US 11,811,735 B2
Use of stateless marking to speed up stateful firewall rule processing
Jayant Jain, Cupertino, CA (US); Anirban Sengupta, Saratoga, CA (US); Mohan Parthasarathy, Cupertino, CA (US); and Xinhua Hong, Milpitas, CA (US)
Assigned to NICIRA, INC., Palo Alto, CA (US)
Filed by Nicira, Inc., Palo Alto, CA (US)
Filed on May 15, 2021, as Appl. No. 17/321,423.
Application 17/321,423 is a division of application No. 15/816,708, filed on Nov. 17, 2017, granted, now 11,019,030.
Application 15/816,708 is a continuation of application No. 14/295,544, filed on Jun. 4, 2014, granted, now 9,825,913, issued on Nov. 21, 2017.
Prior Publication US 2021/0273911 A1, Sep. 2, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01); H04L 69/326 (2022.01); H04L 69/22 (2022.01); H04L 43/028 (2022.01)
CPC H04L 63/0254 (2013.01) [H04L 43/028 (2013.01); H04L 63/0263 (2013.01); H04L 69/22 (2013.01); H04L 69/326 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory machine-readable medium storing a program which when executed by one or more processing units statefully classifies network packets belonging to transport layer connections, the program comprising sets of instructions for:
receiving, from a physical network interface controller (PNIC), (i) an incoming packet and (ii) a set of identifiers generated for the incoming packet by a stateless lookup operation performed at the PNIC using identifiers of a transport layer connection to which the incoming packet belongs;
determining whether a connection-tracking data storage stores any record for the transport layer connection;
when the data storage stores a record for the transport layer connection, performing a first stateful operation on the incoming packet based on a first action specified by the stored record; and
when the data storage does not store any record for the transport layer connection, (i) using the received set of identifiers generated by the PNIC to identify a rule applicable to the incoming packet, (ii) performing a second stateful operation on the incoming packet based on a second action specified by the identified rule, and (iii) storing a new record in the connection-tracking data storage for the transport layer connection to which the incoming packet belongs, the new record for use in performing stateful operations on subsequent packets belonging to the transport layer connection.