3com Corporation

Mark A Pearce

Ronald Brown

Hamish D S Martin

Robin Anthony Iddon

David John Maxwell

Jonathan G G Tams

Iain Hogg

Peter I Oliver

Jonathan Tams

Ronnie Brown

A method and apparatus for identifying a device acting as a server on a network is disclosed which uses network data representing communications on the network. The network data contains source device, destination device, data transfer protocol and data volume information for each communication represented therein and may be collected by network traffic monitors or packet capture devices such as RMON2 probes on the network. Data relating to relevant server protocols is identified within the network data, and using the identified data, a device is determined to be acting as a server if it has the highest data volume for communications in which it is the source or destination device and which communications involve at least a threshold number of other devices. The method may be conveniently implemented in a computer program and may be used in conjunction with a network management application.

System for identifying servers on network by determining devices that have the highest total volume data transfer and communication with at least a threshold number of client devices

In a computer network of devices, at least some of the devices (i.e. the DCHP devices) have a static (e.g. MAC) address which does not change over time and a dynamic (e.g. IP) address which may change over time. There is disclosed a method and computer program for mapping the static address and dynamic address for the devices comprising polling said devices using said IP addresses and during said polling determining the MAC addresses of the devices, and providing a set of mapped static and dynamic addresses, said method including repeating the steps of the method at intervals. Using the method of the invention, it is possible, when entering a particular conversation in a database, to access the IP addresses, to determine which is the current DHCP device that address maps to, and assign the conversation to that device and store it in the database assigned to that device. Therefore, for each DHCP device, one can store a history of the conversations or traffic involved in that device.

Tracking dynamic addresses on a network

A computer program detects a potential attack on a computer network. A list E is made from network traffic data including source and destination addresses of traffic on the network. The list E includes all source addresses in the data which are not allocated to the network and are not in a list X. A first address in list E is chosen. A number of data entries including A and B and representing network traffic passing between source address A, chosen from list E, and destination address B, allocated to the network, is counted. If the number of such data entries is more than T, address A is output, thereby identifying address A as a potential source of attack. If it is determined that any entries in list E are left, the next address in list E is moved to, and the counting, outputting and determining is repeated, otherwise, stopping.

Detection of an attack such as a pre-attack on a computer network

Methods and apparatus for collecting, storing, processing and using data, such a RMON2 network traffic data, are described. Network traffic probes are identified and attempts are made to configure the identified probes to generate network traffic data sets which are as close to a preselected common data format as possible. Application layer traffic data is collected in addition to network layer traffic data when possible. In an RMON2 embodiment, the common data format includes the use of delta count values as opposed to absolute count values. The common data format of the present invention utilizes terminal count mode format as opposed to all count mode format for the presentation of RMON2 application layer information. To minimize the amount of data processing required to put a probe's network traffic data into the desired common format and to maximize the amount of information collected, network data is obtained from a probe using one of the available RMON2 table formats. In order to avoid various problems with known data aging processes used to limit the growth of network traffic databases, a database of collected network traffic information which includes multiple parallel sets of data stored at different resolutions is created and maintained. The data sets for each individual resolution are stored in a separate FIFO data structure and with the oldest data records in the FIFO being overwritten when allocated data space becomes fully utilized.

Growing community of inventors

Edinburgh, United Kingdom

Mark A Pearce