Patent ID: 7817549

Claim:
A method for aging network flows in a switch, comprising: receiving, from an Intrusion Prevention System (IPS) device, a new network flow identifier for a new network flow, wherein the new network flow is in addition to a plurality of existing network flows communicatively interfaced through the switch; collecting packet statistics for each of the plurality of existing network flows through the switch, each of the plurality of existing network flows having a corresponding network flow identifier stored in a memory of the switch; prioritizing the plurality of existing network flows based at least in part on the packet statistics collected in view of a dynamic network flow-aging policy, wherein the dynamic network flow-aging policy prioritizes higher volume network flows among the plurality of existing network flows above lower volume network flows among the same plurality of existing network flows; removing a network flow identifier stored in the memory of the switch corresponding to one of the plurality of existing network flows based at least in part on the prioritization of the plurality of existing network flows and the dynamic network flow-aging policy; storing the new network flow identifier for the new network flow in the memory of the switch among the remaining network flow identifiers not removed from the memory of the switch that correspond to the plurality of existing network flows; and forwarding packets associated with any of the plurality of existing network flows having a corresponding network flow identifier stored in the memory of the switch and/or the new network flow having the new network flow identifier stored in the memory of the switch without redirecting the packets to the IPS device.