Simplified network packet analyzer for distributed packet snooper

• US 7,269,647 B2
• Filed: 12/15/2000
• Issued: 09/11/2007
• Est. Priority Date: 12/15/2000
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Chang, Ching-Jye, Ullmann, Lorin Evan
• Primary Examiner(s): Caldwell; Andrew
• Assistant Examiner(s): Blair; Douglas
• Application Number:
  US09/738,334
• Publication Number:
  US 20020078231A1
• Time in Patent Office: 2,461 Days
• Field of Search: 709220-224, 709201-203, 709238-239, 709229-231, 345/736, 345/738, 370/248, 370/252, 370/254, 717/148
• US Class Current: 709/224
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A method, system, apparatus, and computer program product are presented for a dynamically locatable packet analyzer spread across a distributed network of endpoints for determining packet generating applications is provided. In particular, the analyzer determines which ports are being used by which applications in order to verify that only intended packets are being sent and received by endpoints. The analyzer also provides novice packet snooping by not requiring administrators to configure operating system specific, packet specific or port specific information. The analyzer also provides snooping per application type (i.e. security, discovery, etc.) on endpoints, rather than packet type or port only.

Claims

1. A method for analyzing network packets, the method comprising:

receiving snoop configuration information;

configuring an endpoint and a source endpoint;

initialize a snooper on at least one client; and

snooping, by the at least one client, data packets transmitted through the endpoint originating from the source endpoint and transmitted through the endpoint destined for the source endpoint, wherein the step of initializing the snooper on the at least one client comprises;

creating, by a java virtual machine within the snooper client, a packet filter definition corresponding to the packet type selected by a user;

sending the packet filter definition to the native operating system layer of the snooper client.

2. A computer program product in a computer readable storage media for use in a data processing system for analyzing network packets, the computer program product comprising:

first instructions for receiving snoop configuration information;

second instructions for configuring an endpoint and a source endpoint;

third instructions for initialize a snooper on at least one client; and

fourth instructions for snooping, by the at least one client, data packets transmitted through the endpoint originating from the source endpoint and transmitted through the endpoint destined for the source endpoint, wherein the third instructions for initializing the snooper on the at least one client comprises;

fifth instructions for creating, by a java virtual machine within the snooper client, a packet filter definition corresponding to the packet type selected by a user;

sixth instructions for sending the packet filter definition to the native operating system layer of the snooper client.

3. A system for analyzing network packets, the system comprising:

first means for receiving snoop configuration information;

second means for configuring an endpoint and a source endpoint;

third means for initialize a snooper on at least one client; and

fourth means for snooping, by the at least one client, data packets transmitted through the endpoint originating from the source endpoint and transmitted through the endpoint destined for the source endpoint, wherein the third means for initializing the snooper on the at least one client comprises;

fifth means for creating, by a java virtual machine within the snooper client, a packet filter definition corresponding to the packet type selected by a user,

sixth means for sending the packet filter definition to the native operating system layer of the snooper client.

4. A system for network packet analyzing, comprising:

at least one remote snooper client;

a snooper manager server controlling execution of the at least one remote snooper client, the snooper manager server comprising a snooper logging database;

a java virtual machine component of a snooper in the at least one remote snooper client; and

a native operating system component of the snooper in the at least one remote snooper client;

wherein

the snooper is configurable by the snooper manager to snoop only certain types of data packets.