Patent ID: 8266267

Claim:
A method comprising: receiving, with an intermediate device, packets carried within a network tunnel that extends from an ingress device of the network tunnel to an egress device of the network tunnel, wherein the packets encapsulate data units for transmission along the network tunnel, and wherein the intermediate device is positioned between the ingress device and the egress device along the network tunnel; extracting the encapsulated data units from the packets with the intermediate device; applying a set of heuristics to the data units to determine whether the data units are encrypted; and based on the determination of whether the data units are encrypted, generating, with the intermediate device, temporary packets from the data units such that the temporary packets are different from the originally received packets, analyzing the data units of the temporary packets with the intermediate device to detect a network attack, and selectively transmitting, with the intermediate device, the originally received packets to the egress device based on the analysis of the temporary packets.