SYSTEM AND METHOD TO ACCESS AND USE LAYER 2 AND LAYER 3 INFORMATION USED IN COMMUNICATIONS

• US 20080295158A1
• Filed: 05/24/2007
• Published: 11/27/2008
• Est. Priority Date: 05/24/2007
• Status: Active Grant

• Current Assignee: AT&T Knowledge Ventures, L.P. (AT&T, Inc.)
• Original Assignee: AT&T Knowledge Ventures, L.P. (AT&T, Inc.)
• Inventors: Henry, David A., Forsyth, James W., Hilving, James P.
• Granted Patent: US 8,819,271 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

A system and method can be used to collect communication information including Layer 2 and Layer 3 information during normal communications between devices or other elements within a network. In a particular embodiment, the information can be generated as address resolution protocol tables and media access control tables, which are used to keep track of which elements are connected to other elements and to map network addresses to media access control identifiers. The communication information can be used in performing an action, such as servicing the system, auditing the system, checking for security breaches or policy violations, or other suitable action.

Claims

1. A method of reviewing network information comprising:

accessing communication information, wherein the communication information includes media access controller identifiers of elements within a network, network addresses used by the elements within the network, and coupling identifiers corresponding to couplings between different elements within the network; and

determining whether or not a particular piece of the communication information matches a corresponding piece of expected information, wherein the expected information includes information that would be expected based upon a portion of the communicated information, including a corresponding media access controller identifier, a corresponding network address, a corresponding coupling identifier, or any combination thereof.

2. The method of claim 1, wherein receiving the communication information comprises:

receiving a first media access control identifier of a first element within a network;

receiving a first network address corresponding to the first media access control identifier; and

receiving a first coupling identifier corresponding to a coupling between the first element and another element within the network.

3. The method of claim 2, wherein receiving the communication comprises receiving Layer 2 and Layer 3 information from the another element.

4. The method of claim 2, wherein receiving the communication information comprises receiving information obtained from address resolution protocol tables and media access control tables of the different elements within the network.

5. The method of claim 1, wherein:

receiving the communication information comprises receiving domain name service identifiers; and

determining whether or not the particular piece of the communication information matches the corresponding piece of expected information comprises determining that a particular domain name service identifier associated with a particular element of the network is unresolved.

6. The method of claim 1, further comprising performing an action in response to determining the particular piece of the communication information does not match the corresponding piece of the expected information.

7. The method of claim 6, wherein performing the action comprises investigating why the particular piece of the communication information does not match the corresponding piece of the expected information.

8. The method of claim 6, wherein performing the action comprises locating a particular element of the network.

9. The method of claim 6, wherein performing the action further comprises isolating or deactivating a particular element of the network.

10. The method of claim 6, wherein performing the action further comprises determining whether a potential security breach or policy violation of the network has occurred.

11. An information handling system comprising:

local area networks operable to be used by subscribers of a service provider; and

a management system coupled to the local area networks, the management system comprising;

a storage device comprising communication information, wherein the communication information includes media access controller identifiers, network addresses, and coupling identifiers corresponding to couplings between different elements within the network, wherein the communication information has been obtained from communications between different elements in different local area networks; and

a processor configured to;

generate expected information from a portion of the communication information, wherein the expected information includes information that would be expected based upon a portion of the communicated information, including a corresponding media access controller identifier, a corresponding network address, a corresponding coupling identifier, or any combination thereof, and

determine whether or not a particular piece of the communication information matches a corresponding piece of the expected information.

12. The system of claim 11, wherein the processor is further configured to perform an action in response to determining that the particular piece of the communication information does not match the corresponding piece of the expected information.

13. A processor readable medium having code to be used in association with a user interface, wherein the code is embodied within the processor readable medium, the code comprising:

an instruction to send a first output signal to be displayed on a display, wherein the first output display signal includes user-selectable objects corresponding to requests for information associated with media access control identifiers within a network;

an instruction to process a first request in response to receiving an input signal corresponding to a first user-selectable object; and

an instruction to send a second output signal to be displayed on the display in response to the first request, wherein the second output signal includes tabular information regarding a first media access control identifier.

14. The processor readable medium of claim 13, wherein the user-selectable objects are configured to be displayed in a form of entries within a pull-down menu or tiles.

15. The processor readable medium of claim 13, wherein the user-selectable objects are organized at a first level by geographic location, mail server, domain name service identifier, media access control identifier, or any combination thereof.

16. The processor readable medium of claim 15, wherein some of the user-selected objects are organized at a second level by media access control identifier, wherein the second level lies at a lower hierarchical level as compared to the first level.

17. The processor readable medium of claim 13, wherein the second display signal corresponds to collected information at a traffic handling element within the network.

18. The processor readable medium of claim 17, wherein the second display signal corresponds to the collected information that include information from a media control access table and an address resolution protocol table.

19. The processor readable medium of claim 17, wherein the tabular information includes an element identifier for the traffic handling element, a port or virtual local area network identifier through which the traffic handling element has access to a device corresponding to the first media access control identifier, a name for the port or virtual local area network, the first media access control identifier, a manufacturer of the device corresponding to the media access control identifier, a network address corresponding to the media access control identifier, a domain name service identifier associated with the media access control identifier, or any combination thereof.

20. The processor readable medium of claim 17, wherein the tabular information includes an element identifier for the traffic handling element, a port or virtual local area network identifier through which the traffic handling element has access to a device corresponding to the first media access control identifier, the first media access control identifier, and a network address corresponding to the media access control identifier.