US 12,267,404 B2
Transparent inline content inspection and modification in a TCP session
Gregory Lyle Galloway, Cumming, GA (US); Paul Coccoli, Marietta, GA (US); David Allen Dennerline, Sandy Springs, GA (US); and Steven Ashley Mazur, Johns Creek, GA (US)
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Jul. 1, 2019, as Appl. No. 16/458,624.
Application 16/458,624 is a continuation of application No. 14/512,504, filed on Oct. 13, 2014, granted, now 10,382,591.
Prior Publication US 2019/0327347 A1, Oct. 24, 2019
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 69/16 (2022.01); H04L 9/40 (2022.01)
CPC H04L 69/16 (2013.01) [H04L 63/1416 (2013.01); H04L 63/1441 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method carried out in a device positioned between a pair of endpoints, each of which endpoints includes a TCP stack, comprising:
inspecting a stream of TCP traffic flowing between the pair of endpoints, wherein said endpoints are dedicated to retransmission of data packets;
as the stream of TCP traffic is flowing, and without TCP connection termination, selectively rewriting the stream of TCP traffic to generate rewritten data content;
wherein selectively rewriting the stream includes generating, from the one or more input data packets in the input record, a modified portion of the stream, the modified portion being the rewritten data content and comprising one or more output data packets to be sent to a receiving endpoint entity such that a TCP connection tracking table, instead of a retransmission timer per connection, can keep track of the sequence numbers in both directions for each connection, and track endpoint-generated retransmitted packets and acknowledgement messages as they flow through the inline network appliance;
in response to tracking endpoint-generated TCP acknowledgement messages as they flow unmodified through the device, controlling transmission of the rewritten data content;
wherein the inspecting, rewriting and controlling operations are performed in software executing in one or more hardware elements and without using a TCP stack in the device, and without requiring termination or re-origination of a connection between the pair of endpoints;
reassembling any out-of-order input data packets received from the sending endpoint entity prior to generating the modified portion of the stream.