Traffic data pre-filtering

摘要

A network appliance includes a first and second compliance checker and an action identifier. Each compliance checker includes a first and second lookup operator. Traffic data is received by the network appliance. A field within the traffic data is separated into a first and second subfield. The first lookup operator performs a lookup operation on the first subfield of the traffic data and generates a first lookup result. The second lookup operator performs a lookup operation on the second subfield of the traffic data and generates a second lookup result. A compliance result is generated by a lookup result analyzer based on the first and second lookup results. An action is generated by an action identifier based at least in part on the compliance result. The action indicates whether or not additional inspection of the traffic data is required. The first and second lookup operators may perform different lookup methodologies.

主权项

1. A method, comprising:
(a) receiving traffic data onto a networking appliance; (b) separating a field within the traffic data into multiple subfields, wherein the separating is performed by a network flow processor; (c) performing a lookup on each subfield in parallel, wherein each lookup generates a lookup result, wherein the parallel lookups are performed by a plurality of lookup operators; (d) determining a compliance result based on the multiple lookup results generated in (c); (e) determining an action based at least in part upon the compliance result determined in (d), wherein the network flow processor is an Island-Based Network Flow Processor, wherein the determining of (d) is performed by a lookup result analyzer, and wherein the determining of (e) is performed by an action identifier.