Secured network switch and method for broadcast, multicast, and neighbor management

A secured network switch for computer networks, the secured network switch comprising:

• a processor;
• and
• a memory in communication with the processor, the memory comprising executable instructions that, when executed by the processor alone or in combination with other processors, cause the secured network switch to perform functions of:
• receiving a broadcast or multicast packet from a source device at a first port of a plurality of ports of the secured network switch;
• extracting address data for the source device from the broadcast or multicast packet using the processor;
• determining whether the source device is banned based on the address data using the processor;
• in response to the source device being banned, automatically dropping the broadcast or multicast packet before providing the broadcast or multicast packet to switch logic of the secured network switch using the processor;
• in response to the source device not being banned, automatically determining whether there are any devices connected to a second port of the secured network switch that have a defined relationship with the source device using the processor;
• in response to determining that there is at least one device connected to the second port having a defined relationship with the source device, automatically forwarding the broadcast or multicast packet to a network segment connected to the second port using the processor;
• and
• in response to determining that there are no devices connected to the second port having a defined relationship with the source device, automatically blocking transmission of the broadcast or multicast packet via the second port.

A non-transitory computer readable medium on which are stored instructions that, when executed, cause a programmable device to perform functions of:

• receiving a broadcast or multicast packet from a source device at a first port of a plurality of ports of a secured network switch;
• extracting address data for the source device from the broadcast or multicast packet using a processor of the secured network switch;
• determining whether the source device is banned based on the address data using the processor;
• in response to determining that the source device is banned, dropping the broadcast or multicast packet before providing the broadcast or multicast packet to switch logic of the secured network switch using the processor of the secured network switch;
• in response to determining that the source device is not banned, determining whether there are any devices connected to a second port of the secured network switch that have a defined relationship with the source device using the processor of the secured network switch;
• in response to determining that there are no devices connected to the second port that have a defined relationship with the source device, blocking transmission of the broadcast or multicast packet to the second port using the processor of the secured network switch;
• in response to determining that there are devices connected to the second port that have a defined relationship with the source device, forwarding the broadcast or multicast packet to a network segment connected to the second port using the processor of the secured network switch;
• receiving a unicast packet at the second port from a first device in response to the broadcast or multicast packet;
• determining whether the first device has a defined relationship with the source device using the processor of the secured network switch;
• in response to determining that the first device does not have a defined relationship with the source device, dropping the unicast packet using the processor of the secured network switch;
• and
• in response to determining that the first device does have a defined relationship with the source device, forwarding the unicast packet to a network segment containing the source device using the processor of the secured network switch.