Patent ID: 8339959

Claim:
A network router comprising: a plurality of interfaces configured to send and receive packets; a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network; a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding plane comprising a switch fabric to forward the packets to the interfaces based on the selected next hops; and a security plane configured to apply security services to the packets, wherein the forwarding plane includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the security plane for application of the security services, and wherein the security plane processes the packets received from the forwarding plane and, based on the processing of the packets received from the forwarding plane, outputs commands to the forwarding plane directing the forwarding plane to dynamically install at least one filter within the forwarding plane to dynamically configure the flow control module for processing packets subsequently received from the network.