Network traffic processing system
A system for processing network traffic includes a hardware-accelerated inspection unit to process network traffic in hardware-accelerated inspection mode, and a software inspection unit to process the network traffic in software inspection mode. The software inspection unit processes a connection in in the software inspection mode at least for a consecutive predetermined number of bytes of the connection. The connection may be transitioned to the hardware-accelerated inspection mode if the connection is determined to be clean.
1. A system for processing network traffic in a computer network, the system comprising:
a hardware-accelerated inspection unit to process the network traffic in hardware-accelerated inspection mode, the hardware-accelerated unit comprising an integrated circuit that is customized to inspect the network traffic for signatures; and
a software inspection unit to process the network traffic in software inspection mode, the software inspection unit comprising a processor that executes instructions in memory to inspect the network traffic for signatures,
wherein the software inspection unit processes a connection in the network traffic in the software inspection mode to detect a signature match, and if the connection is determined by the software inspection unit to not have a signature match or a potential signature match for at least a consecutive predetermined number of bytes of the connection, the connection is transitioned to the hardware-accelerated inspection mode for processing by the hardware-accelerated inspection unit,
wherein if the hardware-accelerated inspection unit detects a potential signature match, the connection is transitioned back to the software inspection mode to perform deep packet inspection on the connection.
2. The system of claim 1 , wherein if the software inspection unit determines the connection has a signature match, an action is taken based on the signature match.
3. The system of claim 1 , wherein the hardware-accelerated inspection unit processes the connection at a faster rate than the software inspection unit.
4. The system of claim 1 , wherein in the software inspection mode, the connection is processed by the hardware-accelerated inspection unit and the software inspection unit.
5. The system of claim 1 , wherein in the hardware-accelerated inspection mode, the connection is processed only by the hardware-accelerated inspection unit.
6. The system of claim 1 , wherein all the network traffic received by the system is processed at least by the hardware-accelerated inspection unit.
7. The system of claim 1 , wherein the system is in a standalone network appliance.
8. The system of claim 1 , wherein the system is incorporated into a network switch, a firewall network appliance, a converged security appliance, or a bladed chassis.
9. An intrusion prevention system (IPS) comprising:
an interface to receive network traffic in a computer network and output the network traffic toward its destination if it is determined by the IPS to not have a signature match;
a hardware-accelerated inspection unit to process a connection in the network traffic in hardware-accelerated inspection mode to determine whether the connection has a potential signature match, the hardware-accelerated unit comprising an integrated circuit that is customized to inspect the network traffic for signatures; and
a software inspection unit to process the connection in software inspection mode to determine whether the connection has a signature match, the software inspection unit comprising a processor that executes instructions in memory to inspect the network traffic for signatures,
wherein the software inspection unit processes the connection in the software inspection mode, and if the connection is determined to not have a signature match or a potential signature match for a consecutive predetermined number of bytes of the connection, the connection is transitioned to the hardware-accelerated inspection mode for processing by the hardware-accelerated inspection unit,
wherein if the hardware-accelerated inspection unit determines the connection has a potential signature match, the connection is transitioned back to the software inspection unit to perform additional inspection on the connection.
10. The IPS of claim 9 , wherein if the software inspection unit determines the connection has a signature match, the connection is blocked from being sent out of the interface.
11. The IPS of claim 9 , wherein the hardware-accelerated inspection unit processes the connection at a faster rate than the software inspection unit.
12. A method of processing network traffic comprising:
receiving, on an interface of a network processing system, a connection in a network traffic in a computer network;
processing the connection in a software inspection mode for a predetermined number of bytes of the connection to determine whether the connection has a signature match;
if the connection is determined to not have a signature match or a potential signature match for the predetermined number of bytes, transitioning processing of the connection to a hardware-accelerated inspection mode, wherein connection processing in the hardware-accelerated inspection mode includes inspection of the communication using a custom integrated circuit and is faster than in the software inspection mode; and
if the processing in the hardware-accelerated inspection mode determines the connection has a potential signature match, the connection processing is transitioned back to the software inspection mode.