Monitoring dynamic device configuration protocol offers to determine anomaly
AssigneeHewlett Packard Enterprise Development LP
InventorsShaun Wackerly, Duane Mentze, Shaun Wakumoto
Life of this patent
Estimating the term…
Abstract
Example embodiments disclosed herein relate to monitoring Dynamic Device Configuration Protocol offers via a control plane. In one example, an address range or multiple address ranges for sources of the Dynamic Device Configuration Protocol offers can be tracked. In this example, an anomaly can be determined based on one of the Dynamic Device Configuration Protocol offers and the address range(s).
Claims15
A software defined networking (SDN) controller, comprising:
- an interface engine to monitor a plurality of Dynamic Device Configuration Protocol (DDCP) Offers in a data plane of a network via at least one network switch of the network, wherein the SDN controller communicates with the at least one network switch via a control plane;
- a tracking engine to track at least one respective address range of respective sources of the DDCP Offers;
- and
- an anomaly engine to determine that another DDCP Offer is within the at least one respective address range and that the other DDCP Offer is sourced from another source that is not the respective source associated with the at least one respective address range.
A method comprising:
- monitoring, by at least one processor, a plurality of Dynamic Device Configuration Protocol (DDCP) Offers in a data plane of a network via at least one network switch of the network, wherein the at least one processor communicates with the at least one network switch via a control plane,
- wherein each of the DDCP Offers originate from a respective source server,
- identifying an address range for each source server based, at least in part, on the respective DDCP Offers and probing of each source server;
- and
- determining an anomaly based on one of the DDCP Offers and the identified address range for another source server.
A non-transitory machine-readable storage medium storing instructions that, if executed by at least one processor of a device, cause the device to:
- monitor a plurality of Dynamic Device Configuration Protocol (DDCP) Offers in a data plane of a network via at least one network switch of the network, wherein the device communicates with the at least one network switch via a control plane,
- wherein each of the DDCP Offers originate from a respective source server,
- identify an address range for each source server based, at least in part, on the respective DDCP Offers and probing of each source server;
- determine an anomaly based on one of the DDCP Offers and the identified address range for another source server;
- determine, based on the anomaly, that the respective source server for the one DDCP Offer is a rogue DDCP server;
- and
- based on the determination of the rogue DDCP server, inject a plurality of packets into the data plane to the rogue DDCP server to consume Internet Protocol addresses provided by the rogue DDCP server.
Dependencies are inferred from the claim text.