Abstract: Systems and methods for a cloud state engine are provided. According to one embodiment, a query pertaining to state information associated with a packet to be processed by a first packet processing device of multiple packet processing devices associated with a distributed security environment is received by a centralized state engine running on a computing device associated with the distributed security environment. The state information associated with the packet influences how the packet is to be processed by the first packet processing device. Responsive to the query, the state information is identified by the centralized state engine by processing the received query with reference to a state database containing state information for multiple packets. The identified state information is provided to the first packet processing device by generating a response to the query containing the identified state information.

Abstract: Systems and methods for a cloud state engine are provided. According to one embodiment, a query pertaining to state information associated with a packet to be processed by a first packet processing device of multiple packet processing devices associated with a distributed security environment is received by a centralized state engine running on a computing device associated with the distributed security environment. The state information associated with the packet influences how the packet is to be processed by the first packet processing device. Responsive to the query, the state information is identified by the centralized state engine by processing the received query with reference to a state database containing state information for multiple packets. The identified state information is provided to the first packet processing device by generating a response to the query containing the identified state information.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, reputation information regarding observed senders of Internet Protocol (IP) version 6 (IPv6) packets and packet fragments is maintained by a traversing device based on conformity or nonconformity of extension headers contained within the IPv6 packets with respect to a set of security checks performed by the traversing device. When an IPv6 packet or packet fragment is received from a particular source IP address indicated by the reputation information to be associated with one or more nonconformity issues, then dropping, rate limiting or quarantining, by the traversing device, the IPv6 packet or the packet fragment.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, a traversing device receives an Internet Protocol (IP) version 6 (IPv6) packet or packet fragment. One or more security checks are applied to extension headers of the IPv6 packet or packet fragment. If a security check of the one or more security checks is determined to be violated, then one or more appropriate countermeasures are identified and performed.

Abstract: Methods and systems for selectively blocking, allowing and/or reformatting IPv6 headers by traversing devices are provided. According to one embodiment, a traversing device receives an Internet Protocol (IP) version 6 (IPv6) packet or packet fragment. One or more security checks are applied to extension headers of the IPv6 packet or packet fragment. If a security check of the one or more security checks is determined to be violated, then one or more appropriate countermeasures are identified and performed.