Patent ID: 8650632

Claim:
A method in a computing system for proxying network traffic for a particular network application between a pair of nodes including a first node and a second node, the method comprising: in a security facility operating on a processor of an intermediate node computing device, for packets received from either node of the pair: maintaining sequence information pertaining to each of a plurality of connections, the sequence information comprising sequence indicators from a perspective of the first node and sequence indicators from a perspective of the second node; filtering packets to be proxied under a set of policies; associating packets to be proxied with connections to which they belong; reordering the packets to be proxied for the respective connections to which they belong using the sequence information of the respective connections; performing analysis specific to the particular application on packet data of the packets to be proxied to determine whether the packet data is permissible; if it is determined that the packet data is not permissible, modifying the packet data to make the packet data permissible before the packet data is passed to its destination; and creatin one or more remediated packets contain in the modified packet data, the one or more remediated packets comprising sequence indicators from the perspective of a destination node, wherein the destination node is one of the first node and the second node and wherein the sequence indicators are based on the sequence information such that the modifying of the packet data is transparent to the first node and the second node.