Detection of wireless devices

• US 7,570,625 B1
• Filed: 01/10/2006
• Issued: 08/04/2009
• Est. Priority Date: 01/10/2006
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: TW Acquisition Inc.
• Inventors: Ocepek, Steven R.
• Primary Examiner(s): Phan; Huy Q
• Application Number:
  US11/329,786
• Time in Patent Office: 1,302 Days
• Field of Search: 370/338, 370/328, 370/229, 370/230, 370/310, 370/310.2, 370/349, 455/422.1, 455/423, 455/9, 455/67.11
• US Class Current: 370/338
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A method, system, apparatus, and computer-readable medium to determine whether a device having access to a network is wireless. A method for determining whether a device is wireless includes sending a specially-constructed packet to the device via a network. The packet is constructed so that the source address for the packet is a physical address on the network for the device. If the device does not send a response to the packet, a determination is made that the device is wireless. If the device sends a response to the packet, a determination is made that the device is wired. In one embodiment of the invention, the physical address for the device is a Media Access Control (MAC) address. The initial packet may, for example, request the physical address for the device and may be sent in response to detecting a communication to or from the suspect device.

Claims

1. A method comprising:

sending a packet to a device via a network, wherein

the packet comprises a source address, and

the source address is a physical address on the network for the device;

if the device does not send a response to the packet,

determining that the device is wireless.

2. The method of claim 1, wherein

the physical address is a MAC address.

3. The method of claim 1, wherein

the sending of the packet is performed in response to a determination that the device has been sent information via the network.

4. The method of claim 1, wherein

the sending of the packet is performed in response to a determination that the device has sent information via the network.

5. The method of claim 1 further comprising:

if the device is wireless, querying at least one network device to identify a network connection to the device; and

using the network connection to locate a wireless access point associated with the network connection.

6. The method of claim 5 further comprising:

disabling the wireless access point.

7. The method of claim 1 further comprising:

if the device is wireless, limiting access to the network by the device.

8. The method of claim 1 further comprising:

if the device is wireless, preventing access to the network by the device.

9. The method of claim 1 further comprising:

formulating the packet such that the source address is the physical address on the network for the device and the packet includes a request message that asks the device to identify an address that corresponds to the device'"'"'s IP address.

10. The method of claim 1 further comprising:

if the device sends the response, determining that the device is wired.

11. A system comprising:

packet-sending means for sending a packet to a device via a network, wherein

the packet comprises a source address, and

the source address is a physical address on the network for the device;

response-determining means for determining whether the device sends a response to the packet; and

type-determining means for determining that the device is wireless if the device does not send the response.

12. The system of claim 11 wherein

the type-determining means determines that the device is wired if the device does send the response.

13. The system of claim 11 further comprising:

suspect-identifying means to identify the device as a suspect device if one of the following is true;

the device has been sent information via the network; and

the device has sent information via the network.

14. The system of claim 11 further comprising:

querying means for querying at least one network device to identify a network connection to the device if the device is wireless; and

using means for using the network connection to locate a wireless access point associated with the network connection.

15. The system of claim 14 further comprising:

disabling means for disabling the wireless access point.

16. The system of claim 11 further comprising:

formulating means for formulating the packet such that the source address is the physical address on the network for the device and the packet includes a request message that asks the device to identify an address that corresponds to the device'"'"'s IP address.

17. A computer-readable medium comprising computer instructions for execution on a processor, wherein the instructions comprise:

packet-sending instructions configured to send a packet to a device via a network, wherein

the packet comprises a source address, and

the source address is a physical address on the network for the device;

response-determining instructions configured to determine whether the device sends a response to the packet; and

type-determining instructions configured to determine that the device is wireless if the device does not send the response.

18. The computer-readable medium of claim 17 wherein

the type-determining instructions are configured to determines that the device is wired if the device does send the response.

19. The computer-readable medium of claim 17 further comprising:

suspect-identifying instructions configured to identify the device as a suspect device if one of the following is true;

the device has been sent information via the network; and

the device has sent information via the network.

20. The computer-readable medium of claim 17 further comprising:

querying instructions configured to query at least one network device to identify a network connection to the device if the device is wireless; and

using instructions configured to use the network connection to locate a wireless access point associated with the network connection.

21. The computer-readable medium of claim 20 further comprising:

disabling instructions configured to disable the wireless access point.

22. The computer-readable medium of claim 17 further comprising:

formulating instructions configured to formulate the packet such that the source address is the physical address on the network for the device and the packet includes a request message that asks the device to identify an address that corresponds to the device'"'"'s IP address.

23. A computer system comprising:

a processor for executing instructions; and

the computer-readable medium of claim 17.

24. A system comprising:

a packet-sending module configured to send a packet to a device via a network, wherein the packet comprises a source address, and

the source address is a physical address on the network for the device;

a response-determining module configured to determine whether the device sends a response to the packet; and

a type-determining module configured to determine that the device is wireless if the device does not send the response.

25. The system of claim 24 wherein

the type-determining module is configured to determine that the device is wired if the device does send the response.

26. The system of claim 24 further comprising:

a suspect-identifying module configured to identify the device as a suspect device if one of the following is true;

the device has been sent information via the network; and

the device has sent information via the network.

27. The system of claim 24 further comprising:

a querying module configured to query at least one network device to identify a network connection to the device if the device is wireless; and

a using module configured to use the network connection to locate a wireless access point associated with the network connection.

28. The system of claim 27 further comprising:

a disabling module configured to disable the wireless access point.

29. The system of claim 24 further comprising:

a formulating module configured to formulate the packet such that the source address is the physical address on the network for the device and the packet includes a request message that asks the device to identify an address that corresponds to the device'"'"'s IP address.