Method and device for determining network device status

A network monitoring device for augmenting security of a data network, said monitoring device comprising:

• communication circuitry communicatively coupled to the data network and adapted to monitor data traffic exchanged with an authentication server, which data traffic is not addressed to said monitoring device;
• wherein the authentication server is an HTTP server, a Telnet server, a NetBIOS server, a FTP server, a Microsoft Exchange™ server (MAPI), a POP mail server, an IMAP mail server, a RADIUS server, a Kerberos server or a secure shell (SSH) network service;
• a network monitoring module including processing circuitry functionally associated with said communication circuitry and configured to:
• identify, via said communication circuitry, authentication attempt related data traffic exchanged with the authentication server, to which data traffic the monitoring device is not a party, wherein the authentication attempt related data traffic is associated with the device attempting to access resources of the network;
• generate a record for the device in a device status table;
• mark a status of the device in the device status table as guest;
• identify from the identified authentication attempt related data traffic at least one of an indication of a successful authentication attempt by the device or an indication of a failed authentication attempt by the device;
• in response to identifying a successful login attempt, change the status of the device in the device status table from guest to authenticated;
• increment a failure counter in response to identifying a failed authentication attempt;
• change the status for the device in the device status table from guest to rogue in response to the failure counter exceeding a predefined value;
• update at least one record associated with the device, based on the status of the device;
• and
• determine whether to permit access to network resources for the device based on the at least one record associated with the device.

A network monitoring system for augmenting security of a data network, said monitoring system comprising:

• a component functionally coupled to a network switch or router, configured to copy data traffic passing through the network switch or router and send a copy of the data traffic passing through the network switch or router to a network monitoring device;
• a network monitoring device communicatively coupled to said component, said network monitoring device comprising:
• communication circuitry communicatively coupled said component and adapted to receive the copied data traffic;
• a network monitoring module including processing circuitry functionally associated with said communication circuitry and configured to:
• identify, within the copied data traffic, authentication attempt related data traffic, to which the monitoring device is not a party, wherein the authentication attempt related data traffic is associated with the device attempting to access resources of the network;
• generate a record for the device in a device status table;
• mark a status of the device in the device status table as guest;
• identify from the identified authentication attempt related data traffic at least one of an indication of a successful authentication attempt by the device or an indication of a failed authentication attempt by the device;
• increment a failure counter in response to identifying a failed authentication attempt;
• change the status for the device in the device status table from guest to rogue in response to the failure counter exceeding a predefined value;
• update at least one record associated with the device, based on the status of the device;
• and
• determine whether to permit access to network resources for the device based on the at least one record associated with the device.

A network monitoring system for augmenting security of a data network, said monitoring system comprising:

• a data replicating component coupled to the data network, configured to replicate data traffic passing through the network and send replicates of the data traffic passing through the network to a network monitoring device;
• a network monitoring device communicatively coupled to said data replicating component, said network monitoring device comprising:
• communication circuitry communicatively coupled said data replicating component and adapted to receive the replicated data traffic;
• a network monitoring module including processing circuitry functionally associated with said communication circuitry and configured to:
• identify, within the replicated data traffic, authentication attempt related data traffic, to which the monitoring device is not a party, wherein the authentication attempt related data traffic is associated with the device attempting to access resources of the network;
• generate a record for the device in a device status table;
• mark a status of the device in the device status table as guest;
• identify from the identified authentication attempt related data traffic at least one of an indication of a successful authentication attempt by the device or an indication of a failed authentication attempt by the device;
• in response to identifying a successful login attempt, change the status of the device in the device status table from guest to authenticated;
• increment a failure counter in response to identifying a failed authentication attempt;
• change the status for the device in the device status table from guest to rogue in response to the failure counter exceeding a predefined value;
• update at least one record associated with the device, based on the status of the device;
• and
• determine whether to permit access to network resources for the device based on the at least one record associated with the device.