Patent ID: 7779126

Claim:
A method for propagating filters in a network comprising a first network device and a second network device, said second network device located upstream of said first network device such that network traffic passes through said second network device before arriving at said first network device, the method comprising: generating and installing a first filter at said first network device; sending filter information from said first network device to said second network device; requesting said second network device to install a second filter so that said network traffic is filtered closer to a source of said network traffic, said second filter configured to filter said network traffic forwarded to said first network device without filtering traffic to other downstream nodes; receiving filter statistics from said second network device at said first network device; analyzing said filter statistics and said network traffic received from said second network device at said first network device, refining said first filter based on said analyzed filter statistics, and sending updated filter information to said second network device so that said second network device can refine said second filter installed thereon; and removing said first filter from the first network device and sending a request to said second network device to remove said second filter, if a network flow requiring said filter is no longer present based on said received filter statistics.