Snoop echo response extractor

• US 8,082,586 B2
• Filed: 11/22/2005
• Issued: 12/20/2011
• Est. Priority Date: 11/22/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mullen, Shawn Patrick, Venkatsubra, Venkat, Brown, Tristan Anthony
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Jeudy, Josnel
• Application Number:
  US11/284,682
• Publication Number:
  US 20070118908A1
• Time in Patent Office: 2,219 Days
• Field of Search: 711/146, 711/100, 711/117, 711/118, 711/141, 713151-154, 713187-188, 713193-194, 713160-163, 709/249, 709/389, 709227-229, 726/1, 726 26- 33, 726 22- 25
• US Class Current: 726/23
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A mechanism is provided for identifying a snooping device in a network environment. A snoop echo response extractor generates an echo request packet with a bogus MAC address that will only be received by a snooping device. The snoop echo response extractor also uses an IP address that will cause the snooping device to respond to the echo request. Non-snooping devices discard the echo request packet. Upon receiving the response packet, the snooping device is identified.

Claims

1. A computer implemented method for extracting a response from a snooping device in a computer network, the computer implemented method comprising:

generating, by a packet source device in the computer network, an echo request packet comprising a source hardware address and a source network protocol address of the packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an echo response from the snooping device;

sending, by the packet source device, the echo request packet to one or more devices in the computer network, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address; and

responsive to receiving the echo response packet at the packet source device in the computer network, identifying, by the packet source device, a presence of a snooping device among the one or more devices.

2. The computer implemented method of claim 1, wherein generating an echo request packet includes selecting the valid network protocol address from a subnet, the computer implemented method further comprising:

cycling through network protocol addresses in the subnet and generating an echo request packet for each of a plurality of network protocol addresses in the subnet.

3. The computer implemented method of claim 1, wherein the valid destination network protocol address is a broadcast address.

4. The computer implemented method of claim 1, wherein the bogus destination hardware address is a bogus Media Access Control address.

5. The computer implemented method of claim 1, wherein the valid destination network address is an Internet protocol address.

6. The computer implemented method of claim 1, further comprising:

examining the echo response packet to identify a source network address of the snooping device.

7. The computer implemented method of claim 6, further comprising:

blocking all network traffic originating from the source network address of the snooping device.

8. An apparatus for extracting a response from a snooping device in a computer network, the apparatus comprising:

a processor;

a network adapter operatively coupled to the processor; and

a memory operatively coupled to the processor, wherein the memory has computer instructions stored therein, wherein the processor, under control of the computer instructions, generates an echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address and a valid destination network protocol address to elicit an echo response from the snooping device, sends the echo request packet to one or more devices in the computer network using the network adapter, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address, and identifies a presence of the snooping device among the one or more devices responsive to receiving the echo response packet at the packet source device in the computer network.

9. The apparatus of claim 8, wherein the processor selecting the valid network protocol address from a subnet;

and

cycles through network protocol addresses in the subnet and generates an echo request packet for each of a plurality of network protocol addresses in the subnet.

10. The apparatus of claim 8, wherein the bogus destination hardware address is a bogus Media Access Control address.

11. The apparatus of claim 8, wherein the processor examines the echo response packet to identify a source network address of the snooping device and blocks all network traffic originating from the source network address of the snooping device.

12. A computer program product for extracting a response from a snooping device in a computer network, the computer program product comprising:

a computer usable storage device having computer usable program code stored thereon;

computer usable program code configured to generate an echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address and a valid destination network protocol address to elicit an echo response from the snooping device;

computer usable program code configured to send the echo request packet to one or more devices in the computer network, wherein the snooping device ignores the bogus destination hardware address in the echo request packet, processes the echo request packet, and sends an echo response packet to the packet source device, and wherein a non-snooping device in the one or more devices discards the echo request packet based on the bogus destination hardware address;

computer usable program code configured to identify a presence of the snooping device among the one or more devices responsive to receiving the echo response packet at the packet source device in the computer network.

13. The computer program product of claim 12, wherein the computer usable program code configured to generate an echo request packet includes computer usable program code configured to select the valid network protocol address from a subnet, the computer program product further comprising:

computer usable program code configured to cycle through network protocol addresses in the subnet and generate an echo request packet for each network protocol address in the subnet.

14. The computer program product of claim 12, wherein the valid destination network protocol address is a broadcast address.

15. The computer program product of claim 12, wherein the bogus destination hardware address is a bogus Media Access Control address.

16. The computer program product of claim 12, wherein the valid destination network address is an Internet protocol address.

17. The computer program product of claim 12, further comprising:

computer usable program code configured to examine the echo response packet to identify a source network address of the snooping device.

18. The computer program product of claim 17, further comprising:

computer usable program code configured to block all network traffic originating from the source network address of the snooping device.