Abstract: A method and apparatus receive packets, wherein the packets comprise headers, and the headers comprise session parameter values, route the packets in response to the session parameter values matching an active traffic session entry of the active traffic session entries in an active traffic session cache memory, match the session parameter values against historical session entries in an historical session cache memory in response to the session parameter values not matching any active traffic session entry of the active traffic session entries in the active traffic session cache memory, wherein the historical session entries for traffic sessions in the historical session cache memory persist after the traffic sessions are no longer active, and, in response to the session parameter values not matching any historical session entry of the historical session entries in the historical session cache memory, performing a packet security check on the packets.

Abstract: This disclosure describes an approach to handle packets that arrive at a network security device, such as a router. At a data plane of the security device, packet identifiers included in an incoming packet not currently belonging to an IP session of the device are compared to packet identifiers stored in a table stored in a memory of the security device. The incoming packet identifiers includes a source IP, a destination IP, a protocol, a destination port, and a source port while the identifiers stored in the table do not include the source port. A new session is established for the incoming packet in response to the set of packet identifiers matching one of the entries in the table.

Abstract: A method and apparatus receive packets, wherein the packets comprise headers, and the headers comprise session parameter values, route the packets in response to the session parameter values matching an active traffic session entry of the active traffic session entries in an active traffic session cache memory, match the session parameter values against historical session entries in an historical session cache memory in response to the session parameter values not matching any active traffic session entry of the active traffic session entries in the active traffic session cache memory, wherein the historical session entries for traffic sessions in the historical session cache memory persist after the traffic sessions are no longer active, and, in response to the session parameter values not matching any historical session entry of the historical session entries in the historical session cache memory, performing a packet security check on the packets.

Abstract: This disclosure describes an approach to handle packets that arrive at a network security device, such as a router. At a data plane of the security device, packet identifiers included in an incoming packet not currently belonging to an IP session of the device are compared to packet identifiers stored in a table stored in a memory of the security device. The incoming packet identifiers includes a source IP, a destination IP, a protocol, a destination port, and a source port while the identifiers stored in the table do not include the source port. A new session is established for the incoming packet in response to the set of packet identifiers matching one of the entries in the table.

Abstract: An approach is provided where incoming packets are received at a data plane and header fields are extracted from the incoming packet. Flows from a flow data store are matched with the extracted header fields from the incoming packet. Packet descriptor data associated with the incoming packet is marked in the selected incoming packet forming a marked ingress packet with marking performed when the matching fails. The marked ingress packet is forwarded to a control plane that retrieves flow-related data related to the marked ingress packet and updates the marked packet descriptor data using the retrieved flow-related data, thereby forming an updated marked packet. The control plane passes the updated marked packet back to the data plane for further processing to update the flow data stored in the flow data store.

Abstract: An approach is provided where incoming packets are received at a data plane and header fields are extracted from the incoming packet. Flows from a flow data store are matched with the extracted header fields from the incoming packet. Packet descriptor data associated with the incoming packet is marked in the selected incoming packet forming a marked ingress packet with marking performed when the matching fails. The marked ingress packet is forwarded to a control plane that retrieves flow-related data related to the marked ingress packet and updates the marked packet descriptor data using the retrieved flow-related data, thereby forming an updated marked packet. The control plane passes the updated marked packet back to the data plane for further processing to update the flow data stored in the flow data store.