Network packet inspection flow management
View Patent ↗Deep packet inspection is performed on packets in a network intrusion prevention system. A processing priority may be assigned to a packet based on characteristics such as the protocol type of the packet. Higher-priority packets may be processed before lower-priority packets or otherwise given preferential processing treatment. Deep packet inspection may be performed on the packet, and the processing priority of the packet may be changed based on the amount of time required to complete inspection of the packet. For example, the processing priority of the packet may be lowered if inspection of the packet takes longer than a predetermined time threshold. Furthermore, inspection of such packets may be suspended and either terminated or resumed at a subsequent time.
1. A computer-implemented method comprising:
(A) dequeueing a first packet from a first packet inspection queue;
(B) applying load balancing to a first network packet flow to produce a plurality of network packet flows, wherein a first one of the plurality of network packet flows includes the first packet;
(C) providing the plurality of network packet flows to a plurality of deep packet inspection engines, comprising providing the first one of the plurality of network packet flows to a first one of the plurality of deep packet inspection engines;
(D) queuing packets, including the first packet, in the first one of the plurality of network packet flows onto a packet inspection queue associated with the first one of the plurality of deep packet inspection engines;
(E) applying deep packet inspection to the first packet; and
(F) if deep packet inspection of the first packet is not completed within a predetermined maximum amount of time, then:
(1) suspending deep packet inspection of the first packet.
2. The method of claim 1 , further comprising:
(G) forwarding the first packet toward its destination if deep packet inspection of the first packet is completed within a predetermined maximum amount of time.
3. The method of claim 1 , wherein (F) further comprises:
(2) receiving a second packet;
(3) applying deep packet inspection to the second packet; and
(4) after (3), resuming deep packet inspection of the first packet.
4. The method of claim 3 , wherein (F) further comprises:
(5) before (3), queuing the first packet on the first packet inspection queue; and
wherein (F)( 4 ) comprises dequeueing the first packet from the first packet inspection queue before resuming deep packet inspection of the first packet.
5. The method of claim 3 , wherein (F)( 2 ) comprises saving a state of the deep packet inspection of the first packet, and wherein (F)( 4 ) comprises restoring the state of the deep packet inspection of the first packet before resuming deep packet inspection of the first packet.
6. The method of claim 1 , wherein (F) further comprises:
(2) dropping the first packet.
7. The method of claim 1 , wherein (F) further comprises:
(2) forwarding the first packet toward its destination.
8. The method of claim 1 , further comprising:
(G) before (E), identifying a state of the first packet indicating a first processing priority;
wherein (E) comprises applying deep packet inspection to the first packet according to the first processing priority; and
wherein (F) further comprises:
(2) updating the state of the first packet to indicate a second processing priority that is lower than the first processing priority; and
(3) applying deep packet inspection to the first packet according to the second processing priority.
9. The method of claim 1 , wherein the predetermined maximum amount of time comprises about 100 microseconds.
10. A computer-implemented method comprising:
(A) dequeueing a first packet from a first packet inspection queue;
(B) applying load balancing to a first network packet flow to produce a plurality of network packet flows, wherein a first one of the plurality of network packet flows includes the first packet;
(C) providing the plurality of network packet flows to a plurality of deep packet inspection engines, comprising providing the first one of the plurality of network packet flows to a first one of the plurality of deep packet inspection engines;
(D) queuing packets, including the first packet, in the first one of the plurality of network packet flows onto a packet inspection queue associated with the first one of the plurality of deep packet inspection engines;
(E) applying deep packet inspection to the first packet according to a first processing priority indicated by a first state of the first packet;
(F) if deep packet inspection of the first packet is not completed within a first predetermined maximum amount of time, then:
(1) changing the first state of the first packet to indicate a second processing priority that is lower than the first processing priority.
11. The method of claim 10 , wherein (E) comprises applying deep packet inspection to the first packet in a first deep packet inspection queue having the first processing priority, wherein (F)(1) comprises moving the first packet to a second deep packet inspection queue having the second processing priority, and wherein the method further comprises:
(G) after (F), if there is a second packet in the first deep packet inspection queue, then applying deep packet inspection to the second packet;
(H) otherwise, applying deep packet inspection to the first packet in the second deep packet inspection queue.
12. The method of claim 10 , wherein (F) further comprises:
(2) before (F)(1), suspending deep packet inspection of the first packet; and
wherein (H) comprises resuming the suspended deep packet inspection of the first packet.
13. The method of claim 10 , further comprising:
(G) applying deep packet inspection to the first packet according to the second processing priority;
(H) if deep packet inspection of the first packet according to the second processing priority is not completed within a second predetermined maximum amount of time, then:
(1) changing the first state of the first packet to indicate a third processing priority that is lower than the second processing priority.
14. The method of claim 10 , wherein (E) comprises using a first processor associated with the first processing priority to apply deep packet inspection to the first packet; and
wherein (F)(1) comprises changing the first state of the first packet to indicate a second processing priority associated with a second processor.
15. The method of claim 10 , wherein (E) comprises using one of a first plurality of processors associated with the first processing priority to apply deep packet inspection to the first packet; and
wherein (F)(1) comprises changing the first state of the first packet to indicate a second processing priority associated with a second plurality of processors that is smaller in number than the first plurality of processors.
16. A network intrusion prevention system comprising:
a memory storing machine readable instructions, the machine readable instructions comprising code to:
dequeue a first packet from a first packet inspection queue;
apply load balancing to a first network packet flow to produce a plurality of network packet flows, wherein a first one of the plurality of network packet flows includes the first packet;
provide the plurality of network packet flows to a plurality of deep packet inspection engines, comprising providing the first one of the plurality of network packet flows to a first one of the plurality of deep packet inspection engines;
queue packets, including the first packet, in the first one of the plurality of network packet flows onto a packet inspection queue associated with the first one of the plurality of deep packet inspection engines;
apply a deep packet inspection to the first packet; and
if the deep packet inspection of the first packet is not completed within a predetermined maximum amount of time, suspend the deep packet inspection of the first packet; and
a processor to execute the machine readable instructions.