Patent ID: 8059532

Claim:
An apparatus comprising a control plane; and a network processing unit that: selectively samples received packets of the respective data flows to the control plane; maintains a flow database of flow information entries, each comprising one or more policies and indexed by a hash of one or more data flow attributes comprising one or more client-side attributes and one or more server-side attributes; maintains a triggering cache of flow information entries, comprising a plurality of cached classification policies and indexed by a hash of one or more server-side attributes and no client-side attributes; matches packets of respective data flows to flow information entries in the flow database based on respective client-side and server-side attributes; else match packets of new respective data flows to flow information entries in the triggering cache based on the one or more server-side attributes and not based on the one or more client-side attributes; applies the one or more policies to received packets of respective data flows that match corresponding flow information entries in the triggering cache or the flow database, otherwise apply one or more default policies to received packets of respective data flows according to a current data plane configuration; wherein the control plane processes packets sampled by the network processing unit; and transmits control messages to the network processing unit identifying one or more policies for the respective data flows; wherein one or more of the control messages include indications causing the data plane to add flow information entries in the flow database, and store the one or more policies in the triggering cache in association with the one or more server-side attributes.