TCP proxying of network sessions mid-flow

An intermediate network device positioned between a client device and a server device, the intermediate network device comprising:

• a plurality of network interfaces configured to send packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device of an established network session after a synchronization (SYN) packet, a SYN-ACK (acknowledgement) packet, and an ACK packet of the established network session have been exchanged between the client device and the server device, and receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the established network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the established network session;
• and
• a processor configured to initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number, and to act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.

A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor of an intermediate network device to:

• send packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device of an established network session after a synchronization (SYN) packet, a SYN-ACK (acknowledgement) packet, and an ACK packet of the established network session have been exchanged between the client device and the server device;
• after sending the packets, receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the established network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the established network session;
• initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number;
• and
• act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.

A system comprising:

• a primary network device configured to receive a synchronization (SYN) packet from a client device of a network session, a SYN-ACK (acknowledgement) packet from a server device of the network session, and an ACK packet from the client device;
• and
• a backup network device configured to receive data of the network session when the primary network device is no longer active after receiving the SYN packet, the SYN-ACK packet, and the ACK packet of the network session, wherein the backup network device is configured to send packets that advertise a transmission control protocol (TCP) window size of zero bytes to the client device and the server device, after sending the packets, receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the network session, initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number, and act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.