US 8,997,223 B2 · Event aggregation in a distributed processor system

Abstract

A security device for processing network flows includes packet processing cards with packet processors formed thereon where each packet processing card stores local counter values for one or more events and a packet processing manager including global event counters to maintain event statistics for events in the security device. In one embodiment, the packet processing manager stores a copy of the local counter value of an event for each packet processor reporting the event in the counter memory and the global event counter provides a global counter sum value for the event by summing the copies of local counter values in the local memory. In another embodiment, the global counter sum is compared to a threshold value to put the event in a conforming state or non-conforming state. The packet processing manager sends a multicast message to the interested packet processors indicating an event has transitioned to a non-conforming state.

Claims16

Dependent claims

A security device for processing a plurality of network flows, comprising:

one or more packet processing cards, each having one or more packet processors formed thereon, each packet processing card having a data port for receiving and transmitting data packets and a local counter memory, each packet processing card storing local counter values for one or more events in the local counter memory;
and
a packet processing manager comprising global event counters to maintain event statistics for one or more events in the security device, the global event counters being in communication with a counter memory, each global event counter being identified by a counter identifier and being associated with a global threshold value and a global counter sum value,
wherein the packet processing manager stores a copy of a local counter value of an event for each packet processor reporting the event in the counter memory, a global event counter providing a global counter sum value for the event by summing copies of local counter values in the local counter memory.

1 more element

A security device for processing a plurality of network flows, comprising:

one or more packet processing cards, each having one or more packet processors formed thereon, each packet processing card having a data port for receiving and transmitting data packets and a local counter memory, each packet processor storing local counter values for one or more events in the local counter memory;
and
a packet processing manager comprising global event counters to maintain event statistics for one or more events in the security device, each global event counter being identified by a counter identifier and being associated with a global threshold value and a global counter sum value,
wherein when the global counter sum value exceeds the global threshold value for an event, the packet processing manager sends a message to the packet processors on the one or more packet processing cards maintaining local counter values for the event indicating the event has become non-conforming;
and when the global counter sum value is less than the global threshold value for an event, the packet processing manager sends a message to the packet processors on the one or more packet processing cards maintaining local counter values for the event indicating the event has become conforming.

2 more elements

Dependencies are inferred from the claim text.

Event aggregation in a distributed processor system

Life of this patent

Event aggregation in a distributed processor system

Life of this patent

Abstract

Claims16