Packet processing in a multiple processor system

• US 8,798,065 B2
• Filed: 09/14/2012
• Issued: 08/05/2014
• Est. Priority Date: 08/02/2005
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Zuk, Nir, Mao, Yu Ming
• Primary Examiner(s): CHO, HONG SOL
• Application Number:
  US13/617,729
• Publication Number:
  US 20130074184A1
• Time in Patent Office: 690 Days
• Field of Search: 370/389, 370/392, 370/394, 370/400, 370/401, 370/474
• US Class Current: 370/392
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Packet processing is provided in a multiple processor system including a first processor to processing a packet and to create a tag associated with the packet. The tag includes information about the processing of the packet. A second processor receives the packet subsequent to the first processor and processes the packet using the tag information.

Claims

1. A method comprising:

receiving, by a first processor and from a second processor, a packet;

processing, by the first processor, the packet using first information,

the first information being based on a result of the second processor processing the packet;

determining, by the first processor and based on processing the packet, whether the packet is to be processed by a third processor,

the third processor being different than the first processor and the second processor;

when the packet is to be processed by the third processor;

generating, by the first processor, second information that is based on a result of the first processor processing the packet,

the second information including;

session information identifying a session,

 

the packet belonging to the session, and

an instruction for the third processor to determine whether the packet is associated with an attack; and

transmitting, by the first processor, the packet for processing of the packet by the third processor,

the second information being used by the third processor to process the packet; and

when the packet is not to be processed by the third processor, performing at least one of a plurality of actions,

the plurality of actions including;

dropping, by the first processor, the packet, or

generating, by the first processor, an alarm relating to the packet.

2. The method of claim 1, where the second information further includes an instruction relating to the third processor processing the packet, and

where the third processor is to process the packet based on the instruction relating to the third processor processing the packet.

3. The method of claim 2, where the second information further includes an instruction to transmit the packet to a fourth processor after the third processor processes the packet, and

where the third processor, after processing the packet, is to transmit the packet to the fourth processor based on the instruction to transmit the packet to the fourth processor.

4. The method of claim 1, where determining whether the packet is to be processed by the third processor includes:

determining that the packet is associated with the attack, and

determining that the packet is not to be processed by the third processor based on determining that the packet is associated with the attack, and

where performing the at least one of the plurality of actions includes;

dropping the packet after determining that the packet is not to be processed by the third processor.

5. The method of claim 1, where determining whether the packet is to be processed by the third processor includes:

determining a likelihood that the packet is associated with the attack; and

determining that the packet is to be processed by the third processor based on the likelihood that the packet is associated with the attack.

6. The method of claim 5, where the second information further includes an instruction for the third processor to drop the packet when the third processor determines that the packet is associated with the attack.

7. The method of claim 1, where transmitting the packet includes:

transmitting the first information, the packet, and the second information.

8. The method of claim 1, the plurality of actions further including:

generating a log relating to the packet, or

holding the packet.

9. The method of claim 1, where the first processor and the third processor are included on a single integrated circuit or a single printed circuit board, or

where:

the first processor is included on a first single integrated circuit or a first single printed circuit board, and

the third processor is included on a second single integrated circuit, different than the first integrated circuit, or a second single printed circuit board different than the first single printed circuit board.

10. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by a first processor, cause the first processor to receive a packet from a second processor;

one or more instructions which, when executed by the first processor, cause the first processor to process the packet using first information,

the first information being based on a result of the second processor processing the packet;

one or more instructions which, when executed by the first processor, cause the first processor to determine, based on processing the packet, whether the packet is to be further processed;

one or more instructions which, when executed by the first processor, cause the first processor to generate, when the packet is to be further processed, second information that is based on a result of the first processor processing the packet,

the second information including;

session information identifying a session to which the packet belongs, and

an instruction for a third processor to determine whether the packet is associated with an attack,

the third processor being different than the first processor and the second processor;

one or more instructions which, when executed by the first processor, cause the first processor to transmit the packet for further processing of the packet by the third processor, when the packet is to be further processed,

the second information being used by the third processor to process the packet; and

one or more instructions which, when executed by the first processor, cause the first processor to, when the packet is not to be further processed, one of;

drop the packet,

hold the packet,

generate a log relating to the packet, or

generate an alarm relating to the packet.

11. The non-transitory computer-readable medium of claim 10, where the one or more instructions to determine whether the packet is to be further processed include:

one or more instructions which, when executed by the first processor, cause the first processor to determine a likelihood that the packet is associated with the attack; and

one or more instructions which, when executed by the first processor, cause the first processor to determine that the packet is to be processed by the third processor based on the likelihood that the packet is associated with the attack.

12. The non-transitory computer-readable medium of claim 10, where the second information further includes an instruction for the third processor to drop the packet when the third processor determines that the packet is associated with the attack.

13. The non-transitory computer-readable medium of claim 10, where the second information further includes an instruction for the third processor to drop packets, matching the session, when the third processor determines that the packet is associated with the attack.

14. The non-transitory computer-readable medium of claim 10, where the second information further includes an instruction for the third processor to at least one of hold the packet or generate an alarm relating to the packet when the third processor determines that the packet is associated with the attack.

15. The non-transitory computer-readable medium of claim 10, where the second information further includes an instruction for the third processor to modify content of the packet when the third processor determines that the packet is associated with the attack.

16. The non-transitory computer-readable medium of claim 10, where the first processor includes a firewall processing engine, and

where the third processor includes an intrusion detection engine.

17. A system comprising:

a first processor to;

receive a packet from a second processor,

process the packet using first information,

the first information being based on a result of the second processor processing the packet;

determine, based on processing the packet, whether the packet is to be further processed;

when the packet is to be further processed;

generate second information that is based on a result of the first processor processing the packet,

the second information including;

 

session information identifying a session to which the packet belongs, and

 

an instruction for a third processor to determine whether the packet is associated with an attack, and

cause the packet to be transmitted for further processing of the packet by the third processor,

the third processor being different than the first processor and the second processor, and

the second information being used by the third processor to process the packet; and

when the packet is not to be further processed, at least one of;

drop the packet,

hold the packet,

generate a log relating to the packet, or

generate an alarm relating to the packet.

18. The system of claim 17, further comprising the third processor,

the third processor to:

receive the packet;

process the packet using the second information; and

at least one of;

drop the packet, or

cause the packet to be forwarded to a destination identified by an address of the packet.

19. The system of claim 17, further comprising the third processor,

where the first processor and the third processor are included on a single integrated circuit or a single printed circuit board.

20. The system of claim 17, further comprising the third processor,

where the first processor is included on a first single integrated circuit or a first single printed circuit board, and

where the third processor is included on a second single integrated circuit, different than the first integrated circuit, or a second single printed circuit board different than the first single printed circuit board.

21. The system of claim 17, where, when causing the packet to be transmitted, the first processor is further to:

cause the first information, the second information, and the packet to be transmitted for further processing of the packet by the third processor, or

cause the first information and the packet to be transmitted for further processing of the packet by the third processor without the second information being transmitted.

22. The system of claim 17, where each of the first processor, the second processor, and the third processor is associated with a different one of a firewall processing element, an intrusion detection system, or a network address translation (NAT) element.