Patent ID: 11949659
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 8:
9. An apparatus comprising:
one or more memories;
one or more network interfaces configured to enable network communications; and
one or more processors, wherein the one or more processors are configured to perform operations on behalf of a security device, the operations comprising:
obtaining, via the one or more network interfaces, a first packet of an Internet Protocol packet flow at the security device;
providing the first packet to a firewall of the security device;
obtaining at a classifier of the security device an indication from the firewall that the Internet Protocol packet flow is to be split between a processing entity of the security device and the firewall of the security device such that non-control packets of the Internet Protocol packet flow are to be provided to the processing entity and control packets configured to indicate a potential change in a flow state of the Internet Protocol packet flow are to be provided to the firewall;
storing, in the one or more memories, data that indicates that the non-control packets of the Internet Protocol packet flow are to be provided to the processing entity;
obtaining, via the one or more network interfaces, one or more non-control packets of the Internet Protocol packet flow at the security device;
determining, by comparing at the classifier data contained in the one or more non-control packets of the Internet Protocol packet flow to the data stored in the one or more memories, that the one or more non-control packets of the Internet Protocol packet flow are to be provided to the processing entity;
providing the one or more non-control packets of the Internet Protocol packet flow to the processing entity in response to the determining;
obtaining, via the one or more network interfaces, a control packet of the Internet Protocol packet flow at the security device;
identifying a control flag in the control packet that indicates a potential change in the flow state of the Internet Protocol packet flow;
providing the control packet of the Internet Protocol packet flow to the firewall in response to identifying the control flag in the control packet;
obtaining at the classifier an indication from the firewall that non-control packets of the Internet Protocol packet flow should no longer be provided to the processing entity;
obtaining a non-control packet of the Internet Protocol packet flow at the classifier; and
providing the non-control packet of the Internet Protocol packet flow to the firewall.