# US 2014/0192675 A1 · Method and apparatus for internet protocol (ip) logical wire security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0192675 A1 - Document ID: US20140192675A1 - Status: Published application - Kind: A1 - Application number: 13/735,262 - Filed: 2013-01-07 - Published: 2014-07-10 - Earliest claimed: 2013-01-07 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: John Scott Perez - Web page: https://patentgrep.com/patent/US20140192675A1 ## CPC - H04L 45/28: using route fault recovery - H04L 45/02: Topology update or discovery - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for improved approaches for detection of exploits and drift in a network is described. The method includes: determining, by a processor, a logical configuration of a network comprising a plurality of links connecting a plurality of nodes; determining, by the processor, a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the processor is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node; receiving an error detection value computed by one of the switches; and determining, by the processor, whether the error detection value corresponds with a value inaccessible to the one switch. ## Claims ### Claim 1 A method comprising: determining, by a processor, a logical configuration of a network comprising a plurality of links connecting a plurality of nodes; determining, by the processor, a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the processor is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node; receiving an error detection value computed by one of the switches; and determining, by the processor, whether the error detection value corresponds with a value inaccessible to the one switch. ### Claim 2 (depends on 1) The method according to claim 1, comprising: receiving another error detection value computed by another one of the switches; determining, by the processor, whether the other error detection value corresponds with another value, the value and the other value being inaccessible to the one switch and the other switch; validating, by the processor, the one switch and the other switch when the error detection value and the other error detection value are identical to the value and the other value, respectively; receiving a first and second geolocation from the one switch and the other switch switches, respectively; and determining, by the processor, a physical path of network traffic forwarded by the one switch, other switch, or a combination thereof based on the received first and second geolocations when the one switch and the other switch are validated. ### Claim 3 (depends on 2) The method according to claim 2, comprising: determining, by the processor, an indication of a physical location associated with the network traffic; and comparing the indication of the physical location with the determined physical path. ### Claim 4 (depends on 3) The method according to claim 3, comprising: determining a source and/or destination address of a datagram of the network traffic; and determining the indication of the physical location according to the source and/or destination address. ### Claim 5 (depends on 4) The method according to claim 4, further comprising: determining whether the first switch connects an end device associated with the destination or source address to the switches of the network; and determining the indication of the physical location as the first geolocation based on whether the first switch connects the end device to the switches. ### Claim 6 (depends on 3) The method according to claim 3, wherein the indication of the physical location is an automatic number identification (ANI) of the network traffic. ### Claim 7 (depends on 3) The method according to claim 3, comprising: determining a media access control (MAC) address of a endpoint device connected to the network via the first switch, the endpoint device being an endpoint of the network traffic; determining a type of device according to the MAC address; and determining the indication of the physical location based on the type of device. ### Claim 8 (depends on 1) The method according to claim 1, wherein the first error detection value is according to a configuration type and/or a datastore associated with the first switch, the value is stored in a datastore inaccessible to the processor and/or calculated by another processor, and the data is a datagram, the method further comprising initiating a stateful inspection of the network based on the comparison. ### Claim 9 An apparatus comprising: at least one processor; and at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following, determine a logical configuration of a network comprising a plurality of links connecting a plurality of nodes; determine a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the apparatus is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node; receive an error detection value computed by a first switch of the switches; and compare the error detection value with a value inaccessible to the first switch. ### Claim 10 (depends on 9) The apparatus according to claim 9, wherein the apparatus is further caused to: receive a second error detection value computed by a second switch of the switches; compare, the second error detection value with a second value, the first and second values being inaccessible to the first and second switches; validate the first and second switches when the first and second error detection values are identical to the first and second values, respectively; receive a first and second geolocation from the first and second switches, respectively; and determine a physical path of network traffic forwarded by the first switch, second switch, or a combination thereof based on the received first and second geolocations when the first and second switches are validated. ### Claim 11 (depends on 10) The apparatus according to claim 10, wherein the apparatus is further caused to: determine, an indication of a physical location associated with the network traffic; and compare the indication of the physical location with the determined physical path. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the apparatus is further caused to: determining a source and/or destination address of a datagram of the network traffic; and determining the indication of the physical location according to the source and/or destination address. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein the apparatus is further caused to: determining whether the first switch connects an end device associated with the destination or source address with the switches of the network; and determining the indication of the physical location as the first geolocation based on whether the first switch connects the end device to the switches. ### Claim 14 (depends on 11) The apparatus according to claim 11, wherein the indication of the physical location is an automatic number identification (ANI) of the network traffic. ### Claim 15 (depends on 11) The apparatus according to claim 11, wherein the apparatus is further caused to: determine a media access control (MAC) address of a endpoint device connected to the network via the first switch, the endpoint device being an endpoint of the network traffic; determine a type of device according to the MAC address; and determine the indication of the physical location based on the type of device. ### Claim 16 (depends on 9) The apparatus according to claim 9, wherein the first error detection value is according to a configuration type and/or a datastore associated with the first switch, the value is stored in a datastore inaccessible to the apparatus and/or calculated by another apparatus and the data is a datagram, the apparatus being further caused to initiate a stateful inspection of the network based on the comparison. ### Claim 17 A method comprising: receiving, at a switch, network traffic comprising datagrams; determining, by the switch, a header of one of the datagrams, the header indicating a destination address; selecting, by the switch, a physical link to transport the one datagram based on the destination address; determining, by the switch, a network node to forward the one datagram based on the destination address; forwarding, by the switch, the one datagram to the network node on the physical link; computing, at the switch, an error detection value for the switch; and forwarding the error detection value to a processing device to determine whether the error detection value corresponds to a value inaccessible to the switch. ### Claim 18 (depends on 17) The method according to claim 17, comprising: computing the error detection value according to a configuration type of the switch and/or a datastore of the switch. ### Claim 19 (depends on 17) The method according to claim 17, further comprising: determining the network node according to a routing table of the switch, wherein the error detection value is computed based on values indicated in the routing table. ### Claim 20 An apparatus comprising: at least one processor; and at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following, receive network traffic comprising datagrams; determine a header of one of the datagrams, the header indicating a destination address; select a physical link to transport the one datagram based on the destination address; determine a network node to forward the one datagram based on the destination address; forward the one datagram to the network node on the physical link; compute an error detection value for the apparatus; and forward the error detection value to a processing device to determine whether the error detection value corresponds to a value inaccessible to the apparatus. ### Claim 21 (depends on 20) The apparatus according to claim 20, wherein the apparatus is further caused to: determine the error detection value according to a configuration type of the apparatus and/or a datastore of the apparatus. ### Claim 22 (depends on 20) The apparatus according to claim 20, wherein the apparatus is further caused to: determine the network node according to a routing table of the apparatus, wherein the error detection value is computed based on values indicated in the routing table.