Sean W Hull

US Patent:

7770215, Aug 3, 2010

Filed:

Oct 30, 2006

Appl. No.:

11/554081

Inventors:

Chris O'Rourke - Apex NC, US
Gaurang K. Shah - Cary NC, US
Louis F. Menditto - Raleigh NC, US
Mark Albert - Morrisville NC, US
Michael S. Sutton - Garner NC, US
Pranav K. Tiwari - Raleigh NC, US
Robert M. Batz - Raleigh NC, US
Richard Gray - Cary NC, US
Sean W. Hull - Raleigh NC, US
Tzu-Ming Tsang - Chapel Hill NC, US

Assignee:

Cisco Technology, Inc. - San Jose CA

International Classification:

G06F 9/00

US Classification:

726 11, 726 3, 726 12, 726 13, 709223, 709224, 709225

Abstract:

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

US Patent:

7131140, Oct 31, 2006

Filed:

Feb 19, 2001

Appl. No.:

09/788690

Inventors:

Chris O'Rourke - Apex NC, US
Gaurang K Shah - Cary NC, US
Louis F Menditto - Raleigh NC, US
Mark Albert - Morrisville NC, US
Michael S Sutton - Garner NC, US
Pranav K Tiwari - Raleigh NC, US
Robert M Batz - Raleigh NC, US
Richard Gray - Cary NC, US
Sean W Hull - Raleigh NC, US
Tzu-Ming Tsang - Chapel Hill NC, US

Assignee:

Cisco Technology, Inc. - San Jose CA

International Classification:

G06F 9/00

US Classification:

726 11, 726 3, 709224

Abstract:

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Author:

Sean Hull

ISBN #:

0596000189