Duplicating packets efficiently within a network security appliance

摘要

A network security appliance uses a switch to switch packets between cores configured for fast path processing and slow path processing. The switch duplicates packets for delivery to the slow path processing cores, eliminating the need for the fast path processing cores to expend processor resources on packet duplication. The switch can use IEEE 802.1ad Q-in-Q VLAN tags in the packet to perform the switching and packet duplication. Slow path processing cores may also broadcast packets to other slow path processing cores via the switch.

主权项

1. A non-transitory machine readable medium with instructions stored thereon, comprising instructions that when executed cause a network security appliance to:
perform in a first core fast path processing on a packet received by the network security appliance; insert by the first core a first virtual local area network tag into the packet; define a first virtual local area network to a switch of the network security appliance, the first virtual local area network associated with the first virtual local area network tag; assign a first plurality of cores to the first virtual local area network associated with the first virtual local area network tag; switch the packet from the first core to the first plurality of cores via the switch based on the first virtual local area network tag; perform slow path processing concurrently in the first plurality of cores; remove the first virtual local area network tag from the packet; insert by a second core a second virtual local area network tag into the packet, wherein the second core is a member of the first plurality of cores; and send the packet from the second core to a second plurality of cores via the switch based on the second virtual local area network tag.