METHOD AND SYSTEM FOR DETECTING WIRELESS ACCESS DEVICES OPERABLY COUPLED TO COMPUTER LOCAL AREA NETWORKS AND RELATED METHODS

• US 20090013073A1
• Filed: 09/10/2008
• Published: 01/08/2009
• Est. Priority Date: 02/11/2004
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Mittal, Sharad, Chaskar, Hemant, Bhagwat, Pravin, Jonnalagadda, Murthy
• Granted Patent: US 7,751,393 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A system and method is provided for detecting wireless access devices coupled to local area network of computers. The method includes coupling a sniffer device to a local area network. The method includes transferring one or more packets to be directed to a selected device over the local area network. The selected device is preferably coupled to the local area network. The method includes intercepting the one or more packets to be directed to the selected device at the sniffer device. Moreover, the method includes deriving information from the intercepted one or more packets using the sniffer device. The method can generate one or more marker packets in a selected format using the sniffer device. The marker packets are provided based upon at least a portion of the information derived from the intercepted packets. The method includes transferring the one or more marker packets from the sniffer device over the local area network to the selected device and monitoring an airspace within a vicinity of the selected device using one or more sniffer devices

Claims

1-27. -27. (canceled)

28. A system for monitoring wireless access to local area network of computers, the system comprising:

a wired communication interface for coupling the system to a wired portion of a local area network;

a processor unit; and

a computer readable medium having stored thereon a first set of instructions for instructing the processor unit to;

intercept using the wired communication interface one or more packets on the wired portion of the local area network which are directed to be transferred to a selected device coupled to the wired portion of the local area network;

determine a destination port number from the intercepted one or more packets;

generate one or more packets in a selected format and directed to the destination port on the selected device, the destination port being identified in the generated one or more packets via the destination port number determined from the intercepted one or more packets; and

transfer the generated one or more packets over the wired portion of the local area network to the selected device using the wired communication interface.

29. The system of claim 28 and further comprising:

a wireless communication interface for coupling the system to a wireless communication medium within a vicinity of the selected device; and

the computer readable medium having stored thereon a second set of instructions for instructing the processor unit to;

receive one or more packets wirelessly transmitted in the wireless communication medium using the wireless communication interface; and

identify the selected format in the received one or more packets.

30. The system of claim 29 wherein the wireless communication interface is an IEEE 802.11 network interface.

31. The system of claim 28 wherein the wired communication interface is an Ethernet network interface.

32. A method for monitoring wireless access devices coupled to local area network of computers for providing wireless access, the method comprising:

coupling a sniffer device to a wired portion of a local area network;

intercepting at the sniffer device one or more packets over the wired portion of the local area network, the one or more packets being directed to a selected device coupled to the wired portion of the local area network;

deriving format information from the intercepted one or more packets;

transferring the intercepted one or more packets from the sniffer device over the wired portion of the local area network to the selected device;

monitoring an airspace within a vicinity of the selected device using one or more sniffer devices to detect one or more packets wirelessly transmitted in the airspace; and

comparing format information associated with the detected one or more packets in the airspace with the derived format information from the intercepted one or more packets.

33. The method of claim 32 and further comprising:

the comparing the format information resulting in a match; and

inferring that the selected device is coupled to the wired portion of the local area network to provide wireless access to the wired portion of the local area network.