Sourcefire, Inc.

Ronald A Dempster

Martin Frederick Roesch

Eric Gustafson

Andrew Baker

Judy Hollis Novak

Nigel Houghton

A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.

Systems and methods for determining characteristics of a network and enforcing policy

Systems and methods for determining characteristics of a network based on flow analysis

Systems and methods for determining characteristics of a network

Systems and methods for identifying the services of a network

Systems and methods for determining characteristics of a network and assessing confidence

A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A client application running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and client applications identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and client applications identified by reading, decoding, and analyzing packets.

Systems and methods for identifying the client applications of a network

Growing community of inventors

Mount Airy, MD, United States of America

Ronald A Dempster