SYSTEM AND METHOD FOR FILTERING NETWORK TRAFFIC

• US 20140289800A1
• Filed: 06/04/2014
• Published: 09/25/2014
• Est. Priority Date: 09/03/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Huang, Dehua, Sweeney, Adam J., Sudame, Pradeep S., Dobrota, Silviu, Jonnala, Premkumar
• Granted Patent: US 9,882,904 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Protocol status information is used to perform traffic filtering by dropping messages that are not consistent with the protocol status information. In one embodiment, a method involves comparing message information and protocol status information. The message information is associated with a first message. The protocol status information is obtained in response to one or more second messages, which are conveyed according to a protocol used to assign network addresses to clients. The method also involves determining whether to discard the first message, based on an outcome of the comparison of the message information and the protocol status information. For example, it can be determined that the first message should be discarded, if the message information does not match the protocol status information.

Claims

1. A method comprising:

performing a first security action for a first message, wherein an access control rule indicates performance of the first security action; and

selecting to unicast the first message instead of forwarding the first message normally, wherein

the first message would normally be broadcast, multicast, or flooded to multiple recipients, and

the selecting to unicast the first message is performed in response to a determination that the first message comprises a first protocol message from a protocol server.