Network address repository management

• US 8,954,573 B2
• Filed: 04/11/2012
• Issued: 02/10/2015
• Est. Priority Date: 04/11/2012
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, James Michael IV, Keir, Robin, Rebelo, Joshua Cajetan, Arkin, Ofir, Schrecker, Sven
• Primary Examiner(s): Golabbakhsh, Ebrahim
• Application Number:
  US13/444,459
• Publication Number:
  US 20130275575A1
• Time in Patent Office: 1,035 Days
• Field of Search: 709/220, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A first Internet protocol version 6 (IPv6) address of a particular computing device within a network is identified using a first passive discovery sensor performing a first discovery task. A second discovery task is caused to be performed using the first IPv6 address and an attribute of the particular computing device is identified from results of the second discovery task. The first IPv6 address and attribute of the particular device is added to a repository maintaining a record of detected IPv6 addresses within the network. In some instances, a first passive discovery sensor can be one of an event-based discovery sensor, a latent-type discovery sensor, and an indirect-type discovery sensor.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a first internet protocol version 6 (IPv6) address of a particular computing device within a network discovered through a first discovery task performed by a first passive discovery sensor, wherein the first passive discovery sensor is an instance of a particular one of a plurality of pluggable sensors for use in connection with one or more asset detection engines deployed in the network;

cause a second discovery task to be performed by a second discovery sensor, based on the first IPv6 address, wherein the second discovery sensor is an instance of another one of the plurality of pluggable sensors;

identify an attribute of the particular computing device from results of the second discovery task; and

add the first IPv6 address and attribute of the particular device to a repository to comprise records of detected IPv6 addresses within the network.

2. The storage medium of claim 1, wherein the second discovery task is to be performed in accordance with a predetermined discovery task sequence, and the second discovery task is subsequent to the first discovery task in the sequence.

3. The storage medium of claim 2, wherein the second discovery task is to be performed in the sequence in response to identification of an IPv6 address using the first discovery task.

4. The storage medium of claim 1, wherein the second discovery task comprises an active discovery task, the second discovery sensor comprises an instance of an active discovery sensor within the plurality of pluggable sensors, and the second discovery task includes sending data to the particular computing device at the first IPv6 address and monitoring responses of the particular computing device to the sent data.

5. The storage medium of claim 1, wherein the attribute includes another address of the particular computing device.

6. The storage medium of claim 2, wherein the other address is of a type other than IPv6.

7. The storage medium of claim 6, wherein the other address is to be used to determine a second IPv6 address of the particular computing device.

8. The storage medium of claim 7, wherein the other address is a domain name service (DNS) name of the particular computing device, the second discovery task includes a reverse DNS query using the first IPv6 address, and the second IPv6 address is determined from a DNS query using the DNS name.

9. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to determine whether the particular computing device is already identified in the repository, wherein the second discovery task is performed in response to determining that the particular computing device was an undiscovered computing device on the network prior to the identification of the first IPv6 address.

10. The storage medium of claim 1, wherein the first discovery task is an event-based discovery task identifying IPv6 addresses from event record data describing events in the network identified by event management services on the network.

11. The storage medium of claim 10, wherein the first passive discovery sensor is adapted to access event record data of at least one of dynamic host configuration protocol (DHCP) server events, Active Directory audit events, firewall events, and intrusion prevention system (IPS) events.

12. The storage medium of claim 1, wherein the first discovery task is a latent-type discovery task identifying IPv6 addresses from network traffic monitored by the first passive discovery sensor.

13. The storage medium of claim 12, wherein the first passive discovery sensor is adapted to monitor at least one of NetBIOS broadcast packets in the network traffic, internet control message protocol version 6 (ICMPv6) network traffic, and network traffic via port mirroring.

14. The storage medium of claim 1, wherein the first discovery task is an indirect-type discovery task identifying IPv6 addresses from querying records of network services of the network hosted remote from the particular computing device.

15. The storage medium of claim 14, wherein the first passive discovery sensor is adapted to at least one of:

query a simple network management protocol (SNMP) management information base (MIB), query a DHCP database, query a MAC address table, and issue a netstat command on another computing device in the network.

16. The storage medium of claim 1, wherein each asset detection engine includes two or more pluggable sensors from the plurality of pluggable sensors, wherein the plurality of pluggable sensors comprise active discovery sensors, latent discovery sensors, event-based discovery sensors, and indirect discovery sensors.

17. The storage medium of claim 1, wherein the first passive discovery sensor is a included on a particular asset detection engine, the second discovery task is to be performed by the second discovery sensor, the second discovery sensor is also included on the particular asset detection engine, and the second discovery sensor is of a type different from the first discovery sensor.

18. A method comprising:

identifying a first IPv6 address of a particular computing device within a network discovered through a first discovery task performed by a first passive discovery sensor, wherein the first passive discovery sensor is an instance of a particular one of a plurality of pluggable sensors for use in connection with one or more asset detection engines deployed in the network;

causing a second discovery task to be performed by a second discovery sensor, based on the first IPv6 address, wherein the second discovery sensor is an instance of another one of the plurality of pluggable sensors;

identifying an attribute of the particular computing device from results of the second discovery task; and

adding the first IPv6 address and attribute of the particular device to a repository maintaining a record of detected IPv6 addresses within the network.

19. A system comprising:

at least one processor device;

at least one memory element;

an asset detection engine to use a plurality of pluggable sensors, wherein the plurality of sensors comprise a particular passive discovery sensor and a second discovery sensor, wherein the particular passive discovery sensor is of a type different from the second discovery sensor; and

an asset management system, adapted when executed by the at least one processor device to;

identify a first IPv6 address of a particular computing device within a network discovered through a first discovery task performed by the particular passive discovery sensor;

cause a second discovery task to be performed by the second discovery sensor using the first IPv6 address;

identify an attribute of the particular computing device from results of the second discovery task; and

add the first IPv6 address and attribute of the particular device to a repository to comprise records of detected IPv6 addresses within the network.

20. The system of claim 19, wherein the second discovery sensor comprises a particular active discovery sensor, and causing the second discovery task to be performed includes identifying the particular active discovery sensor adapted to perform the second discovery task and invoking the particular active discovery sensor to perform the second discovery task using the first IPv6 address.

21. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

maintain a repository of device information for a plurality of devices in a network, wherein the device information is to include a corresponding internet protocol version 6 (IPv6) address for each of the plurality of devices;

receive, from a particular passive discovery sensor included in a plurality of sensors, reporting data identifying a first IPv6 address of a particular computing device within the network discovered through a first discovery task performed by the particular passive discovery sensor;

send data to a particular active discovery sensor in the plurality of sensors to initiate a second discovery task to be performed by the particular active discovery sensor based on discovery of the first IPv6 address, wherein the data identifies the first IPv6 address and the second discovery task is based on the first IPv6 address;

receive, from the particular active discovery sensor, reporting data identifying an attribute of the particular computing device from results of the second discovery task;

initiate a third discovery task based on the attribute, wherein results of the third discovery task identify another IPv6 address; and

add the first IPv6 address and attribute of the particular device to a repository maintaining a record of detected IPv6 addresses within the network.