Patent ID: 7116675

Claim:
A packet transfer apparatus which is connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excludes the illicit packet, comprising: receiving means for receiving a packet from the first network segment; identifier adding means for adding an identifier to the received packet received by said receiving means; a packet hold queue for temporarily holding the received packet having the added identifier; packet analyzing means for determining whether the received packet is a packet related to an illicit access including a known preset operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet; and sent packet holding means for holding a sent packet that was previously sent to the second network segment, before determining whether the received packet relates to the illicit access, for which said packet analyzing means determines that the packet is not the packet related to the received illicit access, wherein in analyzing the received packet, said packet analyzing means looks up the sent packet held by said sent packet holding means and determines whether or not a combination of the received packet and the sent packet includes a factor that causes an operation error when software in the apparatus connected to the second network segment is executed sending means for receiving the identifier output from said packed analyzing means, extracting the received packet having the received identifier from said packed hold queue, and sending the received packet to the second network segment.