HOST ENTRY SYNCHRONIZATION

• US 20110055382A1
• Filed: 10/06/2009
• Published: 03/03/2011
• Est. Priority Date: 09/03/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Narasimhan, Srinivasan
• Granted Patent: US 8,671,181 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, synchronizing records in peer devices. In one aspect, a method includes comparing, in a first peer device, a peer record received from a second peer device based on an IP address of the peer record from the second peer device and an IP address of a record stored in a host table of the first peer device. Unique agent identifiers, MAC addresses and time stamps are also compared to determine whether the peer record indicates a new host device, a new IP assignment to a known host device, or a new user logged into a known host device.

Claims

1. A method performed by data processing apparatus, the method comprising:

storing in the memory of the data processing apparatus a host table, the host table including, for each of a plurality of host devices monitored on a network, a record including;

an IP address field for storing an IP address assigned to the host device;

an agent identifier field for storing an agent identifier of agent installed on the host device; and

a time stamp field for storing a time stamp indicating the time that host attributes were stored in the record;

receiving from a peer data processing apparatus, in response to a synchronization event, a peer record for a host device, the peer record comprising data for a record stored in a host table in the memory of the peer data processing apparatus;

determining whether an IP address of the peer record is stored in a record in the host table;

in response to determining that the IP address of the peer record is not stored in a record of the host table;

determining whether the peer record includes an agent identifier;

in response to determining that the peer record includes the agent identifier, determining whether the agent identifier of the peer record is stored in a record of the host table;

in response to determining that the agent identifier of the peer record is stored in a record of the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with data of the peer record.

2. The method of claim 1, further comprising, in response to determining that the agent identifier of the peer record is not stored in a record of the host table:

determining whether the peer record includes a MAC address;

in response to determining that the peer record includes a MAC address, determining whether the MAC of the peer record is stored in a record of the host table;

in response to determining that the MAC address of the peer record is stored in a record of the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with data of the peer record.

3. The method of claim 2, further comprising, in response to determining that the MAC address of the peer record is not stored in a record of the host table, generating a new host device detection event.

4. The method of claim 1, further comprising, in response to determining that the IP address of the peer record is stored in a record of the host table:

determining whether an agent identifier of the record stored in the host table matches an agent identifier of the peer record;

in response to determining that the agent identifier of the record stored in the host table does not match the agent identifier of the peer record, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table;

in response to determining that the peer record is more recent than the record of the host table, deleting the record of the host table and generating a new host device detected event.

5. The method of claim 4, further comprising, in response to determining that the peer record is not more recent than the record of the host table:

determining whether a MAC address of the record stored in the host table matches a MAC address of the peer record;

in response to determining that the MAC address of the record stored in the host table does not match MAC address of the peer record, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, deleting the record stored in the host table and generating a new host detected event.

6. The method of claim 5, wherein each record includes a user identifier field, the user identifier field storing a user identifier of a user, and further comprising, in response to determining that the MAC address of the record stored in the host table matches MAC address of the peer record:

determining whether the user identifier of the peer records matches the user identifier of the record in the host table;

in response to determining that the user identifier of the peer record does not match the user identifier of the record stored in the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with the data of the peer record and generating a new user detection event.

7. The method of claim 6, further comprising, in response to determining that the user identifier of the peer record matches the user identifier of the record stored in the host table:

determining whether an information probe type of an information probe used to collect the data of the peer record is different from an information probe type of an information probe used to the data of the record stored in the host table;

in response to determining that the information probe type of the information probe used to collect the data of the peer record is different from the information probe type of the information probe used to the data of the record stored in the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with the data of the peer record and using, at the data processing apparatus, an information probe of the probe type used to collect the data of the peer record for subsequent probes to the host device.

8. The method of claim 1, wherein the time stamps are unsynchronized system clock values.

9. The method of claim 1, wherein the time stamp of the peer record is a difference of the system clock value of the peer data processing apparatus at the time the peer data processing apparatus transmitted the peer record a time stamp of the peer record stored as stored in the host table in the memory of the peer data processing apparatus.

