Host information collection

• US 9,391,858 B2
• Filed: 10/06/2009
• Issued: 07/12/2016
• Est. Priority Date: 09/03/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Narasimhan, Srinivasan, Hejmadi, Parthiv, Porwal, Vinod Kumar A.
• Primary Examiner(s): Bengzon, Greg C
• Application Number:
  US12/574,082
• Publication Number:
  US 20110055381A1
• Time in Patent Office: 2,471 Days
• Field of Search: 709223-225, 726/1, 726 5- 7, 726 26- 29
• US Class Current: 1/1
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for collecting information of host devices. In one aspect, a method includes transmitting a plurality of information probes to the host device, including an agent probe that queries an agent installed on the host device for a unique agent identifier, monitoring for replies to the information probes from the host device during the host detection phase, ending the host detection phase in response to receiving a reply to the agent probe and that includes the unique agent identifier, resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period and ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.

Claims

1. A method comprising:

receiving data indicating a host device is connecting to a network;

initiating a host detection phase for the host device, wherein network access for the host device is restricted during the host detection phase for the host device; and

collecting host attributes of the host device during the host detection phase using one of at least two peer sensors, wherein collecting host attributes of the host device includes;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that attempts to identify whether one or more agents is installed on the host device, wherein each of the agents has a corresponding unique agent identifier value, attempting to identify one or more agents installed on the host device includes querying the host device for the unique agent identifier value of any agents installed on the host device, and each of the information probes requests one or more other host attributes; and

monitoring for replies to the information probes from the host device during the host detection phase;

wherein each of the one or more agents is configured to assess configuration of the host on which the agent is installed and report configuration information describing the configuration, the agent probe has a higher priority than other information probes in the plurality of information probes, receiving a reply to the agent probe including at least one unique agent identifier causes the host detection phase to end based on the higher priority of the agent probe, ending the host detection phase causes the other lower priority information probes in the plurality of information probes not to be resent to the host device, not receiving a reply to the agent probe after expiration of a time period causes at least a portion of the other information probes in the plurality of information probes to be resent to the host device, a repeat counter is to be incremented to indicate a number of repeat attempts of one or more of the plurality of information probes, and the host detection phase is ended upon a value of the repeat counter exceeding a maximum repeat value.

2. The method of claim 1, further comprising, during the detection phase:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

3. The method of claim 1, further comprising, during the detection phase:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.

4. The method of claim 3, further comprising, during the detection phase:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

5. The method of claim 3, wherein the plurality of information probes further include an NBTSTAT query.

6. The method of claim 3, wherein the plurality of information probes further include an ICMP ping.

7. The method of claim 3, wherein the agent query queries the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

8. The method of claim 3, wherein the agent beacon provides the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

13. The method of claim 3, wherein the plurality of information probes further include an NBTSTAT query.

14. The method of claim 3, wherein the plurality of information probes further include an ICMP ping.

15. The method of claim 3, wherein the agent query queries the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

16. The method of claim 3, wherein the agent beacon provides the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

9. A non-transitory computer storage medium encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations comprising:

receiving data indicating a host device is connecting to a network;

initiating a host detection phase for the host device, wherein network access for the host device is restricted during the host detection phase for the host device; and

collecting host attributes of the host device during the host detection phase using one of at least two peer sensors, wherein collecting host attributes of the host device includes;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that attempts to identify whether one or more agents is installed on the host device, wherein each of the agents has a corresponding unique agent identifier value, attempting to identify one or more agents installed on the host device includes querying the host device for the unique agent identifier value of any agents installed on the host device, and each of the information probes requests one or more other host attributes; and

monitoring for replies to the information probes from the host device during the host detection phase;

wherein each of the one or more agents is configured to assess configuration of the host on which the agent is installed and report configuration information describing the configuration, the agent probe has a higher priority than other information probes in the plurality of information probes, receiving a reply to the agent probe including at least one unique agent identifier causes the host detection phase to end based on the higher priority of the agent probe, ending the host detection phase causes the other lower priority information probes in the plurality of information probes not to be resent to the host device, not receiving a reply to the agent probe after expiration of a time period causes at least a portion of the other information probes in the plurality of information probes to be resent to the host device, a repeat counter is to be incremented to indicate a number of repeat attempts of one or more of the plurality of information probes, and the host detection phase is ended upon a value of the repeat counter exceeding a maximum repeat value.

10. The computer storage medium of claim 9, comprising further instructions that cause the data processing apparatus to perform further operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

11. The computer storage medium of claim 9, comprising further instructions that cause the data processing apparatus to perform further operations comprising:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.

12. The computer storage medium of claim 11, comprising further instructions that cause the data processing apparatus to perform further operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

20. The computer storage medium of claim 9, wherein failure to receive a reply to a respective one of the plurality of information probes causes the respective information probe to be repeated, and receiving a reply to the respective information probe causes repeats of the respective information probe to cease.

17. A data processing apparatus, comprising:

a memory subsystem, an input/output subsystem that transmits and receives data over a network, and a processor in data communication with the memory subsystem and the input/output subsystem, the processor programmed to perform operations comprising;

receiving data indicating a host device is connecting to a network;

initiating a host detection phase for the host device, wherein network access for the host device is restricted during the host detection phase for the host device; and

collecting host attributes of the host device during the host detection phase using one of at least two peer sensors, wherein collecting host attributes of the host device includes;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that attempts to identify whether one or more agents is installed on the host device, wherein each of the agents has a corresponding unique agent identifier value, attempting to identify one or more agents installed on the host device includes querying the host device for the unique agent identifier value of any agents installed on the host device, and each of the information probes requests one or more other host attributes; and

monitoring for replies to the information probes from the host device during the host detection phase;

wherein each of the one or more agents is configured to assess configuration of the host on which the agent is installed and report configuration information describing the configuration, the agent probe has a higher priority than other information probes in the plurality of information probes, receiving a reply to the agent probe including at least one unique agent identifier causes the host detection phase to end based on the higher priority of the agent probe, ending the host detection phase causes the other lower priority information probes in the plurality of information probes not to be resent to the host device, not receiving a reply to the agent probe after expiration of a time period causes at least a portion of the other information probes in the plurality of information probes to be resent to the host device, a repeat counter is to be incremented to indicate a number of repeat attempts of one or more of the plurality of information probes, and the host detection phase is ended upon a value of the repeat counter exceeding a maximum repeat value.

18. The data processing apparatus of claim 17, wherein the processor is further programmed to perform operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

19. The data processing apparatus of claim 18, wherein the processor is further programmed to perform operations comprising:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.