HOST INFORMATION COLLECTION

• US 20110055381A1
• Filed: 10/06/2009
• Published: 03/03/2011
• Est. Priority Date: 09/03/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Porwal, Vinod Kumar A., Hejmadi, Parthiv, Narasimhan, Srinivasan
• Granted Patent: US 9,391,858 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for collecting information of host devices. In one aspect, a method includes transmitting a plurality of information probes to the host device, including an agent probe that queries an agent installed on the host device for a unique agent identifier, monitoring for replies to the information probes from the host device during the host detection phase, ending the host detection phase in response to receiving a reply to the agent probe and that includes the unique agent identifier, resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period and ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.

Claims

1. A method performed by data processing apparatus, the method for collecting host attributes of a host and comprising:

receiving data at the data processing apparatus indicating a host device is connecting to a network;

in response to the host device connecting to the network, initiating a host detection phase for the host device during which host attributes of the host are collected by the data processing apparatus and network access for the host device is restricted, and during the host collection phase for the host device;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes requesting one or more other host attributes;

monitoring for replies to the information probes from the host device during the host detection phase;

ending the host detection phase in response to receiving a reply to the agent probe that includes the unique agent identifier;

resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period; and

ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.

2. The method of claim 1, further comprising, during the collection phase:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

3. The method of claim 1, further comprising, during the collection phase:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.

4. The method of claim 3, further comprising, during the collection phase:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

5. The method of claim 3, wherein the plurality of information probes further include an NBTSTAT query.

6. The method of claim 3, wherein the plurality of information probes further include and ICMP ping.

7. The method of claim 3, wherein the agent query queries the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

8. The method of claim 3, wherein the agent beacon provides the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

13. The method of claim 3, wherein the plurality of information probes further include an NBTSTAT query.

14. The method of claim 3, wherein the plurality of information probes further include and ICMP ping.

15. The method of claim 3, wherein the agent query queries the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

16. The method of claim 3, wherein the agent beacon provides the agent identifier of the agent, the MAC address of the host device, and user login information associated with the host device.

9. A computer storage medium encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations comprising:

receiving data indicating a host device is connecting to a network;

in response to the host device connecting to the network, initiating a host detection phase for the host device during which host attributes of the host are collected by the data processing apparatus and network access for the host device is restricted, and during the host collection phase for the host device;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes requesting one or more other host attributes;

monitoring for replies to the information probes from the host device during the host detection phase;

ending the host detection phase in response to receiving a reply to the agent probe and that includes the unique agent identifier;

resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period; and

ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.

10. The computer storage medium of claim 9, comprising further instructions that cause the data process apparatus to perform further operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

11. The computer storage medium of claim 9, comprising further instructions that cause the data process apparatus to perform further operations comprising:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.

12. The computer storage medium of claim 11, comprising further instructions that cause the data process apparatus to perform further operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

17. A data processing apparatus, comprising:

a memory subsystem, an input/output subsystem that transmits and receives data over a network, and a processor in data communication with the memory subsystem and the input/output subsystem, the processor programmed to perform operations comprising;

receiving data indicating a host device is connecting to a network;

in response to the host device connecting to the network, initiating a host detection phase for the host device during which host attributes of the host are collected by the data processing apparatus and network access for the host device is restricted, and during the host collection phase for the host device;

transmitting a plurality of information probes to the host device, the information probes including an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes requesting one or more other host attributes;

monitoring for replies to the information probes from the host device during the host detection phase;

ending the host detection phase in response to receiving a reply to the agent probe and that includes the unique agent identifier;

resending the plurality of information probes and incrementing a repeat counter in response to not receiving a reply to the agent probe after the expiration of a time period; and

ending the host detection phase in response to a value of the repeat counter exceeding a maximum repeat value.

18. The data processing apparatus of claim 17, wherein the processor is further programmed to perform operations comprising:

not repeating an information probe after the expiration of the time period in response to receiving a reply to the information probe, the information probe being an information probe other than the agent probe.

19. The data processing apparatus of claim 18, wherein the processor is further programmed to perform operations comprising:

monitoring for an agent beacon sent from the host device during the host detection phase, the agent beacon being a data that is sent independent of the information probes; and

ending the host detection phase in response to receiving the unique agent identifier from the agent beacon.