Patent ID: 8095683

Claim:
A system comprising: a first network device in a network, the first network device including: a destination port; and a packet processing hardware module that is configured to: receive, from a user, information associated with the destination port that is to be configured for processing packets that are to be dropped; configure the destination port for receiving packets that are to be dropped, wherein the destination port is configured to forward a copy of the packets to an external network analyzer in the network that is connected to the destination port; receive packets for transmitting to another network device; determine that one or more first packets included in the received packets are to be dropped; responsive to determining that one or more first packets are to be dropped, forward the one or more first packets to the destination port while transmitting a remainder of the received packets to the another network device; generate at the destination port a copy of each packet in the one or more first packets using extended port mirroring; forward, using the destination port, the copy of each packet to the external traffic analyzer, wherein the external traffic analyzer is configured for determining a reason for dropping the one or more first packets and determining an extent of a loss of information due to dropping the one or more first packets by examining the copy of each packet; upon forwarding to the external traffic analyzer the copy each packet, drop the one or more-first packets; receive, from the external network analyzer, information of an analysis regarding dropping the one or more first packets; and responsive to receiving the information of the analysis, identify a problem in firewall rules and security policies in the first network device, wherein the problem is a reason for dropping the one or more first packets, and wherein the problem is caused by a mismatch between the firewall rules and the security policies.