Firewall system and method with network mapping capabilities

• US 6,839,852 B1
• Filed: 02/08/2002
• Issued: 01/04/2005
• Est. Priority Date: 02/08/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Brown, Shawn L., Pantuso, Joseph J.
• Primary Examiner(s): Darrow, Justin T.
• Assistant Examiner(s): Zand, Kambiz
• Application Number:
  US10/071,549
• Time in Patent Office: 1,061 Days
• Field of Search: 713/188, 713/200, 713/201, 380/258, 709/224
• US Class Current: 726/11
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

A system, method and computer program product are provided for tracing a traffic event utilizing a firewall. Initially, a firewall is executed on a local computer. Next, traffic events between the local computer and a remote computer over a network are monitored utilizing the firewall. Further, the traffic events are displayed utilizing the firewall. In use, at least one of the traffic events is traced utilizing the firewall. Moreover, a map of the trace is displayed for effectively conveying information about the traffic event.

Claims

1. A method for tracing a traffic event utilizing a firewall, comprising:

(a) executing a firewall on a local computer;

(b) monitoring traffic events between the local computer and a remote computer over a network utilizing the firewall;

(c) displaying the traffic events utilizing the firewall;

(d) tracing at least one of the traffic events utilizing the firewall; and

(e) displaying a world map with an illustration of the trace thereon utilizing the firewall.

2. The method as recited in claim 1, wherein the traffic events are displayed in an event log.

3. The method as recited in claim 2, wherein the event log identifies a time and an Internet Protocol (IP) address associated with the traffic events.

4. The method as recited in claim 2, wherein the traffic events are organized based on times the traffic events are logged.

5. The method as recited in claim 2, wherein the traffic events include attempts to access the local computer.

6. The method as recited in claim 1, wherein the at least one traffic event is traced in response to a user request.

7. The method as recited in claim 1, wherein the tracing includes identifying a plurality of network segments traversed by the traffic event.

8. The method as recited in claim 7, wherein the map includes the network segments.

9. The method as recited in claim 8, and further comprising displaying a plurality of views.

10. The method as recited in claim 9, wherein a geographical location of the network segments is displayed upon the selection of a first one of the views.

11. The method as recited in claim 10, wherein nodes of the network segments are displayed upon the selection of a second one of the views.

12. The method as recited in claim 11, wherein a list of the network segments are displayed upon the selection of a third one of the views.

13. A computer program product for tracing a traffic event utilizing a firewall, comprising:

(a) computer code for executing a firewall on a local computer;

(b) computer code for monitoring traffic events between the local computer and a remote computer over a network utilizing the firewall;

(c) computer code for displaying the traffic events utilizing the firewall;

(d) computer code for tracing at least one of the traffic events utilizing the firewall; and

(e) computer code for displaying a world map with an illustration of the trace thereon utilizing the firewall.

14. The computer program product as recited in claim 13, wherein the traffic events are displayed in an event log.

15. The computer program product as recited in claim 14, wherein the event log identifies a time and an Internet Protocol (IP) address associated with the traffic events.

16. The computer program product as recited in claim 14, wherein the traffic events are organized based on times the traffic events are logged.

17. The computer program product as recited in claim 14, wherein the traffic events include attempts to access the local computer.

18. The computer program product as recited in claim 13, wherein the at least one traffic event is traced in response to a user request.

19. The computer program product as recited in claim 13, wherein the tracing includes identifying a plurality of network segments traversed by the traffic event.

20. The computer program product as recited in claim 19, wherein the map includes the network segments.

21. The computer program product as recited in claim 20, and further comprising computer code for displaying a plurality of views.

22. The computer program product as recited in claim 21, wherein a geographical location of the network segments is displayed upon the selection of a first one of the views.

23. The computer program product as recited in claim 22, wherein nodes of the network segments are displayed upon the selection of a second one of the views.

24. The computer program product as recited in claim 23, wherein a list of the network segments are displayed upon the selection of a third one of the views.

25. A system for tracing a traffic event utilizing a firewall, comprising:

(a) logic for executing a firewall on a local computer;

(b) logic for monitoring traffic events between the local computer and a remote computer over a network utilizing the firewall;

(c) logic for displaying the traffic events utilizing the firewall;

(d) logic for tracing at least one of the traffic events utilizing the firewall; and

(e) logic for displaying a world map with an illustration of the trace thereon utilizing the firewall.

26. A method for tracing a traffic event utilizing a firewall, comprising:

(a) executing a firewall on a local computer;

(b) monitoring traffic events between the local computer and a remote computer over a network utilizing the firewall;

(c) displaying the traffic events utilizing the firewall;

(d) tracing at least one of the traffic events utilizing the firewall;

(e) displaying a geographical location of a plurality of network segments associated with the traffic event on a world map upon the selection of a first one of a plurality of views utilizing the firewall;

(f) displaying a plurality of nodes of the network segments upon the selection of a second one of the views utilizing the firewall; and

(g) displaying a list of the network segments upon the selection of a third one of the views utilizing the firewall.

27. A method for tracing a traffic event utilizing a firewall, comprising:

(a) executing a firewall on a local computer;

(b) monitoring traffic events between the local computer and a remote computer over a network utilizing the firewall;

(c) logging the traffic events in an event log utilizing the firewall, wherein the event log identifies a time and an Internet Protocol (IP) address associated with the traffic events;

(d) organizing the traffic events in the event log based on times the traffic events are logged utilizing the firewall;

(e) displaying the traffic events in the event log utilizing the firewall;

(f) detecting the selection of one of the traffic event by a user;

(g) tracing at least one of the traffic events utilizing the firewall upon the selection thereof, wherein the tracing identifies a plurality of network segments traversed by the traffic event;

(h) detecting the selection of one of a plurality of views by the user; and

(i) displaying the network segments in the selected view upon the selection of one of the views, wherein one of the views includes a world map with an illustration of a trace thereon.

28. A method for geographically tracing a traffic event utilizing a personal firewall, comprising:

monitoring traffic events between a local computer and a remote computer over a network utilizing a personal firewall;

displaying the traffic events in an event log utilizing the personal firewall, wherein the traffic events are organized based on a time associated therewith;

tracing at least one of the traffic events utilizing the personal firewall; and

displaying the trace on a world map utilizing the personal firewall,

wherein the at least one traffic event is traced in response to a user request.

29. A computer program product for geographically tracing a traffic event utilizing a personal firewall, comprising:

computer code for monitoring traffic events between a local computer and a remote computer over a network utilizing a personal firewall;

computer code for displaying the traffic events in an event log utilizing the personal firewall, wherein the traffic events are organized based on a time associated therewith;

computer code for tracing at least one of the traffic events utilizing the personal firewall; and

computer code for displaying the trace on a world map utilizing the personal firewall,

wherein the at least one traffic event is traced in response to a user request;

wherein the trace is shown to involve a plurality of displayed network segments shown to be spanning different cities of different countries displayed on the world map.