10. The method of claim 1, wherein the time stamps are system clock values synchronized to a reference time.

11. A data processing apparatus, comprising:

a memory subsystem, an input/output subsystem that transmits and receives data over a network, and a processor in data communication with the memory subsystem and the input/output subsystem, the processor programmed to perform operations comprising;

storing in the memory of the data processing apparatus a host table, the host table including, for each of a plurality of host devices monitored on a network, a record including;

an IP address field for storing an IP address assigned to the host device;

an agent identifier field for storing an agent identifier of agent installed on the host device; and

a time stamp field for storing a time stamp indicating the time that host attributes were stored in the record;

receiving from a peer data processing apparatus, in response to a synchronization event, a peer record for a host device, the peer record comprising data for a record stored in a host table in the memory of the peer data processing apparatus;

determining whether an IP address of the peer record is stored in a record in the host table;

in response to determining that the IP address of the peer record is not stored in a record of the host table;

determining whether the peer record includes an agent identifier;

in response to determining that the peer record includes the agent identifier, determining whether the agent identifier of the peer record is stored in a record of the host table;

in response to determining that the agent identifier of the peer record is stored in a record of the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with data of the peer record.

12. The data processing apparatus of claim 11, wherein the processor is further programmed to perform operations comprising, in response to determining that the agent identifier of the peer record is not stored in a record of the host table:

determining whether the peer record includes a MAC address;

in response to determining that the peer record includes a MAC address, determining whether the MAC of the peer record is stored in a record of the host table;

in response to determining that the MAC address of the peer record is stored in a record of the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with data of the peer record.

13. The data processing apparatus of claim 12, wherein the processor is further programmed to perform operations comprising, in response to determining that the MAC address of the peer record is not stored in a record of the host table, generating a new host device detection event.

14. The data processing apparatus of claim 11, wherein the processor is further programmed to perform operations comprising, in response to determining that the IP address of the peer record is stored in a record of the host table:

determining whether an agent identifier of the record stored in the host table matches an agent identifier of the peer record;

in response to determining that the agent identifier of the record stored in the host table does not match the agent identifier of the peer record, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table;

in response to determining that the peer record is more recent than the record of the host table, deleting the record of the host table and generating a new host device detected event.

15. The data processing apparatus of claim 14, wherein the processor is further programmed to perform operations comprising, in response to determining that the peer record is not more recent than the record of the host table:

determining whether a MAC address of the record stored in the host table matches a MAC address of the peer record;

in response to determining that the MAC address of the record stored in the host table does not match MAC address of the peer record, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, deleting the record stored in the host table and generating a new host detected event.

16. The data processing apparatus of claim 15, wherein each record includes a user identifier field, the user identifier field storing a user identifier of a user, and wherein the processor is further programmed to perform operations comprising, in response to determining that the MAC address of the record stored in the host table matches MAC address of the peer record:

determining whether the user identifier of the peer records matches the user identifier of the record in the host table;

in response to determining that the user identifier of the peer record does not match the user identifier of the record stored in the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with the data of the peer record and generating a new user detection event.

17. The data processing apparatus of claim 16, wherein the processor is further programmed to perform operations comprising, in response to determining that the user identifier of the peer record matches the user identifier of the record stored in the host table:

determining whether an information probe type of an information probe used to collect the data of the peer record is different from an information probe type of an information probe used to the data of the record stored in the host table;

in response to determining that the information probe type of the information probe used to collect the data of the peer record is different from the information probe type of the information probe used to the data of the record stored in the host table, determining whether the peer record is more recent than the record of the host table based on the time stamp of the peer record and the time stamp of the records in the host table; and

in response to determining that the peer record is more recent than the record of the host table, updating the record in the host table with the data of the peer record and using, at the data processing apparatus, an information probe of the probe type used to collect the data of the peer record for subsequent probes to the host device.

