Blacklisting based on a traffic rule violation

• US 20080126531A1
• Filed: 09/25/2006
• Published: 05/29/2008
• Est. Priority Date: 09/25/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Iyer, Pradeep, Taylor, John, Setia, Deepinder
• Granted Patent: US 9,125,130 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

In some embodiments, a network system includes an access point to wirelessly associate with a client that provides signals with traffic specification attributes to the access point. The system also includes circuitry detect if at least one of the signals violates a traffic rule through considering at least one of the traffic specification attributes and to instruct the access point to disassociate the client in response to a particular number of violations. Other embodiments are described.

Claims

1. A network system comprising:

an access point to wirelessly associate with a client that provides signals with traffic specification attributes to the access point; and

circuitry to detect if at least one of the signals violates a traffic rule through considering at least one of the traffic specification attributes and to instruct the access point to disassociate the client in response to a particular number of violations.

2. The system of claim 1, wherein the particular number is one.

3. The system of claim 1, wherein the particular number depends on the traffic rule that is violated.

4. The system of claim 1, wherein the traffic specification attributes include at least one of the following:

a source IP address, a destination IP address, a source port, destination port and a data transfer protocol.

5. The system of claim 1, wherein the traffic specification attributes consists of the following:

a source IP address, a destination IP address, a source port, a destination port and a data transfer protocol.

6. The system of claim 1, wherein the signals are in the form of packets.

7. The system of claim 1, wherein the traffic rule is one of several traffic rules and some of the traffic rules may be violated if one of the attributes has a particular value regardless of what the other attributes are.

8. The system of claim 1, wherein the considering at least one of the traffic specification attributes involves a comparison of the at least one of the traffic specification attributes with at least one element of the rule.

9. The system of claim 8, wherein the comparisons with traffic rules are made sequentially and not matching a single particular traffic rule does not necessarily cause a rule violation.

10. The system of claim 1, wherein the circuitry categorizes the client and whether the rule is violated depends on the category of the client.

11. The system of claim 1, further comprising a switch to communicate between the access point and other components of the system, wherein the circuitry to detect and instruct is part of the switch.

12. The system of claim 1, wherein the particular number can be the sum of the violation of different traffic rules.

13. The system of claim 1, wherein the traffic specification attributes are involved with layer 3 and layer 4 processing.

14. The system of claim 1, further comprising an authentication server coupled to the switch and further comprising the client.

15. The system of claim 1, wherein the disassociation is for a particular length of time.

16. An apparatus comprising:

an access point to wirelessly associate with a client that provides signals with traffic specification attributes to the access point;

a switch including circuitry to receive at least some of the signals from the access point and detect if the signals violate a traffic rule through considering at least one of the traffic specification attributes and to instruct the access point to disassociate the client in response to a particular number of violations; and

a package joining the access point and the switch.

17. The apparatus of claim 16, wherein the attributes include the following:

source IP address, destination IP address, source port, destination port and protocol.

18. The apparatus of claim 16, wherein the attributes consists of the following:

source IP address, destination IP address, source port, destination port and protocol.

19. The apparatus of claim 16, wherein the considering at least one of the traffic specification attributes involves a comparison of the at least one of the traffic specification attributes with at least one element of the rule.

20. The apparatus of claim 16, wherein the circuitry categorizes the client and whether a rule is violated depends on the category of the client.

21. The apparatus of claim 16, wherein the signals are in the form of packets.

22. The apparatus of claim 16, wherein the circuitry includes a processor to perform instructions.

23. A method comprising:

associating a client to an access point;

receiving signals having traffic specification attributes from the client at the access point and passing the signals to a switch;

detecting if the signals violate a traffic rule through considering at least one of the traffic specification attributes;

instructing the access point to disassociate the client in response to a particular number of violations; and

disassociating the client.

24. The method of claim 23, further including categorizing the client and wherein whether the rule is violated depends on the category of the client.

25. The method of claim 23, wherein the attributes include the following:

source IP address, destination IP address, source port, destination port and protocol.

26. The method of claim 23, wherein the attributes consists of the following:

source IP address, destination IP address, source port, destination port and protocol.

27. The method of claim 23, wherein the considering at least one of the traffic specification attributes involves a comparison of the at least one of the traffic specification attributes with at least one element of the rule.