Promiscuous monitoring using internet protocol enabled devices

• US 8,331,240 B2
• Filed: 11/08/2007
• Issued: 12/11/2012
• Est. Priority Date: 11/08/2007
• Status: Active Grant

• Current Assignee: Stingray IP Solutions LLC (Acacia Research Corporation)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Voglewede, Paul, Roth, Peter J.
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): Liu, Jung-Jen
• Application Number:
  US11/937,002
• Publication Number:
  US 20090122709A1
• Time in Patent Office: 1,860 Days
• Field of Search: 370/203, 370216-228, 370229-237, 370241-249, 370254-258, 370310-329, 370339-349, 3703951-3955, 370431-441
• US Class Current: 370/241
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses

Abstract

A method (500) is provided for enabling a promiscuous monitoring of network communications by a monitor node (MN). The method includes the steps of: generating a directed IP packet at a first node (FN); transmitting a first unicast signal including a RTS message from the FN to a second node (SN); transmitting a second unicast signal including a CTS message from the SN to the FN in response to the first unicast signal; modifying the directed IP packet by changing an IP destination address of the directed IP packet to an IP subnet broadcast address; transmitting a uni-broadcast signal including the modified directed IP packet from the FN to the IP subnet broadcast address; and receiving the uni-broadcast signal at the SN and a third node (TN). The TN is an IP-enabled device provided to monitor network communications between the FN and SN.

Claims

1. A method for enabling a promiscuous monitoring of network communications by an IP-enabled device that ignores received messages directed to unicast addresses of other devices, comprising:

detecting, by a first node, a physical intrusion within a predetermined geographic area;

in response to said detection of said physical intrusion, performing by said first node a plurality of operations including

generating a directed IP packet comprising an IP destination address for a second node;

establishing a unicast communications session with said second node in anticipation of communicating said directed IP packet exclusively to said second node;

subsequent to establishing said unicast communications session, modifying said directed IP packet by changing said IP destination address of said directed IP packet to an IP subnet broadcast address of said second node;

transmitting within said unicast communication session a uni-broadcast signal including said directed IP packet that has been modified to said second node using said IP subnet broadcast address;

receiving said uni-broadcast signal at said second node as a unicast transmission and at a monitoring node as a broadcast transmission, wherein said monitoring node is said IP-enabled device configured to monitor communications between said first and second nodes; and

processing said directed IP packet that has been modified at said second and said monitoring nodes, wherein said directed IP packet is processed at said monitoring node as broadcast traffic and said directed IP packet is processed at said second node as unicast traffic.

2. The method according to claim 1, wherein said modifying said directed IP packet step further comprises selecting said IP destination address to be an IP destination address of a network layer protocol header.

3. The method according to claim 1, wherein said unicast communications session is established by transmitting a first unicast signal including a request to send message from said first node to said second node.

4. The method according to claim 3, wherein said transmitting said first unicast signal further comprises transmitting a MAC layer signal burst including said request to send message from said first node to said second node.

5. The method according to claim 3, wherein said unicast communications session is further established by transmitting said second unicast signal including a clear to send message from said second node to said first node in response to said first unicast signal.

6. The method according to claim 5, wherein said transmitting a second unicast signal further comprises transmitting a MAC layer signal burst including said clear to send message from said second node to said first node.

7. The method according to claim 1, wherein said transmitting a uni-broadcast signal further comprises transmitting a MAC layer data burst including said directed IP packet that has been modified from said first node to said IP subnet broadcast address.

8. The method according to claim 1, further comprising the step of transmitting a unicast signal including a drop link message from said second node to said first node after said second node receives said uni-broadcast signal.

9. The method according to claim 1, further comprising selecting said second node to be a relay node that is part of a route to a central node.

10. A method for enabling a promiscuous monitoring of network communications by an IP-enabled device that ignores received messages directed to unicast addresses of other devices, comprising:

detecting, by a first node, a physical intrusion within a predetermined geographic area;

in response to said detection of said physical intrusion, performing by said first node a plurality of operations including

generating a directed IP packet comprising an IP destination address for a second node;

transmitting a first unicast signal including a request to send message to said second node for establishing a unicast communication session with said second node;

receiving a second unicast signal including a clear to send message from said second node;

in response to receiving said clear to send message, modifying said directed IP packet by changing said IP destination address of said directed IP packet to an IP subnet broadcast address of said second node; and

transmitting within said unicast communication session a uni-broadcast signal including said directed IP packet that has been modified to said-second node using said IP subnet broadcast address;

receiving said uni-broadcast signal at said second node as a unicast transmission and at a monitoring node as a broadcast transmission, wherein said monitoring node is said IP-enabled device configured to monitor communications between said first and second nodes; and

processing said directed IP packet at said second and said monitoring nodes, wherein said directed IP packet is processed at said monitoring node as broadcast traffic and said directed IP packet is processed at said second node as unicast traffic.

11. The method according to claim 10, wherein said modifying said directed IP packet step further comprises selecting said IP destination address to be an IP destination address of a network layer protocol header.

12. The method according to claim 10, wherein said transmitting said first unicast signal further comprises transmitting a MAC layer signal burst including said request to send message from said first node to said second node.

13. The method according to claim 10, wherein said transmitting said second unicast signal further comprises transmitting a MAC layer signal burst including said clear to send message from said second node to said first node.

14. The method according to claim 10, wherein said transmitting said uni-broadcast signal further comprises transmitting a MAC layer data burst including said directed IP packet that has been modified from said first node to said IP subnet broadcast address.

15. The method according to claim 10, further comprising transmitting a unicast signal including a drop link message from said second node to said first node after said second node receives said uni-broadcast signal.

16. The method according to claim 10, further comprising selecting said second node to be a relay node that is part of a route to a central node.