Back to results
US 9,178,851 B2Granted
High availability security device
AssigneePalo Alto Networks, Inc.
InventorNir Zuk
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for processing a first plurality of packets using one or more processors and maintaining one or more flow records associated with the first plurality of packets, and processing a second plurality of packets without maintaining flow records associated with the second plurality of packets and allowing the second plurality of packets to pass to one or more destinations.
Claims30
A method implemented by a security device, comprising:
- filtering a plurality of packets into a filtered first plurality of packets and a filtered second plurality of packets based on header information of each of the plurality of packets, wherein the filtering the plurality of packets comprises:
- filtering the plurality of packets into the filtered second plurality of packets in response to the header information of the corresponding packets being associated with Domain Name Service (DNS) traffic or a peer-to-peer networking application, wherein the DNS traffic relates to communications with a trusted DNS server, the trusted DNS server being a closely-controlled DNS server, and wherein the peer-to-peer networking application relates to a file download using the peer-to-peer networking application;
- processing the filtered first plurality of packets using one or more processors of the security device and maintaining one or more flow records associated with the filtered first plurality of packets, and
- processing the filtered second plurality of packets using one or more processors of the security device without maintaining flow records associated with the filtered second plurality of packets and allowing the filtered second plurality of packets to pass to one or more destinations, where processing the filtered second plurality of packets includes:
- receiving a second packet;
- determining not to maintain a flow record for a second flow associated with the second packet;
- and
- allowing the second packet to pass to one of the one or more destinations.
5 more elements
A system comprising:
- a non-transitory computer-readable medium including a program product;
- and
- one or more processors configured to interact with the non-transitory computer-readable medium, execute the program product and perform operations comprising:
- filtering a plurality of packets into a filtered first plurality of packets and a filtered second plurality of packets based on header information of each of the plurality of packets, wherein the filtering the plurality of packets comprises:
- filtering the plurality of packets into the filtered second plurality of packets in response to the header information of the corresponding packets being associated with Domain Name Service (DNS) traffic or a peer-to-peer networking application, wherein the DNS traffic relates to communications with a trusted DNS server, the trusted DNS server being a closely-controlled DNS server, and wherein the peer-to-peer networking application relates to a file download using the peer-to-peer networking application;
- processing the filtered first plurality of packets using one or more processors and maintaining one or more flow records associated with the filtered first plurality of packets, and
- processing the filtered second plurality of packets without maintaining flow records associated with the filtered second plurality of packets and allowing the filtered second plurality of packets to pass to one or more destinations, where processing the filtered second plurality of packets includes:
- receiving a second packet;
- determining not to maintain a flow record for a second flow associated with the second packet;
- and
- allowing the second packet to pass to one of the one or more destinations.
8 more elements
A non-transitory computer program product, encoded on a computer-readable storage device, operable to cause data processing apparatus to perform operations comprising:
- filtering a plurality of packets into a filtered first plurality of packets and a filtered second plurality of packets based on header information of each of the plurality of packets, wherein the filtering the plurality of packets comprises:
- filtering the plurality of packets into the filtered second plurality of packets in response to the header information of the corresponding packets being associated with Domain Name Service (DNS) traffic or a peer-to-peer networking application, wherein the DNS traffic relates to communications with a trusted DNS server, the trusted DNS server being a closely-controlled DNS server, and wherein the peer-to-peer networking application relates to a file download using the peer-to-peer networking application;
- processing the filtered first plurality of packets using one or more processors and maintaining one or more flow records associated with the filtered first plurality of packets, and
- processing the filtered second plurality of packets without maintaining flow records associated with the filtered second plurality of packets and allowing the filtered second plurality of packets to pass to one or more destinations, where processing the filtered second plurality of packets includes:
- receiving a second packet;
- determining not to maintain a flow record for a second flow associated with the second packet;
- and
- allowing the second packet to pass to one of the one or more destinations.
5 more elements
Dependencies are inferred from the claim text.