Patent ID: 9225647
Filing Date: 2015-12-29
Classification: H04L

Abstract:
1. A computer-implemented method, comprising: receiving, by an inspection module running within a kernel layer of a first host computer, one or more packets of a flow of packets from a source to a destination, wherein the source or the destination is a first virtual machine running on the first host computer; copying one or more of the one or more received packets; forwarding the received packets to the destination, wherein the copying of the one or more of the one or more received packets includes copying the one or more received packets at a plurality of configurable sampling rates to generate a plurality of samples; determining, by the inspection module, from a comparison of a policy against each of the plurality of samples while or after the a copy of the one or more packets are forwarded to the destination, that the flow of packets triggers a policy response; and performing, by the inspection module, the policy response in response to said determination, wherein the policy response has an impact on the flow of packets to or from the first virtual machine.