US 11,811,731 B2
Packet classification for network routing
Nir Zuk, Menlo Park, CA (US); and Marc Joseph Benoit, Santa Clara, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jun. 14, 2022, as Appl. No. 17/839,614.
Application 17/839,614 is a continuation of application No. 16/927,761, filed on Jul. 13, 2020, granted, now 11,394,688.
Application 16/927,761 is a continuation of application No. 15/250,156, filed on Aug. 29, 2016, granted, now 10,757,074, issued on Aug. 25, 2020.
Application 15/250,156 is a continuation of application No. 13/954,668, filed on Jul. 30, 2013, granted, now 9,461,967, issued on Oct. 4, 2016.
Claims priority of provisional application 61/847,982, filed on Jul. 18, 2013.
Prior Publication US 2022/0311742 A1, Sep. 29, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 45/00 (2022.01); H04L 67/63 (2022.01); H04L 69/22 (2022.01); H04L 45/64 (2022.01); H04L 47/2441 (2022.01)
CPC H04L 63/0227 (2013.01) [H04L 45/38 (2013.01); H04L 45/64 (2013.01); H04L 47/2441 (2013.01); H04L 67/63 (2022.05); H04L 69/22 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
receive packets associated with a new flow at a security controller from a network device, wherein the network device performs packet forwarding;
classify the flow based on an application determined to be associated with the flow, comprising to:
determine a type of traffic related to the flow, the type of traffic including HTTP traffic, HTTPS traffic, FTP traffic, SSL traffic, SSH traffic, DNS requests, unclassified application traffic, or any combination thereof;
assemble out of order packets of the flow into a correct order to extract information from the ordered packets of the flow; and
perform application signature matching based on the type of traffic to determine the application associated with the flow;
determine an action for the flow based on a policy associated with the application; and
instruct the network device to perform the action for the flow, wherein the action is to drop the flow or ignore the flow; and
a memory coupled to the processor and configured to provide the processor with instructions.