Abstract: A system and method for routing packets. The method includes receiving a first packet from an intermediate network by a first network interface card (NIC) operatively connected to a host, where the first packet originates from a first remote network, where the first NIC is operatively connected to the intermediate network, and where the first packet, the intermediate network, and the first NIC use a first network protocol. The method further includes classifying, by the first NIC, the first packet based on the first remote network, sending the first packet to a first receive ring in the first NIC, sending the first packet from the first receive ring to a first non-global container, and converting the first packet, using a first converter located in the first non-global container, to obtain a first converted packet, where the first converted packet and the first remote network use a second network protocol.

Abstract: A system and method for routing packets. The method includes receiving a first packet from an intermediate network by a first network interface card (NIC) operatively connected to a host, where the first packet originates from a first remote network, where the first NIC is operatively connected to the intermediate network, and where the first packet, the intermediate network, and the first NIC use a first network protocol. The method further includes classifying, by the first NIC, the first packet based on the first remote network, sending the first packet to a first receive ring in the first NIC, sending the first packet from the first receive ring to a first non-global container, and converting the first packet, using a first converter located in the first non-global container, to obtain a first converted packet, where the first converted packet and the first remote network use a second network protocol.

Abstract: A network interface card (NIC) includes a security association database (SADB) comprising a plurality of security associations (SAs), a cryptographic offload engine configured to decrypt a packet using one of the plurality of SAs, a security policy database (SPD) comprising a plurality of security policies (SPs) and a plurality of filter policies, and a policy engine configured to determine an admittance of the packet using one of the plurality of SPs from the SPD and apply one of the plurality of filter policies to the packet.

Abstract: A method for routing a packet. The method includes receiving the packet from a first network into a network interface card (NIC), where the NIC is operatively connected to a host and the host includes a first virtual network stack and a second virtual network stack. The method further includes sending the packet to a first virtual network stack, where the first virtual network stack includes a first filter, a first network layer, and a first transport layer. In addition, the first filter, the first network layer, and the first transport layer are isolated from the second virtual network stack. If the packet is permitted through the first filter in the first virtual network stack, then the packet is sent to a first virtual NIC.

Abstract: A network interface card (NIC) includes a security association database (SADB) comprising a plurality of security associations (SAs), a cryptographic offload engine configured to decrypt a packet using one of the plurality of SAs, a security policy database (SPD) comprising a plurality of security policies (SPs) and a plurality of filter policies, and a policy engine configured to determine an admittance of the packet using one of the plurality of SPs from the SPD and apply one of the plurality of filter policies to the packet.

Abstract: A method for routing a packet. The method includes receiving the packet from a first network into a network interface card (NIC), where the NIC is operatively connected to a host and the host includes a first virtual network stack and a second virtual network stack. The method further includes sending the packet to a first virtual network stack, where the first virtual network stack includes a first filter, a first network layer, and a first transport layer. In addition, the first filter, the first network layer, and the first transport layer are isolated from the second virtual network stack. If the packet is permitted through the first filter in the first virtual network stack, then the packet is sent to a first virtual NIC.