Method and system for network management using wire tapping

• US 20070199052A1
• Filed: 02/21/2006
• Published: 08/23/2007
• Est. Priority Date: 02/21/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Venkat, Balaji, Sankaran, Ganesh
• Granted Patent: US 8,352,590 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

A method and a system for collecting information in a network. A wiretap tunnel interface is initialized between a wire-tapping device and a network device. The wire-tapping device receives information related to routing protocol traffic from the network device through the wiretap tunnel interface. The wire-tapping device collates the received information about the routing protocol traffic. This collated information is used by the network administrator to manage the network.

Claims

1. A method for collecting information regarding a network, the method comprising:

accepting signals to initialize a wiretap tunnel interface between a network device and a wire-tapping device;

receiving the information through the wiretap tunnel interface, wherein the information is received at the wire-tapping device from the network device; and

collating the received information at the wire-tapping device.

2. The method of claim 1, wherein the received information comprises information related to a routing protocol, the routing protocol including information regarding forwarding data in the network.

3. The method of claim 2, wherein the information related to the routing protocol is encapsulated according to a generic router encapsulation mechanism.

4. The method of claim 1, wherein the accepting signals to initialize the wiretap tunnel interface between the network device and the wire-tapping device comprises:

coupling the wire-tapping device to the network device through the wiretap tunnel interface; and

executing an authentication mechanism, wherein the authentication mechanism is executed to authenticate the wire-tapping device to receive the encapsulated information related to the routing protocol.

5. The method of claim 4, wherein the coupling the wire-tapping device to the network device through the wiretap tunnel interface further comprises:

pairing the wiretap tunnel interface with one or more physical interfaces, each physical interface participating in the routing protocol.

6. The method of claim 4, wherein the authentication mechanism is executed according to an authentication protocol.

7. The method of claim 4, wherein the executing the authentication mechanism further comprises:

sending an interested traffic parameter to the network device.

8. The method of claim 7, wherein the interested traffic parameter comprises information related to the routing protocol and information related to the one or more physical interfaces paired with the wiretap tunnel interface, wherein the information related to the routing protocol specifies the routing protocol required for forwarding the data in the network.

9. The method of claim 4, wherein the executing the authentication mechanism further comprises:

querying the network device for sending the information related to the routing protocol to the wire-tapping device.

10. The method of claim 1, wherein the receiving the information comprises:

receiving a control word from the network device.

11. The method of claim 10, wherein the control word comprises information related to a type code of a routing protocol, context information related to the routing protocol, information related to the one or more physical interfaces paired with the wiretap tunnel interface and information related to a number of the one or more physical interfaces paired with the wiretap tunnel interface, wherein the type code classifies the routing protocol.

12. The method of claim 1, wherein the collating the received information comprises:

segregating the received information; and

processing the segregated information.

13. The method of claim 1, further comprising:

sending a keep alive message through the wiretap tunnel interface, wherein the wire-tapping device sends the keep alive message to indicate the presence of the wire-tapping device to the network device.

14. The method of claim 13, wherein the keep alive message is sent according to a generic router encapsulating tunneling mechanism.

15. The method of claim 1, further comprising:

sending information through the wiretap tunnel interface, wherein the information is sent to the wire-tapping device from the network device.

16. A method for managing a network by a user, the method comprising:

coupling a wire-tapping device to a network device by configuring a wiretap tunnel interface on the network device;

executing an authentication mechanism, the authentication mechanism is executed to authenticate the wire-tapping device to receive information from the network device;

receiving information through the wiretap tunnel interface, wherein the information is received at the wire-tapping device from the network device; and

collating the received information at the wire-tapping device, wherein the received information is collated for managing the network by a user.

17. The method of claim 16, further comprising:

deriving a routing table from the collated information at the wire-tapping device.

18. A system for collecting information regarding a network, the system comprising:

a wire-tapping device receiving information from a network device; and

a wiretap tunnel interface through which the wire-tapping device receives the information.

19. A system for collecting information regarding a network, the system comprising:

means for accepting signals to initialize a wiretap tunnel interface between a network device and a wire-tapping device;

means for receiving the information through the wiretap tunnel interface from the network device; and

means for collating the received information.

20. A machine-readable medium including instructions executable by a processor, the machine-readable medium comprising:

one or more instructions for accepting signals to initialize a wiretap tunnel interface between a network device and a wire-tapping device;

one or more instructions for receiving the information through the wiretap tunnel interface from the network device; and

one or more instructions for collating the received information.

21. An apparatus for collecting information regarding a network, the apparatus comprising:

a processor for executing instructions; and

a machine-readable medium including instructions executable by the processor comprising;

one or more instructions for accepting signals to initialize a wiretap tunnel interface between a network device and a wire-tapping device;

one or more instructions for receiving the information through the wiretap tunnel interface from the network device; and

one or more instructions for collating the received information.