Abstract: A processing-based bypass “fail open” mode is provided for an intrusion prevention system by a primary process running on a first logical core (lcore) is used as a control plane, which invokes bypass-open run-to-completion threads in other lcores comprising a bypass data plane, and which spawns a secondary process to fully configure intrusion prevention threads on other lcores to create an Intrusion Prevention System data plane. Upon a ready signal from the secondary process, the primary process quiesces such that the secondary process IPS data plane exclusively owns and executes on the other lcores.

Abstract: A processing-based bypass “fail open” mode is provided for an intrusion prevention system by a primary process running on a first logical core (lcore) is used as a control plane, which invokes bypass-open run-to-completion threads in other lcores comprising a bypass data plane, and which spawns a secondary process to fully configure intrusion prevention threads on other lcores to create an Intrusion Prevention System data plane. Upon a ready signal from the secondary process, the primary process quiesces such that the secondary process IPS data plane exclusively owns and executes on the other lcores.

Abstract: A segmentation and re-assembly (SAR) decode engine receives protocol data units of data from a communication channel between two computers, sequences the protocol data units, and re-assembles the data in the protocol data units into the messages exchanged by the computers. The SAR decode engine is responsible for unpacking the payloads from the protocol data units as instructed by a protocol interpreter associated with the protocol data unit, and for creating and maintaining a flow object database containing flow objects representing the data flows at each protocol layer. The SAR decode engine creates a protocol flow object for each protocol layer and logically links the protocol flow object to circuit flow objects that define two one-way circuits within the channel. The circuit flow objects linked to a protocol flow object are logical representations of the protocol data units for the next higher protocol layer.

Abstract: A segmentation and re-assembly (SAR) decode engine receives protocol data units of data from a communication channel between two computers, sequences the protocol data units, and re-assembles the data in the protocol data units into the messages exchanged by the computers. The SAR decode engine is responsible for unpacking the payloads from the protocol data units as instructed by a protocol interpreter associated with the protocol data unit, and for creating and maintaining a flow object database containing flow objects representing the data flows at each protocol layer. The SAR decode engine creates a protocol flow object for each protocol layer and logically links the protocol flow object to circuit flow objects that define two one-way circuits within the channel. The circuit flow objects linked to a protocol flow object are logical representations of the protocol data units for the next higher protocol layer.