Patent ID: 7903655

Claim:
A network device, comprising: a network chip including a number of network ports for receiving and transmitting packets therefrom, and logic to: receive an encapsulated packet diverted using tunnel encapsulation from a path to an original destination by the originating network device; decapsulate the packet, the packet being received from a tunnel connected to an originating network device; identify the originating network device in a memory for the network chip, wherein the originating network device is identified based on tunnel encapsulation information of the packet; mark the packet with a handle associated with the originating network device of the packet using information from an encapsulation header of the packet; store the handle in the memory for the network chip; associate the handle in the memory for the network chip with the originating network device in memory; change a destination address of the packet to an address of a checking functionality to redirect the packet to the checking functionality instead of the original destination of the packet; and forward the marked packet to a checking functionality that detects unwanted network activity.