System and method for remote monitoring in a wireless network

• US 20070086397A1
• Filed: 01/05/2006
• Published: 04/19/2007
• Est. Priority Date: 10/13/2005
• Status: Active Grant

• Current Assignee: Trapeze Networks Incorporated (Juniper Networks Incorporated)
• Original Assignee: Belden Inc.
• Inventors: Taylor, Ron
• Granted Patent: US 7,573,859 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 12/1868 Measures taken after transmission, e.g. acknowledgments
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/06 Testing, supervising or monitoring using simulated traffic

Abstract

A technique for combining operations of a wireless access point with a remote probe. An access point links a wireless client to a wireless switch. A remote probe captures wireless packets, appends radio information, and forwards packets to a remote observer for analysis. In an embodiment, the observer may provide a protocol-level debug. A system according to the technique can, for example, accomplish concurrent in-depth packet analysis of one or more interfaces on a wireless switch. The system can also, for example, augment embedded security functions by forwarding selected packets to a remote Intrusion Detection System (IDS). In an embodiment, filters on the probes may reduce overhead.

Claims

1. A system comprising:

a wired backbone network;

a network, coupled to the wired backbone network;

a wireless access domain, including;

a first access area having

a first wireless exchange switch for sending data through the network to the wired backbone network, and

a first access point, with a first snoop filter, that links wireless mobile stations to the wired backbone network through the first wireless exchange switch;

a second access area having

a second wireless exchange switch for sending data through the network to the wired backbone network, and

a second access point, with a second snoop filter, that links wireless mobile stations to the wired backbone network through the second wireless exchange switch;

an intrusion detection system, coupled to the network, for analyzing packets;

wherein, in operation, a connection is established between a mobile device in the first access area and the mobile device is associated with a persistent identity;

the first snoop filter monitors traffic between the mobile device and the first access point and copies packets that meet a specified criteria to the intrusion detection system;

when the mobile device moves into the second access area, the connection is maintained along with the persistent identity of the mobile device;

the second snoop filter continues to monitor traffic between the mobile device and the second access point and continues to copy packets that meet the specified criteria to the intrusion detection system.

2. The system of claim 1 wherein the network provides a Layer 2 path for Layer 3, and wherein the first wireless exchange and the second wireless exchange send Layer 3 data through the network to the wired backbone network.

3. The system of claim 1, wherein the persistent identity includes a Layer 3 attribute.

4. A method comprising:

establishing a wireless connection with a mobile device in a first access area of a wireless access domain, wherein the connection has an associated IP address;

monitoring traffic associated with the mobile device through the first access area;

capturing a packet from the traffic if the packet meets a specified criteria;

analyzing the packet to determine whether the mobile device is a threat;

detecting movement of the mobile device from the first access area to a second access area of the wireless access domain;

maintaining the wireless connection and the associated IP address;

continuing to monitor traffic associated with the mobile device through the second access area.

5. The method of claim 4, further comprising encapsulating the packet with TZSP.

6. The method of claim 4, further comprising decrypting packets so that a header associated with the packet is clear even if the header indicates encrypted data.

7. The method of claim 4, further comprising decoding encrypted data and reporting accurate signal strength measurements.

8. A system comprising:

an access point, including;

a radio interface through which wireless traffic passes;

one or more filters;

a monitor, coupled to the radio interface, that captures a packet from the wireless traffic if the packet matches a filter of the one or more filters;

an intrusion detection system for analyzing packets;

a network coupling the access point to the intrusion detection system, wherein the captured packet is copied through the network from the access point to the intrusion detection system.

9. The system of claim 8, wherein the intrusion detection system is remote with respect to the access point.

10. The system of claim 8, wherein the monitor appends radio information to the packet.

11. The system of claim 8, wherein the access point is a first access point, further comprising a second access point, wherein a mobile device is capable of passing from the first access point to the second access point with subnet mobility.

12. The system of claim 8, further comprising a workstation with the intrusion detection system included therein.

13. The system of claim 8, further comprising additional radio interfaces, wherein the monitor captures packets from traffic passing through the additional radio interfaces.

14. The system of claim 8, further comprising additional radio interfaces, wherein the one or more filters are mapped to each of the additional radio interfaces.

15. The system of claim 8, wherein the radio interface decrypts the packet such that the payload is clear even if a header indicates encrypted data.

16. The system of claim 8, wherein the radio interface and the monitor are integrated together into the access point.

17. The system of claim 8, wherein the monitor is persistent.

18. The system of claim 8, wherein the filters include one or more parameters selected from the group consisting of Basic Service Set Identifier (BSSID), channel, mac address, frame-type.

19. The system of claim 8, wherein the filters are non-persistently enabled/disabled.

20. The system of claim 8, wherein the packet is an 802.11 packet.