Patent ID: 7721084

Claim:
A method of filtering a data packet, comprising providing a first set of filtering rules for filtering tunneled data packets based on outer headers of tunneled data packets only, each tunneled data packet comprising an outer header and an outer payload, the outer payload comprising an inner data packet comprising an inner header and an inner payload, providing a plurality of second sets of filtering rules for filtering inner data packets of tunneled data packets only, each second set of filtering rules being different from the first set of filtering rules, receiving at an intermediate device along a tunnel, a tunneled data packet sent from a first end point of the tunnel and destined to a second end point of the tunnel, the received tunneled data packet comprising an outer header and an outer payload provided at said first end point of said tunnel to be removed at said second end point of the tunnel, said intermediate device being located apart from the first and second tunnel end points, performing a first search, at said intermediate device, only among said first set of filtering rules provided for filtering said received tunneled data packet based on the outer header of said received tunneled data packet, for a first filtering rule containing a value of at least one header field matching to the value of at least one outer header field of said received tunneled data packet, only in response to finding said matching first filtering rule containing the matching value of at least one header field, taking the action defined in the first matching filtering rule of said first set of filtering rules for filtering an inner data packet without involvement of the first and second end points and without interrupting the tunnel at said intermediate device along the tunnel, the defined action filtering an inner data packet further comprising detecting the inner data packet within said received tunneled data packet, selecting among said plurality of said second sets of filtering rules only one second set of filtering rules corresponding to said first matching filtering rule, performing a second search only among said selected second set of filtering rules for a second filtering rule matching the value of at least one field of the inner data packet and without searching among the other unselected ones of said plurality of said second sets of filtering rules, taking the action defined in the matching second filtering rule for filtering the detected inner data packet separately from the filtering of the outer header, and in response to not finding said matching first filtering rule containing the matching value of at least one header field, forwarding said received tunneled data packet from the intermediate device to the second end point of the tunnel without searching any of said plurality of second sets of filtering rules and without filtering the inner data packet.