# US 11,310,265 B2 · Detecting MAC/IP spoofing attacks on networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,265 B2
- Document ID: US11310265B2
- Status: Granted
- Kind: B2
- Application number: 16/803,950
- Filed: 2020-02-27
- Published: 2021-09-02
- Granted: 2022-04-19
- Earliest claimed: 2020-02-27
- Assignees: Hewlett Packard Enterprise Development LP
- Applicants: Hewlett Packard Enterprise Development LP
- Inventors: Arpit Bhatt; Deepak Jain
- Web page: https://patentgrep.com/patent/US11310265B2

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/166: {at the transport layer}
- H04L 67/145: avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
- H04L 69/10: Streamlined, light-weight or high-speed protocols, e.g. express transfer protocol [XTP] or byte stream
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/163: In-band adaptation of TCP data exchange; In-band control procedures
- H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods are provided for detecting MAC/IP spoofing attacks on networks. A method may include authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device; wherein an attacking device is connected to the network, and to the network device, by a network hub; wherein the attacking device spoofs the MAC address and the IP address of the network device; establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device; sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message; receiving the TCP RST message; and determining the attacking device is present in the network responsive to receiving the TCP RST message.

## Claims

### Claim 1

A system, comprising:
a hardware processor; and
a non-transitory machine-readable storage medium encoded with instructions executable by the hardware processor to perform a method comprising:
authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device;
wherein an attacking device is connected to the network, and to the network device, by a network hub;
wherein the attacking device spoofs the MAC address and the IP address of the network device;
establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device;
sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message;
receiving the TCP RST message; and
determining the attacking device is present in the network responsive to receiving the TCP RST message.

### Claim 2 (depends on 1)

The system of claim 1, the method further comprising:
performing an action responsive to determining the attacking device is present in the network, wherein the action comprises at least one of:
disconnecting, from the network, all network devices using the MAC address of the network device,
quarantining all network devices using the MAC address of the network device, and
notifying an administrator of the network.

### Claim 3 (depends on 1)

The system of claim 1, the method further comprising:
sending a Windows management instrumentation (WMI) query to the IP address responsive to receiving the TCP RST message, and prior to performing the action; and
performing the action responsive to receiving an improper response to the WMI query.

### Claim 4 (depends on 1)

The system of claim 1, wherein:
the attacker and the network device are connected to a network hub; and
the network hub is connected to an edge switch in the network.

### Claim 5 (depends on 1)

The system of claim 1, wherein the authenticating the network device for access to the network complies with the IEEE 802.1X standard.

### Claim 6 (depends on 1)

The system of claim 1, wherein the authenticating the network device for access to the network comprises:
receiving authentication credentials from the network device; and
comparing the authentication credentials to a plurality of authentication credentials stored in an identity store.

### Claim 7 (depends on 6)

The system of claim 6, wherein the identity store comprises an Active Directory store.

### Claim 8

A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing component, the machine-readable storage medium comprising instructions to cause the hardware processor to perform a method comprising:
authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device;
wherein an attacking device is connected to the network, and to the network device, by a network hub;
wherein the attacking device spoofs the MAC address and the IP address of the network device;
establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device;
sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message;
receiving the TCP RST message; and
determining the attacking device is present in the network responsive to receiving the TCP RST message.

### Claim 9 (depends on 8)

The medium of claim 8, the method further comprising:
performing an action responsive to determining the attacking device is present in the network, wherein the action comprises at least one of:
disconnecting, from the network, all network devices using the MAC address of the network device,
quarantining all network devices using the MAC address of the network device, and
notifying an administrator of the network.

### Claim 10 (depends on 8)

The medium of claim 8, the method further comprising:
sending a Windows management instrumentation (WMI) query to the IP address responsive to receiving the TCP RST message, and prior to performing the action; and
performing the action responsive to receiving an improper response to the WMI query.

### Claim 11 (depends on 8)

The medium of claim 8, wherein:
the attacker and the network device are connected to a network hub; and
the network hub is connected to an edge switch in the network.

### Claim 12 (depends on 8)

The medium of claim 8, wherein the authenticating the network device for access to the network complies with the IEEE 802.1X standard.

### Claim 13 (depends on 8)

The medium of claim 8, wherein the authenticating the network device for access to the network comprises:
receiving authentication credentials from the network device; and
comparing the authentication credentials to a plurality of authentication credentials stored in an identity store.

### Claim 14 (depends on 13)

The medium of claim 13, wherein the identity store comprises an Active Directory store.

### Claim 15

A method comprising:
authenticating a network device for access to a network using a Media Access Control (MAC) address and an Internet Protocol (IP) address of the network device;
wherein an attacking device is connected to the network, and to the network device, by a network hub;
wherein the attacking device spoofs the MAC address and the IP address of the network device;
establishing a Transport Control Protocol (TCP) connection with the network device subsequent to authenticating the network device;
sending at least one TCP keepalive message to the IP address of the network device, wherein, responsive to receiving the TCP keepalive message, the attacking device transmits a TCP reset (RST) message;
receiving the TCP RST message; and
determining the attacking device is present in the network responsive to receiving the TCP RST message.

### Claim 16 (depends on 15)

(Original The method of claim 15, further comprising:
performing an action responsive to determining the attacking device is present in the network, wherein the action comprises at least one of:
disconnecting, from the network, all network devices using the MAC address of the network device,
quarantining all network devices using the MAC address of the network device, and
notifying an administrator of the network.

### Claim 17 (depends on 15)

The method of claim 15, further comprising:
sending a Windows management instrumentation (WMI) query to the IP address responsive to receiving the TCP RST message, and prior to performing the action; and
performing the action responsive to receiving an improper response to the WMI query.

### Claim 18 (depends on 15)

The method of claim 15, wherein:
the attacker and the network device are connected to a network hub; and
the network hub is connected to an edge switch in the network.

### Claim 19 (depends on 15)

The method of claim 15, wherein the authenticating the network device for access to the network complies with the IEEE 802.1X standard.

### Claim 20 (depends on 15)

The method of claim 15, wherein the authenticating the network device for access to the network comprises:
receiving authentication credentials from the network device; and
comparing the authentication credentials to a plurality of authentication credentials stored in an identity store.