Method and system for detecting wireless access devices operably coupled to computer local area networks and related methods

• US 7,440,434 B2
• Filed: 12/29/2004
• Issued: 10/21/2008
• Est. Priority Date: 02/11/2004
• Status: Expired due to Fees

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Mittal, Sharad, Chaskar, Hemant, Bhagwat, Pravin, Jonnalagadda, Murthy
• Primary Examiner(s): Wilson; Robert W
• Application Number:
  US11/026,960
• Publication Number:
  US 20050195753A1
• Time in Patent Office: 1,392 Days
• Field of Search: None
• US Class Current: 370/338
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A system and method is provided for detecting wireless access devices coupled to local area network of computers. The method includes coupling a sniffer device to a local area network. The method includes transferring one or more packets to be directed to a selected device over the local area network. The selected device is preferably coupled to the local area network. The method includes intercepting the one or more packets to be directed to the selected device at the sniffer device. Moreover, the method includes deriving information from the intercepted one or more packets using the sniffer device. The method can generate one or more marker packets in a selected format using the sniffer device. The marker packets are provided based upon at least a portion of the information derived from the intercepted packets. The method includes transferring the one or more marker packets from the sniffer device over the local area network to the selected device and monitoring an airspace within a vicinity of the selected device using one or more sniffer devices.

Claims

1. A method for monitoring wireless access to local area network of computers, the method comprising:

intercepting one or more packets over a wired portion of a local area network, the one or more packets being directed to a destination port on a selected device coupled to the wired portion of the local area network, the destination port being identified via a destination port number included in the one or more intercepted packets;

determining the destination port number from the intercepted one or more packets;

generating one or more packets in a selected format and being directed to the destination port on the selected device, the destination port being identified in the generated one or more packets via the destination port number determined from the intercepted one or more packets;

transferring the generated one or more packets over the wired portion of the local area network to the selected device, the transferring being for testing whether the selected device outputs at least one packet from the transferred one or more packets to a wireless medium within a vicinity of the selected device;

monitoring the wireless medium within the vicinity of the selected device; and

inferring that the selected device is coupled to the wired portion of the local area network to provide wireless access to the wired portion of the local area network, the inferring being based in part upon the at least one packet from the transferred one or more packets being detected as outputted to the wireless medium.

2. The method of claim 1 wherein the intercepting the one or more packets comprising routing the one or more packets directed to the destination port on the selected device through another device coupled to the wired portion of the local area network.

3. The method of claim 2 wherein the intercepting comprising Address Resolution Protocol (ARP) poisoning, the ARP poisoning associating an IP address of the selected device with a MAC address of the another device.

4. The method of claim 1 wherein:

the intercepted one or more packets being Transmission Control Protocol (TCP) packets;

the destination port on the selected device being a TCP port on the selected device; and

the generated one or more packets being TCP packets.

5. The method of claim 1 wherein:

the intercepted one or more packets being User Datagram Protocol (UDP) packets;

the destination port on the selected device being a UDP port on the selected wireless device; and

the generated one or more packets being UDP packets.

6. The method of claim 1 wherein the selected format comprises a selected bit pattern in a packet.

7. The method of claim 1 wherein the selected format comprises a selected size of a packet.

8. The method of claim 1 wherein the selected format comprises a set of selected sizes associated with a set of one or more packets.

9. The method of claim 1 wherein the selected format comprises a set of selected bit patterns associated with a set of one or more packets.

10. The method of claim 1 wherein the selected format comprises a set of time instants associated with a set of packets.

11. The method of claim 10 wherein the set of time instants is associated with the transferring the one or more packets to the wired portion of the local area network.

12. The method of claim 1 wherein the intercepting the one or more packets over the wired portion of the local area network is performed using a first sniffer device coupled to the wired portion of the local area network.

13. The method of claim 12 wherein the monitoring the wireless medium within the vicinity of the selected device is performed using a second sniffer device.

14. The method of claim 13 wherein the second sniffer device is same as the first sniffer device.

15. The method of claim 13 wherein the second sniffer device is different from the first sniffer device.

16. The method of claim 15 wherein the first sniffer device and the second sniffer device are in communication with a server device.

17. The method of claim 1 wherein the monitoring the wireless medium within the vicinity of the selected device comprising:

receiving one or more packets transmitted over the wireless medium; and

processing the one or more packets received to identify the selected format in the one or more packets.