Patent ID: 8117657

Claim:
A method in a network switch operating within a network, the method comprising: identifying, within traffic flowing through the network switch, potentially harmful traffic constituting a threat to operation of the network by detecting at least two simultaneous connections on a service port of the network switch, wherein a first protocol is used for a first connection on the service port and a second protocol is used for a second connection on the service port, herein the first protocol is different than the second protocol; mirroring the potentially harmful traffic associated with the service port to a separately located security management device via the network, wherein it is not necessary for the traffic flowing thorough the network switch to pass through the security management device to reach a destination as only copies of the potentially harmful traffic are passed to the security management device; redirecting the potentially harmful traffic to the separately located security management device via the network responsive to a threat mitigation policy from the separately located security management device; and reducing network bandwidth consumed by the potentially harmful traffic associated with the service port responsive to receiving the threat mitigation policy from the separately located security management device by blocking the potentially harmful traffic associated with the service port according to the threat mitigation policy.