Patent ID: 9503425
Filing Date: 2016-11-22
CPC Classification: H04L

Claim Text:
1. A method for performing deep packet inspection on a plurality of data packets belonging to a flow of data packet, the method comprising: receiving a first packet at a switch; identifying that the first packet belongs to a flow of a plurality of packets; mirroring at least a portion of the first packet to a firewall over a first communication interface at the switch, wherein the portion of the first packet is scanned by a deep packet inspection (DPI) scanner at the firewall; receiving a message from the firewall indicating that the portion of the first packet does not include a threat; sending the first packet to a destination identified by information contained in the first packet over a port at the switch in response to receiving the message from the firewall indicating that the first packet does not include a threat; receiving a second packet at the switch; identifying that the second packet belongs to the flow of the plurality of packets; mirroring, by a hardware processor, at least a portion of the second packet to the firewall over the first communication interface at the switch, wherein the firewall scans the portion of the second packet by a DPI scanner and identifies that the second packet includes a threat; prior to receiving the first packet: setting the switch to an observe mode; receiving a plurality of other packets that are associated with the flow; mirroring, by the hardware processor, at least a portion of each of the plurality of other packets to the firewall; sending each of the other packets to a destination without waiting for a message from the firewall when the switch is set to the observe mode, wherein the firewall collects information from at least one of the other packets received from the switch; and setting the switch to an enforce mode.