Patent ID: 8861369

Claim:
A method, comprising: selectively passing a network packet from an Internet Protocol kernel module to a filter upon determining that at least one filter hook is registered in the filter, wherein the Internet Protocol kernel module processes the network packet according to layer 3 Internet Protocol processing by using a plurality of layer 3 processes; re-directing the network packet to a virtual interface upon determining the network packet is a member of a class of packets specified by the filter hook, wherein re-directing the network packet occurs during layer 3 Internet Protocol processing of the network packet and occurs according to the filter hook that is inserted between the plurality of layer 3 processes that perform the layer 3 Internet Protocol processing, wherein the plurality of layer 3 processes are processes for performing a plurality of different layer 3 services, and wherein re-directing the network packet includes copying the network packet from the filter by the virtual interface and providing the network packet to at least one application; and releasing the network packet for additional layer 3 processing by (i) sending the network packet to the filter, and (ii) selectively providing the network packet to the Internet Protocol kernel module to resume processing upon determining there are no additional filter hooks registered in the filter, wherein the plurality of different layer 3 services include processes in addition to filtering.