System and method for diverting established communication sessions

1. A method for diverting established communication sessions comprising:

under the control of one or more computer systems configured with executable instructions performable by at least one processor, receiving at least one packet from a communication session, via a network interface;

determining the state of the communication session, via a packet parsing module;

if the state of the communication session is diverted, bridging the at least one packet to a service chain, via a divert chain manager, wherein the divert chain manager is operatively connected to the at least one processor;

if the state of the communication session has been prohibited from being diverted, forwarding the at least one packet to an endpoint, via a fast path module; and

otherwise, if the state of the communication session is a state prior to the divert decision, saving, via a protocol recognition state storage, the at least one packet and determining whether the communication session is a candidate to be diverted to the service chain, via the divert chain manager, wherein determining whether the communication session is a candidate to be diverted to the service chain comprises:

establishing a connection with the service chain;

sending the at least one saved packet to the service chain;

receiving at least one response packet as a response from the service chain;

determining an offset of the at least one response packet associated with the application layer content;

determining whether the at least one response packet has had application layer content identical to or has been modified by the service chain when compared to the at least one saved packet based in part on the offset of the at least one response packet;

if the at least one response packet has been modified, prohibit the communication session from being diverted; and

if the at least one response packet is identical, divert the communication session to the service chain.

2. The method of claim 1 wherein receiving the at least one packet comprises receiving initial set-up packets for the communication session as well as at least one data packet related to the communication session.

3. The method of claim 1 wherein the communication session is a UDP communication session.

4. The method of claim 1 wherein the communication session is a TCP communication session.

5. The method of claim 4 further comprising:

determining whether the at least one packet from the communication session has a timestamp option enabled;

if the timestamp option is enabled, saving a timestamp value and associating the timestamp value to an endpoint; and

mapping a timestamp for the at least one packet received from the service chain to an associated timestamp value of the associated endpoint.

6. The method of claim 1 further comprising:

determining a maximum frame size associated with a packet that can be received by the service chain;

determining a frame size of the at least one packet; and

if the frame size of the at least one packet is greater than the maximum frame size, fragmenting the at least one packet prior to bridging the packet to the service chain.

7. The method of claim 1 further comprising:

establishing a timeout timer with a predetermined threshold timeout time;

starting the timeout timer after sending the at least one packet to the service chain;

determining whether a response is received from the service chain prior to the timer

reaching the predetermined threshold timeout time; and

if no response is received, ending the connection to the service chain and prohibiting the communication session from being diverted.

8. The method of claim 1 wherein diverting the communication session to the service chain further comprises ending the communication session with an endpoint.

9. The method of claim 1 wherein if the response packet has not been modified,

determining whether the saved packed has been sent to an endpoint and if the saved packet has been sent, not forwarding the response packet to the endpoint.

10. A system for diverting established communication sessions comprising:

one or more processors

a memory comprising one or more modules executable by the one or more processors, the one or more modules comprising:

a network interface configured to receive at least one packet from a communication session;

a packet parsing module configured to determine the state of the communication session;

a divert chain manager configured to bridge the at least one packet to a service chain if the state of the communication session is diverted, bridging the at least one packet to a service chain;

a fast path module configured to forward the at least one packet to an endpoint, if the state of the communication session has been prohibited from being diverted, forwarding the at least one packet to an endpoint; and

a protocol recognition state storage configured to save the at least one packet and determining whether the communication session is a candidate to be diverted to the service chain, if the state of the communication session is a state prior to the divert decision, and wherein the divert chain manager is further configured to:

establish a connection with the service chain;

send the at least one saved packet to the service chain;

receive at least one response packet as a response from the service chain;

determining an offset of the at least one response packet associated with the application layer content;

determine whether the at least one response packet has had application layer content identical to or has been modified by the service chain when compared to the at least one saved packet_based in part on the offset of the at least one response packet;

if the at least one response packet has been modified, prohibit the communication session from being diverted; and

if the at least one response packet is identical, divert the communication session to the service chain.

11. The system of claim 10 wherein the network interface is further configured to receive initial set-up packets for the communication session as well as at least one data packet related to the communication session.

12. The system of claim 10 wherein the communication session is a UDP communication session.

13. The system of claim 10 wherein the communication session is a TCP communication session.

14. The system of claim 13 wherein the divert chain manager is further configured to:

determine whether the at least one packet from the communication session has a timestamp option enabled;

if the timestamp option is enabled, save a timestamp value and associating the timestamp value to an endpoint; and

map a timestamp for the at least one packet received from the service chain to an associated timestamp value of the associated endpoint.

15. The system of claim 10 wherein the packet parsing module and divert chain manager are further configured to:

determine a maximum frame size associated with a packet that can be received by the service chain;

determine a frame size of the at least one packet; and

if the frame size of the at least one packet is greater than the maximum frame size, fragment the at least one packet prior to bridging the packet to the service chain.

16. The system of claim 10 wherein the divert chain manager is further configured to:

establish a timeout timer with a predetermined threshold timeout time;

start the timeout timer after sending the at least one packet to the service chain;

determine whether a response is received from the service chain prior to the timer reaching the predetermined threshold timeout time; and

if no response is received, end the connection to the service chain and prohibiting the communication session from being diverted.

17. The system of claim 10 wherein the divert chain manager is further configured to end the communication session with an endpoint.

18. The system of claim 10 wherein the divert chain manager is further configured to determine whether the saved packet has been sent to an endpoint and if the response packet has not been modified and the saved packet has been sent, not forwarding the response packet to the endpoint.