Method for configuring ACLS on network device based on flow information
AssigneeSolarwinds Worldwide, LLC
InventorGreg Newman
Life of this patent
Estimating the term…
Abstract
Embodiments of the present invention provide a system and method for using network flows records exported from network routers to provide information about the traffic entering/exiting the device. Network routers or hubs can be configured to authorize or deny various types of network traffic between two network devices whose traffic transits via the router. The method presented describes the creation and application of access control lists on the router from information derived from the network flow information exported by the network router.
Claims24
A system for dynamically controlling network communications, the system comprising:
- a network device configured to receive network traffic and to produce a flow record describing said network traffic;
- a flow record storage configured to receive said flow record from said network device and to store said flow records;
- and
- a data analysis tool configured to access said stored flow record and to assess said flow record according to predefined criteria to dynamically identify an address;
- wherein the network device is configured to receive said identified port address and to add said identified node or port address to an access control list.
A method for managing network comprising:
- monitoring traffic through components in the network;
- receiving flow records from said components describing said traffic;
- analyzing the flow records and identifying an address that meets a predefined criterion;
- and
- forwarding the identified address to one of the network components, wherein said component adds the identified network address to an associated access control list, wherein said access control list directs the component from forwarding traffic associated with said identified address.
A system for dynamically controlling traffic in a network, the system comprising:
- a flow record generating device configured to provide flow records describing said network traffic;
- a flow record storage system configured to receive and store the flow records;
- a data analysis device configured to access the storage system and to assess the stored flow records according to predefined criteria;
- whereby the data analysis device dynamically identifies at least one address satisfying said predefined criteria, said address comprising a port or a node address associated with the traffic.
A method for evaluating an address on an access control list, the method comprising:
- monitoring traffic through components in the network;
- receiving flow records from said components describing said traffic;
- analyzing any of said received flow records associated with said address in the access control list according to a predefined criterion;
- and
- renewing the address in the access control list if said address satisfies said predefined criterion.
The method of claim 22 further comprising displaying to a user said address, and whereby the renewing of the address occurs after the user approves the address.
Dependencies are inferred from the claim text.