Methods, apparatuses and systems facilitating management of airspace in wireless computer network environments

• US 8,576,812 B2
• Filed: 10/09/2007
• Issued: 11/05/2013
• Est. Priority Date: 02/18/2003
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Gray, Gordon P., Luther, Jason E., Augustine, Daniel T.
• Primary Examiner(s): PARK, JUNG H
• Application Number:
  US11/869,624
• Publication Number:
  US 20090028118A1
• Time in Patent Office: 2,219 Days
• Field of Search: 370/230, 370/229, 370/328, 370/341
• US Class Current: 370/338
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 5/0058 Allocation criteria
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Methods, apparatuses and systems facilitating the management of wireless computer network environments and the detection of rogue and other devices that may affect the performance and/or security of the wireless computer network. The present invention enables accurate and cost effective WLAN airspace mapping. In one embodiment, the present invention allows any conforming access point the ability to routinely scan its airspace, collect data on all operating frequencies and report this information back to a management platform. In one embodiment, the management and reporting functionality described herein uses a standards-based vehicle, such as Simple Network Management Protocol (SNMP). In one embodiment, the present invention facilitates isolation of rogue wireless devices affecting the computer network environment and effective decision-making as to management of the detected device. The present invention also allows network administrators to optimize the configuration of the wireless network environment for performance and security.

Claims

1. A wireless access point, comprising:

a hardware processor;

a wireless communications transmit/receive unit;

wherein the wireless access point is configured for;

operating in a first mode by communicating wirelessly with at least one wireless client device to provide the at least one wireless client device access to resources;

wherein providing access to resources comprises receiving one or more data packets from the at least one wireless client device and forwarding the one or more data packets;

switching from the first mode to a second mode;

wherein the wireless access point is switched, from (i) the first mode in which a lower layer in an Operating System executing on the wireless access point is configured at least for forwarding packets received from devices within a particular Basic Service Set to higher layers in the operating system to (ii) the second mode in which the wireless access point is configured at least for monitoring wireless traffic regardless of network association of the wireless traffic;

operating in the second mode by monitoring for data packets addressed at least to wireless devices other than the wireless access point to identify one or more wireless devices within a radio coverage area of the wireless access point and reporting the identified one or more wireless devices.

2. The wireless access point of claim 1, wherein the wireless access point does not provide access to resources to any wireless client device while operating in the second mode.

3. The wireless access point of claim 1, wherein the wireless access point does not transmit data while operating in the second mode.

4. The wireless access point of claim 1, wherein the identifying of the one or more wireless devices include monitoring wireless traffic within the radio coverage area, the wireless traffic comprises wireless signals directed to a wireless device other than the wireless access point.

5. The wireless access point of claim 1, wherein the identifying of the one or more wireless devices comprises identifying a first wireless device transmitting wireless signals on a first channel and identifying a second wireless device transmitting wireless signals on a second channel.

6. The wireless access point of claim 1, wherein the identified one or more wireless devices comprises a first wireless client device transmitting wireless signals to a second wireless access point that is associated with the first wireless client device, the second wireless access point being different than said wireless access point.

7. A method comprising:

communicating wirelessly, by a wireless access point operating in a first mode, with at least one wireless client device to provide access to resources by receiving one or more data packets and forwarding the one or more data packets;

switching, by the wireless access point, from the first mode to a second mode configured for monitoring wireless traffic with a radio coverage area, subsequent to communicating wirelessly with the at least one wireless client device;

wherein the switching by the wireless access point occurs from (i) the first mode in which a lower layer in an Operating System executing on the wireless access point is configured at least for forwarding packets received from devices within a particular Basic Service Set to higher layers in the operating system to (ii) the second mode in which the wireless access point is configured at least for monitoring wireless traffic regardless of network association of the wireless traffic;

subsequent to the communicating and switching steps, operating in the second mode by monitoring for data packets addressed to at least wireless devices other than the wireless access point to identify one or more wireless devices within the radio coverage area of the wireless access point and reporting the identified one or more wireless devices;

wherein the wireless access point comprises a hardware processor.

8. The method of claim 7, wherein the wireless access point does not provide access to resources to any wireless client device while operating in the second mode.

9. The method of claim 7, wherein the wireless access point does not transmit data while operating in the second mode.

10. The method of claim 7, wherein the identifying of the one or more wireless devices include monitoring wireless traffic within the radio coverage area, the wireless traffic comprises management packets and data packets directed to a wireless device other than the wireless access point.

11. The method of claim 7, wherein the identifying of the one or more wireless devices comprises identifying a first wireless device transmitting wireless signals on a first channel and identifying a second wireless device transmitting wireless signals on a second channel.

12. The method of claim 7, wherein the identified one or more wireless devices comprises a first wireless client device associated with a second wireless access point different than said wireless access point.

13. A non-transitory computer readable storage medium comprising instructions which, when executed by one or more processors within a device, is configured to cause performance of:

operating in a first mode, communicating wirelessly with at least one wireless client device to provide access to resources, wherein providing access to resources comprises receiving one or more data packets from the at least one wireless client device and forwarding the one or more data packets;

switching, from the first mode to a second mode;

wherein the wireless access point is switched, from (i) the first mode in which a lower layer in an Operating System executing on the wireless access point is configured at least for forwarding packets received from devices within a particular Basic Service Set to higher layers in the operating system to (ii) the second mode in which the wireless access point is configured at least for monitoring wireless traffic regardless of network association of the wireless traffic;

operating in a second mode by monitoring for data packets addressed at least to wireless devices other than the wireless access point to identify one or more wireless devices within a radio coverage area of the wireless access point and reporting the identified one or more wireless devices.

14. The non-transitory computer readable storage medium of claim 13, wherein the device restricts access to resources to any wireless client device while the device is operating in the second mode.

15. The non-transitory computer readable storage medium of claim 13, wherein the device does not transmit data while the device is operating in the second mode.

16. The non-transitory computer readable storage medium of claim 13, wherein the identifying of the one or more wireless devices by the device further comprises monitoring wireless traffic within the radio coverage area, the wireless traffic comprises wireless signals directed to a wireless device other than the wireless access point.

17. The non-transitory computer readable storage medium of claim 13, wherein the identifying of the one or more wireless devices by the device comprises identifying a first wireless device transmitting wireless signals on a first channel and identifying a second wireless device transmitting wireless signals on a second channel.

18. The non-transitory computer readable storage medium of claim 13, wherein the identified one or more wireless devices comprises a first wireless client device associated with a second wireless access point different than said wireless access point.