Systems and methods for identifying the services of a network

• US 7,730,175 B1
• Filed: 05/12/2004
• Issued: 06/01/2010
• Est. Priority Date: 05/12/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Roesch, Martin, Dempster, Ronald A.
• Primary Examiner(s): Jean; Frantz B
• Application Number:
  US10/843,373
• Time in Patent Office: 2,211 Days
• Field of Search: 709/223, 709/224, 702/186, 713/201, 726/4, 726/23
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.

Claims

1. A method for passively and automatically identifying a service running on a network device of a network, comprising:

reading a packet transmitted by the network device on the network;

decoding the packet into plural protocol fields;

comparing the plural protocol fields to pre-defined protocol fields which collectively identify a service and are stored in a service identifying data structure, the structure and content of the protocol fields being compared, instead of identifying the service from a port of the packet; and

recording a service from the service identifying structure which has protocol fields that match the protocol fields decoded from the packet as the service running on the network device,

the plural protocol fields being application protocol fields.

2. The method of claim 1, wherein the service comprises a domain name server service.

3. The method of claim 2, wherein the plural protocol fields comprise one or more of a domain name server header, a domain name server response bit, an operation code, a z flag, a return code, and a truncated flag.

4. The method of claim 1, further comprising verifying one or more response packets that are sent in response to the packet for structure and content.

5. The method of claim 1, further comprising reporting the service to a network reporting mechanism.

6. The method of claim 5, wherein the network reporting mechanism comprises one or more of an intrusion detection system and a network management system.

7. The method of claim 1, further comprising recording a change to the service.

8. A method for passively and automatically identifying a service running on a network device of a network, comprising:

identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;

identifying one or more packets of the flow as one or more initiator packets;

identifying one or more packets of the flow as one or more responder packets;

if plural protocol fields of the one or more initiator packets match predefined initiator protocol fields which collectively identify the service and if protocol fields of the one or more responder packets match predefined responder protocol fields which collectively identify the service, then identifying the service of the matched protocol fields as a service running on one of the initiator network device and the responder network device,

the structure and content of the plural protocol fields being compared, instead of identifying the service from a port of the packets,

the plural protocol fields being application protocol fields.

9. The method of claim 8, further comprising, if a protocol field of a first initiator packet comprises an error socket port, a protocol field of a first responder packet comprises the error socket port, a protocol field of a second initiator packet comprises a printable username and command, and a second responder packet comprises a one-byte packet, then identifying the service running on the responder network device as a shell service.

10. The method of claim 8, further comprising, if a protocol field of an initiator packet comprises a Web server port, a protocol field of a responder packet comprises a header field identifying a hypertext transport protocol, the identifying the service running on the responder network device as a Web service.

11. The method of claim 8, further comprising identifying a sub service from the service.

12. The method of claim 11, wherein the service comprises a remote procedure call service and the sub service is identified from a sub service field type.

13. The method of claim 8, further comprising reporting the service running on one of the initiator network device and the responder network device to a network reporting mechanism.

14. The method of claim 13, wherein the network reporting mechanism comprises one or more of an intrusion detection system and a network management system.

15. The method of claim 8, further comprising recording a change to the service running on one of the initiator network device and the responder network device.

16. A method for passively and automatically identifying a service running on a network device of a network, comprising:

maintaining a service identifying data structure that comprises one or more predefined protocol fields collectively identifying one or more services;

identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;

comparing plural pre-defined protocol fields, which collectively identify a service, of one or more packets of the flow to the plural protocol fields of the one or more services of the service identifying data structure, the structure and content of the protocol fields being compared instead of identifying the service from a port of the one or more packets; and

recording a service from the service identifying structure which has plural protocol fields that match the plural protocol fields of the one or more packets as the service of one of the initiator network device and the responder network device,

the plural protocol fields being application protocol fields.

17. The method of claim 16, further comprising grouping the one or more services of the service identifying data structure by port number, identifying a flow port number of the one or more packets of the flow, and comparing the one or more protocol fields of one or more packets of the flow to one or more protocol fields of one or more services of the service identifying data structure grouped by the flow port number.

18. The method of claim 16, further comprising grouping the one or more services of the service identifying data structure by a search pattern, identifying a flow search pattern of the one or more packets of the flow, and comparing the one or more protocol fields of one or more packets of the flow to one or more protocol fields of one or more services of the service identifying data structure grouped by the search pattern.

19. The method of claim 16, further comprising reporting the service running on one of the initiator network device and the responder network device to a network reporting mechanism.