Patent ID: 8028160

Claim:
A data link layer switch comprising: a first processor; a plurality of ports configured to exchange M packets of data with a network, where M is an integer; a memory configured to store a switch table; and a packet processor that is distinct from the first processor, wherein the packet processor is configured to transfer the M packets of data between the ports according to the switch table, and wherein the packet processor comprises a classifier configured to (i) select N of the M packets of data according to sampling criteria describing the M packets of data without discarding a packet of the M packets and (ii) send N copies of the N selected ones of the M packets of data to the first processor, where N is an integer less than M, wherein the first processor is configured to determine whether an attack upon the data link layer switch has occurred based on the N copies, wherein the classifier is configured to send the N copies to the first processor prior to the data link layer switch determining whether the M packets of data are associated with an attack, wherein the classifier is configured to (i) select the N copies as a representative group of the M packets of data and (ii) transfer the N copies to the first processor prior to threat assessment of the M packets of data by the first processor, wherein the first processor is configured to determine whether the M packets of data are associated with an attack based on the N copies, and wherein the sampling criteria describing the M packets of data comprise at least one of destination addresses of the M packets of data, source addresses of the M packets of data, identifiers of switch interfaces of the data link layer switch receiving the M packets of data into the data link layer switch, identifiers of switch interfaces of the data link layer switch transmitting the M packets of data from the data link layer switch, data rates of the M packets of data, quantities of data in the M packets of data, identifiers of other network devices in paths of the M packets of data, or times of occurrence of the M packets of data wherein the classifier, when selecting the N of the M packets of data, selects only packets that belong to new data flows based on a table of data flows.