Patent ID: 8661241
Filing Date: 2014-02-25
Classification: H04L

Abstract:
1. A network switch comprising: a plurality of ports configured to receive a plurality of packets transmitted from a network to the network switch; a memory configured to store patterns of the plurality of packets through the network switch; a packet processor comprising a classifier, wherein the classifier is configured to select a subset of the plurality of packets according to (i) contents of the plurality of packets, and (ii) sampling criteria, and wherein the selected subset of the plurality of packets includes selected ones of the plurality of packets; and a first processor separate from the packet processor, wherein the first processor is configured to (i) determine, based on the subset of the plurality of packets, whether the plurality of packets are associated with an attack on the network switch, and (ii) in response to determining the subset of the plurality of packets are not associated with an attack, update the patterns of the plurality of packets through the network switch based on characteristics of the subset of the plurality of packets, wherein the classifier is configured to, prior to the first processor determining whether the plurality of packets are associated with an attack, copy the subset of the plurality of packets to the first processor while maintaining the plurality of packets in the packet processor.