Granted Patent B2

US 12,425,335 · App. 17/943,147 · Granted Sep 23, 2025

Inventors: Ajit Ramachandra Mayya (Saratoga, CA); Parag Pritam Thakore (Los Gatos, CA); Stephen Craig Connors (San Jose, CA); Sunil Mukundan (Chennai, IN); Thomas Harold Speeter (San Martin, CA)

H04L45/306H04L45/38H04L45/42H04L45/745

Abstract

Claims (41)

1. A method of routing data messages through a network defined by a plurality of edge devices deployed at a plurality of sites of an entity and a gateway deployed at a different site than the plurality of sites, the method comprising:

at a first edge device:

receiving a first flow;

performing a deep packet inspection (DPI) operation to identify an application associated with the first flow;

based on the identified application, performing a routing decision to forward the first flow through the network;

wherein edge devices are configured to advertise local subnets to the gateway during an initial tunnel establishment.

2. The method of claim 1 , wherein the routing decision comprises selecting a particular link from a plurality of links for the first flow based on the identified application.

3. The method of claim 1 further comprising storing an application identifier that identifies the application in a local storage for use to process all packets of the first flow.

4. The method of claim 3 further comprising sending the application identifier to a second edge device for the second edge device to use.

5. The method of claim 3 further comprising:

creating a record that associates an Internet Protocol (IP) address and a port number of the first flow with the application identifier;

said record stored in the local storage.

6. The method of claim 5 further comprising sending the record to a second edge device to use to associate a second flow received by the second edge device with the application identifier by matching an IP address and port number of the second flow with the IP address and port number in the record.

7. The method of claim 5 , wherein the IP address and port number are destination IP address and port number of the first flow.

8. The method of claim 5 further comprising:

passing records from the local storage to a set of crowd-sourced participants;

receiving records from local storages of other crowd-sourced participants to use to perform routing decisions.

9. The method of claim 5 further comprising:

at a specified period, requesting a latest version of application routing data from an Orchestrator; and

updating the local storage with the latest version of application routing data from the Orchestrator,

wherein the Orchestrator provides a centralized management of the edge devices.

10. The method of claim 1 , wherein performing DPI comprises passing the first flow to a DPI Engine to perform the DPI operation.

11. A non-transitory machine readable medium storing a program for execution on a first edge device of a network to route data messages through a network defined by a plurality of edge devices deployed at a plurality of sites of an entity, the program comprising sets of instructions for:

receiving a first flow;

performing a deep packet inspection (DPI) operation to identify an application associated with the first flow;

based on the identified application, performing a routing decision to forward the first flow through the network;

sending the application identifier to a second edge device for the second edge device to use.

12. The non-transitory machine readable medium of claim 1 , wherein the routing decision comprises selecting a particular link from a plurality of links for the first flow based on the identified application.

13. The non-transitory machine readable medium of claim 11 further comprising:

creating a record that associates an Internet Protocol (IP) address and a port number of the first flow with the application identifier;

said record stored in the local storage.

14. The non-transitory machine readable medium of claim 13 further comprising sending the record to a second edge device to use to associate a second flow received by the second edge device with the application identifier by matching an IP address and port number of the second flow with the IP address and port number in the record.

15. The non-transitory machine readable medium of claim 13 , wherein the IP address and port number are destination IP address and port number of the first flow.

16. The non-transitory machine readable medium of claim 13 further comprising:

passing records from the local storage to a set of crowd-sourced participants;

receiving records from local storages of other crowd-sourced participants to use to perform routing decisions.

17. The non-transitory machine readable medium of claim 13 further comprising:

at a specified period, requesting a latest version of application routing data from an Orchestrator; and

updating the local storage with the latest version of application routing data from the Orchestrator,

wherein the Orchestrator provides a centralized management of the edge devices.

18. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing DPI comprises a set of instructions for passing the first flow to a DPI Engine to perform the DPI operation.

Assignments (2)

Continuity (5)

References Cited (400)