Method and system for detecting wireless access devices operably coupled to computer local area networks and related methods

• US 20050195753A1
• Filed: 12/29/2004
• Published: 09/08/2005
• Est. Priority Date: 02/11/2004
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Mittal, Sharad, Chaskar, Hemant, Bhagwat, Pravin, Jonnalagadda, Murthy
• Granted Patent: US 7,440,434 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A system and method is provided for detecting wireless access devices coupled to local area network of computers. The method includes coupling a sniffer device to a local area network. The method includes transferring one or more packets to be directed to a selected device over the local area network. The selected device is preferably coupled to the local area network. The method includes intercepting the one or more packets to be directed to the selected device at the sniffer device. Moreover, the method includes deriving information from the intercepted one or more packets using the sniffer device. The method can generate one or more marker packets in a selected format using the sniffer device. The marker packets are provided based upon at least a portion of the information derived from the intercepted packets. The method includes transferring the one or more marker packets from the sniffer device over the local area network to the selected device and monitoring an airspace within a vicinity of the selected device using one or more sniffer devices

Claims

1. A method for detecting wireless access devices coupled to local area network of computers, the method comprising:

coupling a sniffer device to a local area network;

transferring one or more packets to be directed to a selected device over the local area network, the selected device being coupled to the local area network;

intercepting the one or more packets to be directed to the selected device at the sniffer device;

deriving information from the intercepted one or more packets using the sniffer device;

generating one or more packets in a selected format based upon at least a portion of the derived information using the sniffer device;

transferring the one or more packets in the selected format from the sniffer device over the local area network to the selected device;

monitoring an airspace within a vicinity of the selected device using one or more sniffer devices.

2. The method of claim 1 further comprising detecting one or more packets associated with the one or more packets in the selected format in the airspace using at least one of the one or more sniffer devices if the selected device is a wireless access device.

3. The method of claim 1 further comprising outputting one or more packets associated with the one or more packets in the selected format using the selected device into the airspace within the vicinity of the selected device if the selected device is a wireless access device.

4. The method of claim 1 wherein the intercepting comprises routing the one or more packets to be directed to the selected device through the sniffer device.

5. The method of claim 1 wherein the intercepting comprises Address Resolution Protocol (ARP) poisoning, the ARP poisoning associating an IP address of the selected device with a MAC address of the sniffer device.

6. The method of claim 1 wherein the deriving information comprises identifying a destination port number in the intercepted packets and recording the destination port number in one or more computer memories.

7. The method of claim 6 wherein the one or more packets in the selected format are Transmission Control Protocol (TCP) packets destined to the recorded destination port number.

8. The method of claim 6 wherein the one or more packets in the selected format are User Datagram Protocol (UDP) packets destined to the recorded destination port number.

9. The method of claim 1 wherein the selected format comprises a selected bit pattern in a packet.

10. The method of claim 1 wherein the selected format comprises a selected size of a packet.

11. The method of claim 1 wherein the selected format comprises a set of selected sizes associated with a set of one or more packets.

12. The method of claim 1 wherein the selected format comprises a set of selected bit patterns associated with a set of one or more packets.

13. The method of claim 1 wherein the selected format comprises a set of time instants associated with a set of packets.

14. The method of claim 13 wherein the set of time instants is associated with the transferring the one or more packets from the sniffer device to the selected device.

15. The method of claim 1 wherein the sniffer device is provided in a computer system, a wireless access point, a network device, or a stand alone device.

16. Sniffer device comprising:

a handler adapted to intercept one or more packets on a network segment, the one or more packets being directed to be transferred to a selected device coupled to the network segment;

a processor adapted to derive information associated with the intercepted one or more packets;

a packet generator adapted to generate one or more packets in a selected format based upon at least a portion of the derived information;

an output handler adapted to transfer the one or more packets in the selected format over the network segment to the selected device.

17. The sniffer device of claim 16 further comprising a wireless activity detector adapted to monitoring wireless activity within an airspace to identify one or more packets associated with the one or more packets in the selected format.

18. The sniffer device of claim 16 wherein the handler, the processor, the packet generator, and the output handler are provided at least partly in one or more computer codes.

19. The sniffer device of claim 16 wherein the handler intercepts the one or more packets using the Ethernet network interface.

20. The sniffer device of claim 16 wherein the output handler transfers the one or more packets in the selected format using the Ethernet network interface.

21. The sniffer device of claim 17 wherein the wireless activity detector is provided at least in part in one or more computer codes and the wireless activity detector monitors the wireless activity using wireless radio receiver.

22. The sniffer device of claim 16 wherein the output handler transfers the one or more packets in the selected format using the wireless network interface.

23. The sniffer device of claim 16 wherein the handler intercepts the one or more packets using the wireless network interface.

24. A method for detecting wireless access devices coupled to local area network of computers, the method comprising:

coupling a sniffer device to a local area network;

transferring one or more packets to be directed to a selected device over the local area network, the selected device being coupled to the local area network;

intercepting the one or more packets to be directed to the selected device at the sniffer device;

deriving format information from the intercepted one or more packets using the sniffer device;

transferring the intercepted one or more packets from the sniffer device over the local area network to the selected device;

monitoring an airspace within a vicinity of the selected device using one or more sniffer devices.

25. The method of claim 24 further comprising detecting one or more packets associated with the one or more intercepted packets in the airspace using at least one of the one or more sniffer devices if the selected device is a wireless access device.

26. The method of claim 25 wherein the detecting comprising comparing format information associated with one or more packets in the airspace with the derived format information from the intercepted one or more packets.

27. The method of claim 24 further comprising outputting one or more packets associated with the one or more intercepted packets using the selected device into the airspace within the vicinity of the selected device if the selected device is a wireless access device.