Misconfigured mirror port detection
AssigneeSophos Limited
InventorNeil Richard Terry
Life of this patent
Estimating the term…
Abstract
A method includes monitoring a plurality of packets received by a network sensor associated with a port of a network, determining a ratio of unicast, multicast or broadcast packets to a total number of packets for the plurality of packets, determining that the ratio is outside the bounds of a threshold range, detecting that a port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range, and automatically notifying a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range. Further disclosed is a computer system and computer program product configured to perform the method.
Claims21
A method for detecting a misconfigured port in a packet forwarding configuration comprising:
- monitoring, by one or more processors of a computer system, a plurality of packets received by a network sensor associated with a port of a network;
- determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received;
- determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range;
- detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range;
- and
- automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of the threshold range.
A computer system, comprising:
- one or more processors;
- one or more computer readable storage media;
- and
- computer readable code stored collectively in the one or more computer readable storage media, with the computer readable code including data and instructions to cause the one or more computer processors to perform a method for detecting a misconfigured port in a packet forwarding configuration comprising:
- monitoring, by the one or more processors of the computer system, a plurality of packets received by a network sensor associated with a port of a network;
- determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received;
- determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range;
- detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range;
- and
- automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of the threshold range.
A computer program product comprising:
- one or more non-transitory computer readable storage media having computer readable program instructions collectively stored on the one or more computer readable storage media, the computer readable program instructions being executed by one or more processors of a computer system to cause the computer system to perform a method for detecting a misconfigured port in a packet forwarding configuration comprising:
- monitoring, by the one or more processors of the computer system, a plurality of packets received by a network sensor associated with a port of a network;
- determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received;
- determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range;
- detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range;
- and
- automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of the threshold range.
Dependencies are inferred from the claim text.