Patent ID: 7808897

Claim:
A computer-implemented method for providing intrusion protection for a unique packet flow of network data traffic, comprising the steps of: receiving at a switch a first portion of the unique packet flow; transmitting a congestion message to an intrusion prevention system in response to a table of packet flow information on the switch approaching its maximum capacity and transmitting a list of one or more packet flows to the intrusion prevention system that can be deleted from the table; determining at the switch whether a second portion of the unique packet flow has previously been received at the switch; in response to determining that the second portion of the unique packet flow has not been received at the switch, analyzing the first portion of the unique packet flow at the intrusion prevention system; and in response to determining that the second portion of the unique packet flow has been received at the switch, checking a value of a single status field corresponding to the unique packet flow, and based on the value, performing one of: blocking the first portion of the unique packet flow at the switch without communicating information relating to the unique packet flow to a security device; and transmitting the first portion of the unique packet flow from the switch to its intended destination without communicating information relating to the unique packet flow to the security device.