AUTOMATED SNIFFER APPARATUS AND METHOD FOR WIRELESS LOCAL AREA NETWORK SECURITY

• US 20070171885A1
• Filed: 04/02/2007
• Published: 07/26/2007
• Est. Priority Date: 02/11/2004
• Status: Abandoned Application

• Current Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: King, David, Bhagwat, Pravin, Gogate, Shantanu
• Application Number:
  US11/695,569
• Publication Number:
  US 20070171885A1
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/04 Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for protecting local area networks within a selected local geographic region (e.g. office, apartment, building, coffee shop, hot-spot etc.) from wireless attacks, using a wireless sniffer apparatus. The method includes placing one or more wireless sniffer apparatus spatially to provide substantial radio coverage over at least a portion of the selected local geographic region comprising one or more local area networks. Moreover the method includes coupling one or more of the wireless sniffer apparatus to one or more of the local area networks.

Claims

1. An apparatus for intrusion detection in wireless communication networks, the apparatus comprising:

a single housing, the housing comprising;

a processing unit;

one or more wireless network interface devices coupled to the processing unit;

at least one network interface device coupled to the processing unit, the at least one network interface device being adapted to operably couple the housing to a local area network to be protected from intrusion; and

one or more memories coupled to the processing unit, the one or more memories including;

one or more codes directed to perform a process for detection of a wireless activity within a selected local geographic region, the wireless activity being derived from at least one authorized device or at least an other device, the wireless activity being received using one or more of the wireless network interface devices;

one or more codes directed to receiving at least identity information associated with the wireless activity from the detection process in a classification process;

one or more codes directed to labeling the identity information into at least one of a plurality of categories in the classification process, the plurality of categories including at least authorized, unauthorized and external; and

one or more codes directed to generating indication associated with the identity information;

whereupon the codes directed to perform the process for detection, the receiving the identity information, the labeling the identity information and the generating indication are all entirely executed within the processing unit.