Security device that performs network flow prediction, flow ownership assignment, and event aggregation in a distributed processor system

摘要

A security device for processing a network flow includes a predicted flow table including a predicted flow entry that associates a predicted network flow with a packet processor ownership assignment. The prediction key comprises a plurality of data fields, and identifies a prediction network flow in which one or more of the data fields have a wildcard value. In another embodiment, a security device for processing network flows comprises a packet processing manager configured to assign network flow ownership to one or more packet processors, wherein the packet processing manager includes packet processor ownership. A global flow table including entries that associate network flows with assignments is provided. In another embodiment, the security device for processing a network flow is a packet processing card formed with a packet processor, each packet processing card storing packet processing for storing local counter values of one or more events A card and a packet processing manager with a global event counter for maintaining event statistics of events in the security device. [Selection] Figure 2