# US 8,787,176 B2 · Switch that monitors for fingerprinted packets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,787,176 B2 - Document ID: US8787176B2 - Status: Granted - Kind: B2 - Application number: 13/259,551 - Filed: 2009-10-29 - Published: 2012-02-09 - Granted: 2014-07-22 - Earliest claimed: 2009-10-29 - Assignees: Hewlett-Packard Development Company, L.P. - Applicants: Daniel E. Ford; Gregory D. Dolkas - Inventors: Daniel E. Ford; Gregory D. Dolkas - Web page: https://patentgrep.com/patent/US8787176B2 ## CPC - H04L 43/026: using flow identification - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 43/022: by sampling - H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A switch comprises a switching module coupled to a plurality of ports. The switching module receives and forwards a plurality of packets through the ports. The switch also comprises a management unit comprising a processor and an agent executable by the processor. The agent causes the processor to monitor each packet received by the switching module and determine whether each such packet contains a predetermined fingerprint. Upon determining that a packet contains the predetermined fingerprint, the processor causes additional information to be included in a copy of the fingerprinted packet and forwarded to a predetermined address. The switching module also forwards the packet containing the predetermined fingerprint, but without the additional information, to an address corresponding to a destination address contained in the packet. A method of programming the switches is also described as well as a management workstation used to program the switches and analyze the fingerprinted packets. ## Claims ### Claim 1 A switch, comprising: a switching module coupled to a plurality of ports, said switching module receives and forwards a plurality of packets through said ports; and a management unit comprising a processor and an agent executable by said processor, said agent causes the processor to monitor each packet received by the switching module and determine whether each such packet contains a predetermined fingerprint, and upon determining that a packet contains the predetermined fingerprint, said processor causes additional information to be included in a copy of said fingerprinted packet and forwarded to a predetermined address; wherein said switching module also forwards said packet containing said predetermined fingerprint, but without said additional information, to an address corresponding to a destination address of a network, the destination address contained in said packet, and wherein said predetermined fingerprint comprises a bit sequence that does not alter a path that the packet follows through the network to the destination address. ### Claim 2 (depends on 1) The switch of claim 1 wherein said management unit receives a management packet from a network, said management packet requesting said agent to begin monitoring packets for said predetermined fingerprint. ### Claim 3 (depends on 1) The switch of claim 1 wherein said management unit receives a management packet from a network, said management packet comprising said predetermined fingerprint. ### Claim 4 (depends on 1) The switch of claim 1 wherein said agent determines whether a received packet should be sampled in accordance with periodic sampling and, if a packet should be sampled, said agent causes said processor to append a copy of such packet with additional information and forward such packet to the predetermined address. ### Claim 5 (depends on 4) The switch of claim 4 wherein said agent determines whether a received packet should be sampled after determining that said packet does not contain said fingerprint. ### Claim 6 (depends on 1) The switch of claim 1 wherein said predetermined address is not an address contained in said packet. ### Claim 7 A method, comprising: receiving, by a switch, a plurality of packets from a network; determining, by the switch, whether at least one packet contains a predetermined fingerprint; generating, by the switch, a copy of said at least one packet that matches said predetermined fingerprint; appending, by the switch, additional information to said copy to form a datagram; forwarding, by the switch, said datagram to a predetermined address; and forwarding, by the switch, said at least one packet that matches said predetermined fingerprint, without said additional information, to an address corresponding to a destination address of a network, the destination address contained in the packet, wherein said predetermined fingerprint comprises a bit sequence that does not alter a path that the packet follows through the network to the destination address. ### Claim 8 (depends on 7) The method of claim 7 further comprising receiving a management packet that specifies that the switch is to begin determining whether received packets contain the predetermined fingerprint. ### Claim 9 (depends on 8) The method of claim 8 further comprising receiving a management packet that specifies the predetermined fingerprint. ### Claim 10 (depends on 7) The method of claim 7 further comprising periodically selecting a received packet, generating a copy of said selected packet, appending additional information to said copy of said selected packet, and forwarding said selected packet with said additional information to said predetermined address. ### Claim 11 A system, comprising: a network interface; a processor coupled to said network interface; storage containing software executable by said processor and that provides a graphical user interface to a user that permits the user to enable a function whereby a plurality of switches in a network monitor packets for a predetermined fingerprint and, upon detecting the packets forward a copy of the packets to the network interface of said system in addition to forwarding said packets to an address corresponding to a destination address of a network, the destination address contained in the packets, wherein said predetermined fingerprint comprises a bit sequence that does not alter a path that the packets follow through the network to the destination address. ### Claim 12 (depends on 11) The system of claim 11 wherein said network interface receives copies of packets from a plurality of switches in said network, each copy containing a common predetermined fingerprint. ### Claim 13 (depends on 11) The system of claim 11 wherein said software causes said processor to send a management packet to a plurality of switches in said network, said management packet comprising the predetermined fingerprint.