# US 2017/0257339 A1 · Logical / physical address state lifecycle management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0257339 A1 - Document ID: US20170257339A1 - Status: Published application - Kind: A1 - Application number: 15/466,695 - Filed: 2017-03-22 - Published: 2017-09-07 - Earliest claimed: 2002-10-01 - Assignees: Trustwave Holdings, Inc. - Applicants: Trustwave Holdings Inc. - Inventors: Mark L. Wilkinson; Ronald J. Miller; Michael J. McDaniels - Web page: https://patentgrep.com/patent/US20170257339A1 ## CPC - H04L 61/10: of different types - H04L 63/1433: {Vulnerability analysis} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, apparatus, and articles of manufacture for managing logical and physical address state lifecycles are disclosed. An example apparatus includes a network interface to capture a first data packet from a first network, and a data transmitter to transmit the first data packet from the apparatus to a security device, where the security device is to determine whether the first data packet is associated with a threat. The apparatus further includes a table updater to adjust an address resolution protocol (ARP) table of the apparatus to mask a device communicatively coupled to the apparatus from the threat when the apparatus obtains a second data packet, where the second data packet is generated in response to the security device determining that the first data packet is associated with the threat. ## Claims ### Claim 1 An apparatus comprising: a network interface to capture a first data packet from a first network; a data transmitter to transmit the first data packet from the apparatus to a security device, the security device to determine whether the first data packet is associated with a threat; and a table updater to adjust an address resolution protocol (ARP) table of the apparatus to mask a device communicatively coupled to the apparatus from the threat when the apparatus obtains a second data packet, the second data packet generated in response to the security device determining that the first data packet is associated with the threat. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the first data packet is at least one of an address resolution protocol (ARP) packet, an Internet control message protocol (ICMP) packet, or a TCP packet. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein determining whether the first data packet is associated with the threat includes determining whether the first data packet violates a behavioral rule or a reconnaissance rule. ### Claim 4 (depends on 1) The apparatus of claim 1, further including determining whether a source Internet Protocol (IP) address of the first data packet is on a second network, the second network including the security device and the device. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the second data packet is an ARP packet, wherein a source of the ARP packet includes an IP address of the device and a synthetic media access control (MAC) address, wherein the synthetic MAC address is not in use on the second network. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein a destination of the ARP packet includes an IP address of the router and a MAC address of the router. ### Claim 7 A method comprising: capturing, at a router, a first data packet from a first network; transmitting the first data packet from the router to a security device, the security device to determine whether the first data packet is associated with a threat; and in response to the security device determining that the first data packet is associated with the threat, obtaining, at the router, a second data packet to adjust an address resolution protocol (ARP) table of the router to mask a device communicatively coupled to the router from the threat. ### Claim 8 (depends on 7) The method of claim 7, wherein the first data packet is at least one of an address resolution protocol (ARP) packet, an Internet control message protocol (ICMP) packet, or a TCP packet. ### Claim 9 (depends on 7) The method of claim 7, wherein the security device and the device are communicatively coupled to the first network via the router. ### Claim 10 (depends on 7) The method of claim 7, wherein determining whether the first data packet is associated with the threat includes determining whether the first data packet violates a behavioral rule or a reconnaissance rule. ### Claim 11 (depends on 7) The method of claim 7, further including determining whether a source Internet Protocol (IP) address of the first data packet is on a second network, the second network including the security device and the device. ### Claim 12 (depends on 11) The method of claim 11, wherein the second data packet is an ARP packet, wherein a source of the ARP packet includes an IP address of the device and a synthetic media access control (MAC) address, wherein the synthetic MAC address is not in use on the second network. ### Claim 13 (depends on 12) The method of claim 12, wherein a destination of the ARP packet includes an IP address of the router and a MAC address of the router. ### Claim 14 A storage device or storage disc comprising instructions that, when executed, cause a machine to at least: capture, at a router, a first data packet from a first network; transmit the first data packet from the router to a security device, the security device to determine whether the first data packet is associated with a threat; and obtain, at the router, a second data packet to adjust an address resolution protocol (ARP) table of the router to mask a device communicatively coupled to the router from the threat when the security device determines that the first data packet is associated with the threat. ### Claim 15 (depends on 14) The storage device or storage disc of claim 14, wherein the first data packet is at least one of an address resolution protocol (ARP) packet, an Internet control message protocol (ICMP) packet, or a TCP packet. ### Claim 16 (depends on 14) The storage device or storage disc of claim 14, wherein the security device and the device are communicatively coupled to the first network via the router. ### Claim 17 (depends on 14) The storage device or storage disc of claim 14, wherein determining whether the first data packet is associated with the threat includes determining whether the first data packet violates a behavioral rule or a reconnaissance rule. ### Claim 18 (depends on 14) The storage device or storage disc of claim 14, further including instructions which when executed, cause the machine to at least determine whether a source Internet Protocol (IP) address of the first data packet is on a second network, the second network including the security device and the device. ### Claim 19 (depends on 18) The storage device or storage disc of claim 18, wherein the second data packet is an ARP packet, wherein a source of the ARP packet includes an IP address of the device and a synthetic media access control (MAC) address, wherein the synthetic MAC address is not in use on the second network. ### Claim 20 (depends on 19) The storage device or storage disc of claim 19, wherein a destination of the ARP packet includes an IP address of the router and a MAC address of the router.