations on the data packets.