Dynamic Control of Endpoint Profiling

An apparatus comprising:

• a network interface unit configured to enable communications over a network, including communication with a network device that has network connectivity to one or more endpoint devices;
• and
• a processor coupled to the network interface unit and configured to:
• receive from the network device a packet that includes a Media Access Control (MAC) address of an endpoint device;
• determine whether at least a portion of the MAC address matches stored information for MAC addresses of known endpoint devices;
• extract from the packet one or more attributes that carry further descriptive information of the endpoint device;
• determine based on the MAC address and the one or more attributes whether the endpoint device can be classified at a level of granularity according to a policy rule;
• if the endpoint device cannot be classified at the level of granularity, dynamically select a probe function based on the one or more attributes extracted from the packet and the MAC address to collect additional data about the endpoint device;
• obtain one or more additional attributes from operation of a selected probe function;
• and
• repeat the operations to determine whether the endpoint device can be classified, dynamically select a probe function and obtain the one or more additional attributes until the endpoint device can be classified at the level of granularity, if possible.

A system comprising:

• a network device that has network connectivity to one or more endpoint devices;
• and
• a server in communication with the network device, wherein the server is configured to:
• receive from the network device a packet that includes a Media Access Control (MAC) address of an endpoint device;
• determine whether at least a portion of the MAC address matches stored information for MAC addresses of known endpoint devices;
• extract from the packet one or more attributes that carry further descriptive information of the endpoint device;
• determine based on the MAC address and the one or more attributes whether the endpoint device can be classified at a level of granularity according to a policy rule;
• if the endpoint device cannot be classified at the level of granularity, dynamically select a probe function based on the one or more attributes extracted from the packet and the MAC address to collect additional data about the endpoint device;
• obtain one or more additional attributes from operation of a selected probe function;
• and
• repeat the operations to determine whether the endpoint device can be classified, dynamically select a probe function and obtain the one or more additional attributes until the endpoint device can be classified at the level of granularity, if possible.