Attribute enhancement for handling network packet traffic between micro segmented guests

1. A method of enhancing attributes for micro segmentation, the method comprising:

receiving a plurality of attributes from a user, wherein the plurality of attributes describes first network packet traffic that should be handled in a first manner and include attributes in a layer of the first network packet traffic lower than an application layer;

processing network packet traffic to identify the first network packet traffic using the plurality of attributes;

while processing the network packet traffic, identifying one or more additional attributes shared among the first network packet traffic, wherein the one or more additional attributes comprise attributes in the application layer of the first network packet traffic;

adding at least a portion of the one or more additional attributes to the plurality of attributes; and

after adding at least the portion of the one or more additional attributes to the plurality of attributes, continuing to process the network packet traffic to identify the first network packet traffic using the plurality of attributes.

2. The method of claim 1 , further comprising:

presenting the one or more additional attributes to the user; and

receiving a selection from the user indicating at least the portion of the one or more attributes.

3. The method of claim 1 , wherein the first network packet traffic is associated with one or more applications.

4. The method of claim 3 , wherein the plurality of attributes, when received from the user, includes an application identifier for each of the one or more applications.

5. The method of claim 4 , wherein the application identifier comprises an identifier of one or more protocols used for the first network packet traffic, wherein one or more protocols include one or more of Secure Sockets Layer (SSL), Secure Shell (SSH), Domain Name System (DNS) protocol, and Dynamic Host Configuration Protocol (DHCP).

6. The method of claim 5 , wherein the one or more additional attributes include one or more of a cipher suite and a security certificate.

7. The method of claim 1 , further comprising:

using a portion of the one or more additional attributes to identify second network packet traffic that should be handled in a second manner different than the first manner.

8. The method of claim 7 , wherein the first manner comprises allowing passage through a network firewall and the second manner comprises denying passage through the network firewall.

9. A system for enhancing attributes for micro segmentation, the system comprising:

one or more computer readable storage media;

a processing system, comprising processing circuitry, operatively coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

receive a plurality of attributes from a user, wherein the plurality of attributes describes first network packet traffic that should be handled in a first manner and include attributes in a layer of the first network packet traffic lower than an application layer;

process network packet traffic to identify the first network packet traffic using the plurality of attributes;

while the network packet traffic is processed, identify one or more additional attributes shared among the first network packet traffic, wherein the one or more additional attributes comprise attributes in the application layer of the first network packet traffic;

add at least a portion of the one or more additional attributes to the plurality of attributes; and

after at least the portion of the one or more additional attributes is added to the plurality of attributes, continue to process the network packet traffic to identify the first network packet traffic using the plurality of attributes.

10. The system of claim 9 , wherein the program instructions further direct the processing system to:

present the one or more additional attributes to the user; and

receive a selection from the user indicating at least the portion of the one or more attributes.

11. The system of claim 9 , wherein the first network packet traffic is associated with one or more applications.

12. The system of claim 11 , wherein the plurality of attributes, when received from the user, includes an application identifier for each of the one or more applications.

13. The system of claim 12 , wherein the application identifier comprises an identifier of one or more protocols used for the first network packet traffic, wherein one or more protocols include one or more of Secure Sockets Layer (SSL), Secure Shell (SSH), Domain Name System (DNS) protocol, and Dynamic Host Configuration Protocol (DHCP).

14. The system of claim 13 , wherein the one or more additional attributes include one or more of a cipher suite and a security certificate.

15. The system of claim 9 , wherein the program instructions further direct the processing system to:

use a portion of the one or more additional attributes to identify second network packet traffic that should be handled in a second manner different than the first manner.

16. The system of claim 15 , wherein the first manner comprises allowing passage through a network firewall and the second manner comprises denying passage through the network firewall.