Network including snooping

• US 8,055,768 B2
• Filed: 05/27/2011
• Issued: 11/08/2011
• Est. Priority Date: 04/27/2005
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Saunderson, Peter, Smith, John P.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US13/118,010
• Publication Number:
  US 20110231574A1
• Time in Patent Office: 165 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

An apparatus includes: a logic circuit with electronic memory to: monitor signal traffic with at least one client and a computer network to determine, without changing the signal traffic, for each client, a network address and a port to which that client is connected; provide to a first dynamic table the network address and port for each said client; access an authentication server that has a second table of user names and corresponding passwords for network login, in which the second table also includes for each user name and password a corresponding virtual local network (VLAN) membership and/or VLAN tag and/or Quality of Service (QoS); and add to the first dynamic table the user name, VLAN membership, VLAN tag and QoS information learnt from the authentication server in the second table.

Claims

1. As snooping apparatus comprising:

a logic circuit with electronic memory to

monitor signal traffic with at least one client and a computer network to determine, without changing the signal traffic, for each client, a network address and a port to which that client is connected;

provide to a first dynamic table the network address and port for each said client;

access an authentication server that has a second table of user names and corresponding passwords for network login, in which the second table also includes for each user name and password a corresponding virtual local network (VLAN) membership and/or VLAN tag and/or Quality of Service (QoS); and

add to the first dynamic table the user name, VLAN membership, VLAN tag and QoS information learnt from the authentication server in the second table.

2. The snooping apparatus of claim 1, further comprising a network switch, said logic circuit and electronic memory being incorporated in said network switch.

3. The snooping apparatus of claim 2, in which the switch contains a Network Login (802.1x) protocol engine and/or a RADA (RADIUS Authenticated Destination MAC Address) based authentication protocol engine, such that said protocol engine detects a user name and adds said user name to the first dynamic table.

4. The snooping apparatus of claim 2, wherein the switch is a level 2 and/or layer 3 switch of the Open Systems Interconnection (OSI) model.

5. The snooping apparatus of claim 1, wherein said logic circuit retains entries in said first dynamic table in said electronic memory for a predetermined period of time, and, then, discards entries that have remained in the first dynamic table for said predetermined period of time.

6. The snooping apparatus of claim 1, wherein said network address includes an IP address that is provided for the first dynamic table by a Dynamic Host Configuration Protocol (DHCP) response process.

7. The snooping apparatus of claim 1, in which the first dynamic table includes, for each client listed, a MAC address, IP address, virtual local network (VLAN) membership and VLAN tag state.

8. The snooping apparatus of claim 1, wherein said logic circuit:

processes data packets to determine a requested destination address of each packet;

compares the requested destination address to the list of network addresses in the first dynamic table; and

discards a packet if that packet'"'"'s requested destination address is not in the list of network addresses in the first dynamic table.

9. The snooping apparatus of claim 1, in which the logic circuit only forwards a data packet to its destination address if its MAC source address and, for an IP packet, its IP source address are contained in the first dynamic table.

10. A network comprising:

an authentication server;

at least one client;

a network switch; and

a snooping apparatus, said snooping apparatus comprising;

a logic circuit with electronic memory for

monitoring signal traffic with the at least one client and the network to determine, without changing the signal traffic, for each client, a network address and a port of said network switch to which that client is connected;

providing to a first dynamic table the network address and port for each said client;

accessing the authentication server that has a second table of user names and corresponding passwords for network login, in which the second table also includes for each user name and password a corresponding virtual local network (VLAN) membership and/or VLAN tag and/or Quality of Service (QoS); and

adding to the first dynamic table the user name, VLAN membership, VLAN tag and QoS information learnt from the authentication server in the second table.

11. The network of claim 10, in which said snooping apparatus is incorporated in said network switch.

12. The network of claim 10, in which the client runs Voice-over-Internet-Protocol (VoIP) Phone software and said network is a mixed voice data network.

13. The network of claim 10, wherein said logic circuit:

processes data packets to determine a requested destination address of each packet;

compares the requested destination address to the list of network addresses in the first dynamic table; and

discards a packet if that packet'"'"'s requested destination address is not in the list of network addresses in the first dynamic table.

14. The network of claim 10, in which the logic circuit only forwards a data packet to its destination address if its MAC source address and, for an IP packet, its IP source address are contained in the first dynamic table.

15. The network of claim 10, further comprising a management apparatus for controlling the network, said management apparatus having access to the first dynamic table of the snooping apparatus.

16. The network of claim 15, wherein the snooping apparatus informs the management apparatus as soon as a user is added to the first dynamic table and provides to the management apparatus data on connection time, network address and switch port for that user.

17. The network of claim 15, wherein the management apparatus

determines network address information associated with misuse of any network components;

and

identifies a user associated with that network address information associated with the misuse of any network components.

18. The network of claim 15, in which the management apparatus configures entries in the first dynamic table.

19. The network of claim 10, further comprising a Dynamic Host Configuration Protocol (DHCP) server, wherein said network address includes an IP address that is provided for the first dynamic table by the Dynamic Host Configuration Protocol (DHCP) server.