Network including snooping

• US 7,596,614 B2
• Filed: 07/29/2005
• Issued: 09/29/2009
• Est. Priority Date: 04/27/2005
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Saunderson, Peter, Smith, John P.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US11/192,774
• Publication Number:
  US 20060248229A1
• Time in Patent Office: 1,523 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A computer network including:

• • at least one switch connecting at least one edge device to the remainder of the network, said at least one switch including:
  • snooping apparatus using DHCP to monitor the signal traffic through the switch to or from the each edge device to determine, without changing the traffic signals, for each edge device, the MAC address, the IP address, and the port of the switch to which it is connected, and
  • a dynamic table within said switch of, for each edge device, the MAC address, the IP address, and the port which it is connected, the contents of the table being provided by said snooping apparatus.

Claims

1. A computer network having snooping means to monitor and control illegitimate use of the network and to control quality of service (QoS) access of devices to the remainder of the network, said snooping means including:

at least one switch connecting at least one edge device to the remainder of the network,

said at least one switch including;

snooping apparatus using DHCP to monitor signal traffic through the switch to or from each edge device to determine, without changing the signal traffic, for each edge device, a MAC address, an IP address, and a port of the switch to which it is connected; and

a first dynamic table within said switch of, for each edge device, the MAC address, the IP address, and the port which it is connected, the contents of the first dynamic table being provided by said snooping apparatus; and

an authentication server which includes a second table of user names and their relevant passwords used by Network Login, in which the second table, which includes User and Password information, also includes, for each user name and password, a corresponding virtual local network (VLAN) membership, VLAN tag and QoS profile traffic classification,

wherein the user name, VLAN membership, VLAN tag and QoS profile traffic classification obtained from the authentication server and the second table are added to the first dynamic table.

2. The computer network as claimed in claim 1 in which the switch contains a Network Login (802.1x) protocol engine and/or a RADA (RADIUS Authenticated Destination MAC Address) based authentication protocol engine, which protocol engines detect a user name which is added to the dynamic table.

3. A computer network as claimed in claim 1 in which the switch operates in level 2 and/or layer 3 of the OSI model.

4. The computer network as claimed in claim 1 including means wherein the first dynamic table includes entries which are only retained for a predetermined period of time and then discarded.

5. The computer network as claimed in claim 1 in which the IP address is added to the first dynamic table by a DHCP response process.

6. The computer network as claimed in claim 5 in which the first dynamic table which includes MAC addresses and their corresponding IP addresses, for each MAC addresses and corresponding IP addresses includes the virtual local network (VLAN) membership and VLAN tag state, VLAN information being added to the dynamic table by a DHCP response process and applied to the port with required VLAN tagging.

7. The computer network as claimed in claim 6 in which the switch includes a process that is used to automatically interconnect all the ports that are also in the same VLAN.

8. The computer network as claimed in claim 1 in which the information in the first dynamic table of the switch may be accessed by a management apparatus controlling the network.

9. The computer network as claimed in claim 8 in which the switch informs the management apparatus as soon as a user is added to the first dynamic table and passes data on connection time, the MAC and IP address and switch port information about that user.

10. The computer network as claimed in claim 9 further comprising network components that do not require user login to enable access to Web servers, Web Caches and firewalls.

11. The computer network as claimed in claim 10 in which the management apparatus determines and collates IP address information from misuse of any network components and relate this directly to the users of that network that caused the misuse.

12. The computer network as claimed in claim 8 in which the first dynamic table has entries configured by the management apparatus.

13. The computer network as claimed in claim 12 in which the switch processes data packets being passed to the switch to determine a requested IP address of the destination and compares these to the list of IP addresses in the first dynamic table, the packet being discarded if the IP address requested is not in the list of IP addresses in the first dynamic table.

14. The computer network as claimed in claim 1 in which the edge device comprises a work station or a computer.

15. The computer network as claimed in claim 14 in which the edge device runs IP Phone software and be automatically connected to on a mixed voice data network to keep voice traffic separate from a purely data network and the data network separate from a purely voice network.

16. The computer network as claimed in claim 1 in which the edge device comprises an IP phone.

17. The computer network as claimed in claim 15 in which the switch, via the use of the table, controls access of said computer to a predetermined output ports suitable for the purpose.

18. The computer network as claimed in claim 15 in which the switch, via the use of the table, controls access of said IP phone to a predetermined output ports suitable for the purpose.

19. The computer network as claimed in claim 1 in which a data packet is only forwarded to its destination address if its MAC source address and, for an IP packet, its IP source address is contained in the dynamic table.

20. The computer network as claimed in claim 1 in which the first dynamic table of the switch includes a list of allowed DHCP servers, and for any DHCP server response can check the IP address of the DHCP server against this allowed list and prevent access to the network from this IP address if it is not a valid DHCP server.