Patent ID: 7561574

Claim:
A system for filtering packets transmitted between a first router and a second router, comprising: a first router operable to: receive a packet; determine whether to send the packet into a first tunnel based on an interface on which the first router received the packet; encapsulate the packet; and transmit the encapsulated packet to a packet filter through the first tunnel; a packet filter operable to: receive the encapsulated packet through the first tunnel with a first thread associated with an agent application executed by the packet filter; de-encapsulate the encapsulated packet with the first thread; receive, with the agent application executed by the packet filter, a signature from a remote management application associated with the agent; determine whether the de-encapsulated packet is undesirable based on a comparison between the received signature and the de-encapsulated packet; and in response to determining that the de-encapsulated packet is not undesirable, encapsulate, with a second thread associated with the agent application, the de-encapsulated packet and transmit, with the second thread, the re-encapsulated packet to a second router through a second tunnel; and the second router operable to receive the re-encapsulated packet from the second tunnel and to de-encapsulate the re-encapsulated packet.