Patent ID: 7797406

Claim:
A data processing apparatus, comprising: a plurality of network interfaces that are coupled to a data network for receiving one or more packets therefrom and sending one or more packets thereto; one or more processors; a switching system coupled to the one or more processors and packet forwarding logic, wherein the switching system and packet forwarding logic are configured to receive packets on a first network interface, determine a second network interface on which to send the packets, and to send the packets on the second network interface; a computer-readable storage medium recorded with one or more message classification rules and a mapping of message classification values to network-level QoS values, wherein each of the message classification rules specifies one or more application-level attributes and one of the message classification values; application QoS logic which when executed by the one or more processors is operable to cause: receiving an application-layer message encapsulated in one or more data packets according to an application-layer protocol; wherein the application-layer message communicates application-level information between applications; extracting the application-layer message based at least in part on the application-layer protocol; matching one or more application-level attributes of the application-layer message to the message classification rules; wherein the one or more application-level attributes comprise a status of at least one of an update to a threat prevention application or a security patch to an application on a machine that generated the application-layer message; determining a message classification value of the application-layer message based at least in part on the matching; selecting one of the network-level QoS values using the mapping and based at least in part on the determined message classification value; marking a network-level header of the one or more data packets based at least in part on the selected QoS value.