Snoop echo response extractor

• US 8,955,125 B2
• Filed: 11/29/2011
• Issued: 02/10/2015
• Est. Priority Date: 11/22/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brown, Tristan Anthony, Mullen, Shawn Patrick, Vankatsubra, Venkat
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US13/306,794
• Publication Number:
  US 20120079595A1
• Time in Patent Office: 1,169 Days
• Field of Search: 713187-188, 713192-194, 726 22- 25
• US Class Current: 726/23
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A mechanism is provided for identifying a snooping device in a network environment. A snoop echo response extractor generates an echo request packet with a bogus MAC address that will only be received by a snooping device. The snoop echo response extractor also uses an IP address that will cause the snooping device to respond to the echo request.

Claims

1. A computer implemented method for extracting a response from a snooping device in a computer network, the computer implemented method comprising:

generating, by a packet source device in the computer network, an Internet Control Message Protocol echo request packet comprising a source hardware address and a source network protocol address of the packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an Internet Control Message Protocol echo response from the snooping device;

sending, by the packet source device, the Internet Control Message Protocol echo request packet to one or more devices in the computer network;

responsive to receiving an Internet Control Message Protocol echo response packet at the packet source device in the computer network, identifying, by the packet source device, a presence of the snooping device among the one or more devices; and

examining the Internet Control Message Protocol echo response packet to identify a source network address of the snooping device.

2. The computer implemented method of claim 1, wherein generating the Internet Control Message Protocol echo request packet includes selecting the source network protocol address from a subnet, the computer implemented method further comprising:

cycling through network protocol addresses in the subnet and generating an Internet Control Message Protocol echo request packet for each of a plurality of network protocol addresses in the subnet.

3. The computer implemented method of claim 1, wherein the source network protocol address is a broadcast address.

4. The computer implemented method of claim 1, wherein the bogus destination hardware address is a bogus Media Access Control address.

5. The computer implemented method of claim 1, wherein the source network protocol address is an Internet protocol address.

6. The computer implemented method of claim 1, further comprising:

blocking all network traffic originating from the source network address of the snooping device.

19. The computer implemented method of claim 1, wherein the snooping device ignores the bogus destination hardware address in the Internet Control Message Protocol echo request packet, processes the Internet Control Message Protocol echo request packet, and sends the Internet Control Message Protocol echo response packet to the packet source device.

20. The computer implemented method of claim 1, wherein a non-snooping device in the one or more devices discards the Internet Control Message Protocol echo request packet based on the bogus destination hardware address.

7. An apparatus for extracting a response from a snooping device in a computer network, the apparatus comprising:

a processor;

a network adapter operatively coupled to the processor; and

a memory operatively coupled to the processor, wherein the memory has computer instructions stored therein, wherein the processor, under control of the computer instructions, generates an Internet Control Message Protocol echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an Internet Control Message Protocol echo response from the snooping device, sends the Internet Control Message Protocol echo request packet to one or more devices in the computer network using the network adapter, identifies a presence of the snooping device among the one or more devices responsive to receiving an Internet Control Message Protocol echo response packet at the packet source device in the computer network, and examines the Internet Control Message Protocol echo response packet to identify a source network address of the snooping device.

8. The apparatus of claim 7, wherein the processor selects the source network protocol address from a subnet;

and

cycles through network protocol addresses in the subnet and generates an Internet Control Message Protocol echo request packet for each of a plurality of network protocol addresses in the subnet.

9. The apparatus of claim 7, wherein the source network protocol address is a broadcast address.

10. The apparatus of claim 7, wherein the bogus destination hardware address is a bogus Media Access Control address.

11. The apparatus of claim 7, wherein the source network protocol address is an Internet protocol address.

12. The apparatus of claim 7, wherein the processor blocks all network traffic originating from the source network address of the snooping device.

13. A computer program product for extracting a response from a snooping device in a computer network, the computer program product comprising:

a non-transitory computer usable storage medium having computer usable program code stored thereon, the computer usable program code configured to;

generate an Internet Control Message Protocol echo request packet comprising a source hardware address and a source network protocol address of a packet source device, a bogus destination hardware address, and a valid destination network protocol address to elicit an Internet Control Message Protocol echo response from the snooping device;

send the Internet Control Message Protocol echo request packet to one or more devices in the computer network;

identify a presence of the snooping device among the one or more devices responsive to receiving an Internet Control Message Protocol echo response packet at the packet source device in the computer network; and

examine the Internet Control Message Protocol echo response packet to identify a source network address of the snooping device.

14. The computer program product of claim 13, wherein the computer usable program code configured to generate the Internet Control Message Protocol echo request packet includes computer usable program code configured to select the source network protocol address from a subnet, and wherein the computer usable program code further comprises:

computer usable program code configured to cycle through network protocol addresses in the subnet and generate an Internet Control Message Protocol echo request packet for each network protocol address in the subnet.

15. The computer program product of claim 13, wherein the source network protocol address is a broadcast address.

16. The computer program product of claim 13, wherein the bogus destination hardware address is a bogus Media Access Control address.

17. The computer program product of claim 13, wherein the source network protocol address is an Internet protocol address.

18. The computer program product of claim 13, wherein the computer usable program code further comprises:

computer usable program code configured to block all network traffic originating from the source network address of the snooping device.