Patent ID: 8130747

Claim:
A method, comprising, in a cluster of peered network devices, receiving network traffic at a first one of the peered network devices and, upon determining that the network device does not yet have any state information for a traffic flow associated with the network traffic, delaying processing of the network traffic to allow time for the state information associated with the traffic flow to be received from a second one of the peered network devices, the state information including an identification of the traffic flow and a corresponding action to be taken by a member of said cluster upon receipt of the network traffic associated with the traffic flow, wherein the traffic flow is a transmission control protocol (TCP) or a user datagram protocol (UDP) connection and each respective network device maintaining separate tables of traffic flow state information for traffic flows to be bypassed by the respective network device, traffic flows to be intercepted by the respective network device and traffic flows associated with peers of the respective network device the table of traffic flow state information associated with peers of the respective network device being maintained as a hash table divided into two sections a first section thereof being used for traffic flows observed for a first time, and a second section thereof being used for recognized traffic flows associated with the peers of the respective network device.