Automated containment of network intruder

A system for containing a client device in a network comprising one or more routers including a first router associated with a network segment including the client device, the system comprising:

• one or more switches operatively connected to the network segment associated with the first router;
• and
• a central management node adapted to:
• receive an intrusion detection with a source address from an intrusion detection entity, the source address associated with the client device;
• identify the first router from among the one or more routers;
• generate a rule to map PDUs having the source address associated with the client device to an penalty virtual local area network (VLAN) separate from other network traffic;
• and
• transmit the rule to each of said one or more switches;
• wherein each of the one or more switches causes PDUs having the source address associated with the client device to the penalty VLAN.

A method for containing traffic in a data communications network having one or more switching devices, the method comprising the steps of:

• identifying an intruder in a network;
• automatically generating an isolation rule associating the identified intruder with an isolation action;
• and
• installing the isolation rule on each of the one or more one or more switching devices;
• wherein each of the one or more switching devices executes the isolation action upon receipt of a PDU from the identified intruder.