Back to results
US 8,510,833 B2Granted
Connection-rate filtering using ARP requests
AssigneeHewlett-Packard Development Company, L.P.
InventorsShaun K. Wakumoto, Frank A. Reichstein
Life of this patent
Estimating the term…
Abstract
One embodiment relates to a method of connection-rate filtering by a network device. Address resolution protocol (ARP) request packets received from a sub-network are monitored, and a copy of the received ARP request packets are sent to an agent program. The agent program determines a rate of ARP request packets sent by a host in the sub-network. Other embodiments are also disclosed.
Claims16
A method of connection-rate filtering within a sub-network by a network device, the method comprising:
- measuring, via the circuitry at a controller, a traffic rate of packets from an ingress port that are destined for a gateway address outside the sub-network;
- comparing, via the circuitry at the controller, the measured traffic rate with a first threshold rate;
- sampling, via the circuitry at the controller, packets from the ingress port that are destined for the gateway address outside the sub-network over a period of time if the first threshold rate is exceeded by the measured traffic rate;
- and
- analyzing, via the circuitry at the controller, the sampled packets;
- the method further comprising:
- monitoring address resolution protocol (ARP) request packets received from a sub-network by a network device;
- sending a copy of the received ARP request packets to an agent program in the sub-network;
- determining by the agent program a rate of ARP request packets sent by a host in the sub-network;
- and
- identifying the host as being potentially infected with malicious code based on the determined rate of ARP request packets.
8 more elements
A network device on a sub-network configured with connection rate filtering, the device comprising:
- a plurality of ports;
- sampling circuitry;
- metering circuitry configured to measure a traffic rate on a port, wherein the sampling circuitry is configured to sample packets from the port if the traffic rate from the port to a gateway address exceeds a pre-determined threshold rate;
- and
- an agent program configured to be executed by a system processor on a sub-network;
- and
- the sampling circuitry further configured to send a copy of ARP request packets received by the network device from the sub-network to the agent program,
- wherein the agent program is further configured to determine a rate of ARP request packets broadcast by a host in the sub-network based on the received copies of the ARP request packets, and identify the host as being potentially infected with malicious code based on the determined rate of ARP request packets.
5 more elements
Dependencies are inferred from the claim text.