# US 8,788,700 B2 · Initiating peer-to-peer tunnels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,700 B2 - Document ID: US8788700B2 - Status: Granted - Kind: B2 - Application number: 13/233,976 - Filed: 2011-09-15 - Published: 2012-03-22 - Granted: 2014-07-22 - Earliest claimed: 2009-04-30 - Assignees: Aruba Networks, Inc. - Applicants: Pradeep J. Iyer; Keerti Melkote - Inventors: Pradeep J. Iyer; Keerti Melkote - Web page: https://patentgrep.com/patent/US8788700B2 ## CPC - H04L 67/1042: using topology management mechanisms - H04L 67/104: Peer-to-peer [P2P] networks - H04L 67/1074: for supporting data block transmission mechanisms (file transfer H04L67/06) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Client traffic normally passes from a client to an access node, and from the access node through a tunnel to a controller, and then through another tunnel from the controller to the destination access node, and the destination client. When initiated by the controller, the access nodes establish a peer-to-peer tunnel for suitable client traffic, bypassing the “slow” tunnels through the controller with a “fast” peer-to-peer tunnel. Traffic through this “fast” tunnel may be initiated once the tunnel is established, or traffic for the “fast” tunnel may be queued up until traffic has completed passing through the “slow” tunnel. Slow tunnel traffic may be timed out, and queued traffic released after a preset time since the last packet was sent through the slow tunnel. The identity of the last packet sent through the slow tunnel may be retained, and queued traffic released when an acknowledgement for that packet is received. ## Claims ### Claim 1 A non-transitory Computer Readable Medium (CRM) comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising: forwarding, at a network device on a first communication path between a first network node and a second network node, data traffic from (i) a first client communicatively coupled with the first network node toward (ii) a second client communicatively coupled with the second network node; instructing at least one of the first network node and the second network node to establish a second communication path, that does not include the network device, for transmitting at least a portion of the data traffic that is not subject to services by the network device; wherein subsequent to establishing the second communication path, both the first communication path and the second communication path are concurrently used for transmissions between the first client and the second client, wherein: (a) the first communication path comprising the network device is used for transmitting a first portion of the data traffic, from the first client to the second client, that is subject to one or more services by the network device; and (b) the second communication path, that does not include the network device is used for transmitting a second portion of the traffic, from the first client to the second client, that is not subject to one or more services by the network device. ### Claim 2 (depends on 1) The CRM of claim 1, wherein the instructing operation is performed in response to determining that the first network node and the second network node are associated with a same controller. ### Claim 3 (depends on 2) The CRM of claim 2, wherein the same controller is the network device that performs the instructing operation. ### Claim 4 (depends on 1) The CRM of claim 1, wherein the instructing operation is performed in response to determining that the first network node is associated with a first controller in a particular set of controllers and that the second network node is associated with a second controller of the same particular set of controllers. ### Claim 5 (depends on 1) The CRM of claim 1, wherein the instructing operation is performed based on one or more characteristics associated with the data traffic. ### Claim 6 (depends on 1) The CRM of claim 1, wherein the one or more services comprise one or more of filtering, firewalling, authentication, virus detection, and deep packet inspection by the network device. ### Claim 7 A non-transitory Computer Readable Medium (CRM) comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising: establishing, between a first network node and a second network node, a first communication path for transmitting data, the first communication path comprising a network device; establishing, between the first network node and the second network node, a second communication path for transmitting data, the second communication path not including the network device; concurrently using the first communication path and the second communication path for transmitting data between a first client device and a second client device by: for each particular subset of the data that is (a) received at the first network node from the first client device and (b) addressed to the second client device communicatively coupled with the second network device: determining whether the particular subset of data is subject to one or more services by the network device; responsive to determining that the particular subset of data is subject to the one or more services by the network device, transmitting the particular subset of data toward the second network node on the first communication path comprising the network device; responsive to determining that the particular subset of data is not subject to the one or more services by the network device, transmitting the particular subset of data toward the second network node on the second communication path not including the network device. ### Claim 8 (depends on 7) The CRM of claim 7, wherein the second communication path is established in response to receiving instructions from the network device. ### Claim 9 (depends on 7) The CRM of claim 7, wherein the one or more services comprise at least one of: filtering, firewalling, authentication, virus detection, and deep packet inspection. ### Claim 10 A system comprising: a network device including one or more hardware processors; the system being configured for performing operations comprising: forwarding, at a network device on a first communication path between a first network node and a second network node, data traffic from (i) a first client communicatively coupled with the first network node toward (ii) a second client communicatively coupled with the second network node; instructing at least one of the first network node and the second network node to establish a second communication path, that does not include the network device, for transmitting at least a portion of the data traffic that is not subject to services by the network device; wherein subsequent to establishing the second communication path, both the first communication path and the second communication path are concurrently used for transmissions between the first client and the second client, wherein: (a) the first communication path comprising the network device is used for transmitting a first portion of the data traffic, from the first client to the second client, that is subject to one or more services by the network device; and (b) the second communication path, that does not include the network device is used for transmitting a second portion of the traffic, from the first client to the second client, that is not subject to one or more services by the network device. ### Claim 11 (depends on 10) The system of claim 10, wherein the instructing operation is performed in response to determining that the first network node and the second network node are associated with a same controller. ### Claim 12 (depends on 11) The system of claim 11, wherein the same controller is the network device that performs the instructing operation. ### Claim 13 (depends on 10) The system of claim 10, wherein the instructing operation is performed in response to determining that the first network node is associated with a first controller in a particular set of controllers and that the second network node is associated with a second controller of the same particular set of controllers. ### Claim 14 (depends on 10) The system of claim 10, wherein the instructing operation is performed based on one or more characteristics associated with the data traffic. ### Claim 15 (depends on 10) The system of claim 10, wherein the one or more services comprise one or more of filtering, firewalling, authentication, virus detection, and deep packet inspection by the network device. ### Claim 16 A system comprising: a first network node comprising a hardware processor; the system being configured for performing operations comprising: establishing, between the first network node and a second network node, a first communication path for transmitting data, the first communication path comprising a network device; establishing, between the first network node and a second network node, a second communication path for transmitting data, the second communication path not including the network device; concurrently using the first communication path and the second communication path for transmitting data between a first client device and a second client device by: for each particular subset of the data that is (a) received at the first network node from the first client device and (b) addressed to the second client device communicatively coupled with the second network data: determining whether the particular subset of data is subject to one or more services by the network device; responsive to determining that the particular subset of data is subject to the one or more services by the network device, transmitting the particular subset of data toward the second network node on the first communication path comprising the network device; responsive to determining that the particular subset of data is not subject to the one or more services by the network device, transmitting the particular subset of data toward the second network node on the second communication path not including the network device. ### Claim 17 (depends on 16) The system of claim 16, wherein the second communication path that does not include the network device is established in response to receiving instructions from the network device. ### Claim 18 (depends on 16) The system of claim 16, wherein the one or more services comprise at least one of: filtering, firewalling, authentication, virus detection, and deep packet inspection.