Distributed virtual security appliance and flow-based forwarding system using virtual machines

A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, comprising:

• receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability;
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• and
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system;
• wherein at least some of the virtual machines have respective databases associated therewith, and the method further comprises storing data regarding the first packet at one of the databases that is associated with the identified second virtual machine.

A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, comprising:

• receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability;
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system;
• creating a packet processing session based at least in part on the first packet, the packet processing session representing a packet processing plan;
• and
• storing the packet processing session in a first session database associated with the first virtual machine at which the first packet is received;
• wherein the packet processing session is also stored in a second session database for another one of the virtual machines at which the first packet is egressed.

A network system, comprising:

• a plurality of virtual machines that are communicatively connected to each other;
• wherein a first virtual machine of the plurality of virtual machines is configured to receive a first packet from a network through an interface and has session processing capability;
• and
• wherein the first virtual machine is configured for:
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• and
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines;
• wherein the network system further comprises respective databases associated with at least some of the virtual machines, wherein packets and/or information regarding the packets are stored among the databases in a distributed manner.

A network system, comprising:

• a plurality of virtual machines that are communicatively connected to each other;
• wherein a first virtual machine of the plurality of virtual machines is configured to receive a first packet from a network through an interface and has session processing capability;
• and
• wherein the first virtual machine is configured for:
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• and
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines;
• and
• wherein the network system further comprises respective databases associated with at least some of the virtual machines, wherein one of the databases that is associated with the identified second virtual machine is configured for storing data regarding the first packet.

A network system, comprising:

• a plurality of virtual machines that are communicatively connected to each other;
• wherein a first virtual machine of the plurality of virtual machines is configured to receive a first packet from a network through an interface and has session processing capability;
• and
• wherein the first virtual machine is configured for:
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• and
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines;
• wherein one of the virtual machines is configured for creating a packet processing session based at least in part on the first packet, the packet processing session representing a packet processing plan;
• wherein the network system further comprises a first session database for storing the packet processing session, the first session database associated with the first virtual machine at which the first packet is received;
• and
• wherein the network system further comprises a second session database for storing the packet processing session, the second session database associated with another one of the virtual machines at which the first packet is egressed.

A network system, comprising:

• a plurality of virtual machines that are communicatively connected to each other;
• wherein a first virtual machine of the plurality of virtual machines is configured to receive a first packet from a network through an interface and has session processing capability;
• and
• wherein the first virtual machine is configured for:
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• and
• using the calculated first value to identify a second virtual machine of the plurality of virtual machines;
• wherein one of the virtual machines is configured for creating a packet processing session based at least in part on the first packet, the packet processing session representing a packet processing plan;
• and
• wherein the first packet is egressed at a third virtual machine, and wherein the packet processing session is stored in the first virtual machine at which the first packet is received, and in the third virtual machine at which the first packet is egressed.

A network system, comprising:

• a plurality of machines comprising a first virtual machine and a second virtual machine that are configured to communicate with each other;
• wherein the first virtual machine is configured to receive a first packet from a network through an interface and has session processing capability;
• and
• wherein the first virtual machine is configured for:
• calculating a first value using a mathematical algorithm based on one or more information regarding the first packet;
• using the calculated first value to identify the second virtual machine of the plurality of machines;
• and
• a database associated with the second virtual machine and configured to store the first packet, or at least one of the one or more information regarding the first packet.