Snoop echo response extractor
First Claim
Patent Images
1. A computer implemented method for extracting a response from a snooping device in a computer network, the computer implemented method comprising:
- generating, by a packet source device in the computer network, an echo request packet comprising a source hardware address and a source network protocol address of the packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an echo response from the snooping device;
sending, by the packet source device, the echo request packet to one or more devices in the computer network, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address; and
responsive to receiving the echo response packet at the packet source device in the computer network, identifying, by the packet source device, a presence of a snooping device among the one or more devices.
1 Assignment
0 Petitions
Accused Products
Abstract
A mechanism is provided for identifying a snooping device in a network environment. A snoop echo response extractor generates an echo request packet with a bogus MAC address that will only be received by a snooping device. The snoop echo response extractor also uses an IP address that will cause the snooping device to respond to the echo request. Non-snooping devices discard the echo request packet. Upon receiving the response packet, the snooping device is identified.
-
Citations
18 Claims
-
1. A computer implemented method for extracting a response from a snooping device in a computer network, the computer implemented method comprising:
-
generating, by a packet source device in the computer network, an echo request packet comprising a source hardware address and a source network protocol address of the packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an echo response from the snooping device; sending, by the packet source device, the echo request packet to one or more devices in the computer network, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address; and responsive to receiving the echo response packet at the packet source device in the computer network, identifying, by the packet source device, a presence of a snooping device among the one or more devices. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. An apparatus for extracting a response from a snooping device in a computer network, the apparatus comprising:
-
a processor; a network adapter operatively coupled to the processor; and a memory operatively coupled to the processor, wherein the memory has computer instructions stored therein, wherein the processor, under control of the computer instructions, generates an echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address and a valid destination network protocol address to elicit an echo response from the snooping device, sends the echo request packet to one or more devices in the computer network using the network adapter, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address, and identifies a presence of the snooping device among the one or more devices responsive to receiving the echo response packet at the packet source device in the computer network. - View Dependent Claims (9, 10, 11)
-
-
12. A computer program product for extracting a response from a snooping device in a computer network, the computer program product comprising:
-
a computer usable storage device having computer usable program code stored thereon; computer usable program code configured to generate an echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address and a valid destination network protocol address to elicit an echo response from the snooping device; computer usable program code configured to send the echo request packet to one or more devices in the computer network, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address; computer usable program code configured to identify a presence of the snooping device among the one or more devices responsive to receiving the echo response packet at the packet source device in the computer network. - View Dependent Claims (13, 14, 15, 16, 17, 18)
-
Specification