Patent ID: 7970899

Claim:
An integrated data flow packet admission and traffic management apparatus deployed between a local area network and a wide area network, the apparatus comprising: a non-statutory machine readable storage, digital electronic circuitry, and processors; a security engine, the security engine coupled to, a traffic management engine, both the security engine and the traffic management engine coupled to a policy table, and the traffic management engine further coupled to a network interface; the security engine comprising a classification component coupled to the network interface, whereby classification is only performed once; and the classification component coupled to the traffic management engine; a connection table coupled to the classification component, wherein said connection table comprises an information store of data to match an incoming packet with an extant admitted connection, and wherein the security engine comprises a data flow identification logic circuit, wherein a data flow is one of an extant admitted connection or a new connection, wherein said data flow identification logic circuit identifies a first packet of a new connection, and causes a drop or deny directive to said first packet of a new connection when an additional admission of said new connection to the connection table would exceed available bandwidth.