Programmable, policy-based efficient wireless sniffing networks in wips (wireless intrusion prevention systems)

Abstract

A plurality of sniffing policies describing deep packet inspection processes performed on network traffic at sniffing access points from the plurality of access points is received. Network traffic levels are monitored at the plurality of access points and a level of sniffed traffic backhauled over the Wi-Fi network for analysis. A change can be detected in network traffic affecting a sniffing policy. Responsive to exceeding a certain level of sniffed traffic being backhauled, an amount of sniffed traffic sent upstream for analysis is adjusted. More specifically, a programmable policy engine at each of a sniffing access points serving as intrusion detection sensors to sniff traffic at various locations on the Wi-Fi network are reprogrammed dynamically. The adjustments reprogram a sniffing pipeline at each of the intrusion detection sensors including adjusting an endpoint device for sending sniffed traffic and dropping more traffic during deep packet inspection.