Packet classification in a network security device

摘要

Methods and apparatuses are described for inspecting data packets in a computer network. One or more data packets through the network have associated header data and content. One method includes receiving a data packet, examining the data packet to classify the data packet including classifying the data packet using information included in the header and content, determining flow instructions for processing the packet based on both the header information and the content and processing of the packet using the flow instructions.

主权项

1. A method for a network security device comprising: receiving, by a processor of the network security device, a data packet having a header and content; determining whether the data packet is associated with a flow that is known based on both the header information and the content; in the event that the data packet is not associated with a flow that is known: associating a new session identifier with the data packet; determining whether the data packet should be allowed based on the new session identifier; and in the event that the data packet should be allowed, generating a new flow record associated with the data packet, the new flow record including information for the new session identifier associated with the data packet; initially classifying a flow associated with the packet using information included in the header and content; and updating the initial classification of the flow based on a processing of one or more packets of the flow, wherein the processing includes one or more of content based protocol decoding, content based object extraction, or content based pattern matching.