18. A system, comprising:

a pair of peer sensors configured to control access to a network for a plurality of host devices, each of the peer sensors including a memory subsystem, an input/output subsystem that transmits and receives data over the network, and a processor in data communication with the memory subsystem and the input/output subsystem, wherein each processor is processor programmed to cause each peer sensor to perform operations comprising;

storing in the memory of the peer sensor a host table, the host table including, for each of the plurality of host devices monitored on the network by the peer sensors, a record including;

an IP address field for storing an IP address assigned to the host device;

an agent identifier field for storing an agent identifier of agent installed on the host device; and

a time stamp field for storing a time stamp indicating the time that host attributes were stored in the record;

receiving from the other peer sensor, in response to a synchronization event, peer record for a host device, the peer record being a record stored in the host table in the memory the other peer sensor;

determining whether an IP address of the peer record is stored in a record in host table of the peer sensor;

in response to determining that the IP address of the peer record is not stored in a record of the host table of the peer sensor;

determining whether the peer record includes an agent identifier;

in response to determining that the peer record includes the agent identifier, determining whether the agent identifier of the peer record is stored in a record of the host table of the peer sensor;

in response to determining that the agent identifier of the peer record is stored in a record of the host table of the peer sensor, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table; and

in response to determining that the peer record is more recent than the record of the host table of the peer sensor, updating the record in the host table of the peer sensor with data of the peer record.

19. The system of claim 18, wherein each processor is further programmed to cause each peer sensor to perform operations comprising, in response to determining that the agent identifier of the peer record is not stored in a record of the host table of the peer sensor:

determining whether the peer record includes a MAC address;

in response to determining that the peer record includes a MAC address, determining whether the MAC of the peer record is stored in a record of the host table peer sensor;

in response to determining that the MAC address of the peer record is stored in a record of the host table of the peer sensor, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table of the peer sensor;

in response to determining that the peer record is more recent than the record of the host table of the peer sensor, updating the record in the host table of the peer sensor with data of the peer record; and

in response to determining that the MAC address of the peer record is not stored in a record of the host table of the peer sensor, generating a new host device detection event.

20. The system of claim 19, wherein each processor is further programmed to cause each peer sensor to perform operations comprising, in response to determining that the IP address of the peer record is stored in a record of the host table:

determining whether an agent identifier of the record stored in the host table of the peer sensor matches an agent identifier of the peer record;

in response to determining that the agent identifier of the record stored in the host table of the peer sensor does not match the agent identifier of the peer record, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table;

in response to determining that the peer record is more recent than the record of the host table, deleting the record of the host table and generating a new host device detected event.

21. The system of claim 20, wherein each processor is further programmed to cause each peer sensor to perform operations comprising, in response to determining that the peer record is not more recent than the record of the host table:

determining whether a MAC address of the record stored in the host table of the peer sensor matches a MAC address of the peer record;

in response to determining that the MAC address of the record stored in the host table of the peer sensor does not match MAC address of the peer record, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table; and

in response to determining that the peer record is more recent than the record of the host table of the peer sensor, deleting the record stored in the host table and generating a new host detected event.

22. The system of claim 21, wherein each record includes a user identifier field, the user identifier field storing a user identifier of a user, and wherein each processor is further programmed to cause each peer sensor to perform operations comprising, in response to determining that the MAC address of the record stored in the host table of the peer sensor matches MAC address of the peer record:

determining whether the user identifier of the peer record matches the user identifier of the record in the host table of the peer sensor;

in response to determining that the user identifier of the peer record does not match the user identifier of the record stored in the host table of the peer sensor, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table of the peer sensor; and

in response to determining that the peer record is more recent than the record of the host table of the peer sensor, updating the record in the host table of the peer sensor with the data of the peer record and generating a new user detection event.

23. The system of claim 22, wherein each processor is further programmed to cause each peer sensor to perform operations comprising, in response to determining that the user identifier of the peer record matches the user identifier of the record stored in the host table of the peer sensor:

determining whether an information probe type of an information probe used to collect the data of the peer record is different from an information probe type of an information probe used to the data of the record stored in the host table of the peer sensor;

in response to determining that the information probe type of the information probe used to collect the data of the peer record is different from the information probe type of the information probe used to the data of the record stored in the host table of the peer sensor, determining whether the peer record is more recent than the record of the host table of the peer sensor based on the time stamp of the peer record and the time stamp of the record in the host table; and

in response to determining that the peer record is more recent than the record of the host table of the peer sensor, updating the record in the host table of the peer sensor with the data of the peer record and using an information probe of the probe type used to collect the data of the peer record for subsequent probes to the host device.