Systems and methods for identifying the client applications of a network

• US 7,467,205 B1
• Filed: 11/14/2005
• Issued: 12/16/2008
• Est. Priority Date: 05/12/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Dempster, Ronald A., Houghton, Nigel
• Primary Examiner(s): Jean; Frantz B
• Application Number:
  US11/272,033
• Time in Patent Office: 1,128 Days
• Field of Search: 709223-224, 702/186, 713/201
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A client application running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and client applications identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and client applications identified by reading, decoding, and analyzing packets.

Claims

1. A method for passively and automatically identifying a client application running on a network device of a network, comprising:

reading a packet transmitted by the network device on the network;

decoding the packet into one or more protocol fields;

comparing the one or more fields to predefined protocol fields which collectively identify a client application, stored in a client application identifying data structure; and

storing a client application from the client application identifying structure which has protocol fields that match the protocol fields decoded from the packet as the client application running on the network device.

2. The method of claim 1, wherein the one or more protocol fields comprise an application protocol field.

3. The method of claim 1, wherein the client application comprises an internet browser.

4. The method of claim 3, wherein the one or more protocol fields comprise one or more of a command, a uniform resource location, and a version.

5. The method of claim 1, further comprising verifying one or more response packets that are sent in response to the packet for structure and content.

6. The method of claim 1, further comprising reporting the client application to a network reporting mechanism.

7. The method of claim 6, wherein the network reporting mechanism comprises one or more of an intrusion detection system and a network management system.

8. The method of claim 1, further comprising recording a change to the client application.

9. A method for passively and automatically identifying a client application running on a network device of a network, comprising:

identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;

identifying one or more packets of the flow as one or more initiator packets;

identifying one or more packets of the flow as one or more responder packets;

if protocol fields of the one or more initiator packets match predefined initiator protocol fields which collectively identity the client application and if protocol fields of the one or more responder packets match predefined responder protocol fields which collectively identify the client application, then identifying the client application of the matched protocol fields as a client application running on one of the initiator network device and the responder network device.

10. The method of claim 9, further comprising storing one or more of a client application type, a client application product, and a client application version in a data structure associated with a host of the application.

11. The method of claim 9, wherein the client application initiates a session to a service running an a remote processor.

12. The method of claim 9, wherein the client application comprises an internet web browser.

13. The method of claim 12, wherein the one or more protocol fields comprise one or more of a command, a uniform resource locator, and a version.

14. The method of claim 9, wherein the client application is identified based on a comparison of one or more fields present in a single packet.

15. The method of claim 9, further comprising reporting the client application running on the initiator network device to a network reporting mechanism.

16. The method of claim 15, wherein the network reporting mechanism comprises one or more of an intrusion detection system and a network management system.

17. The method of claim 9, further comprising recording a change to the client application running on the initiator network device.

18. A method for passively and automatically identifying a client application running on a network device of a network, comprising:

maintaining a client application identifying data structure that comprises one or more predefined protocol fields which collectively identify one or more client applications;

identifying a flow between an initiator network device and a responder network device by reading, decoding, and analyzing two or more packets transmitted on the network;

comparing one or more protocol fields of one or more packets of the flow to the one or more predefined protocol fields of the one or more client applications of the client application identifying data structure; and

recording a client application from the client application identifying structure which has protocol fields that match the protocol fields of the one or more packets as the client application of the initiator network device.

19. The method of claim 18, further comprising reporting the client application running on the initiator network device to a network reporting mechanism.

20. An apparatus for passively and automatically identifying a client application running on a network device of a network, comprising:

a receiver for receiving a packet transmitted by the network device on the network;

a decoder for decoding the packet into one or more protocol fields;

a processor for comparing the one or more fields to predefined protocol fields which collectively identify a client application, stored in a client application identifying data structure; and

a computer-readable medium for storing a matched client application which has protocol fields that match the protocol fields decoded from the packet as the client application running on the network device.