Detectable of intrusions containing overlapping reachabilities

Abstract

In an ATM network operating in accordance with PNNI standards, the operation of a switch is divided into two phases, a learning mode phase and an active mode phase. During learning mode phase, each time a reachability is received from a sending switch, the reachability is recorded in the database of the receiving switch and the received reachability is sent to other switches in the same peer group. At the end of the learning mode phase, the database of each of the switches contains the reachabilities advertised by all the switches of the peer group during the learning mode group phase. On a termination of the learning mode, the switches enter the active mode phase. During the active mode, each time a reachability is received from a sending switch, the receiving switch checks to see if the reachability has been advertised in the past by that sending switch. If it has, the reachability is considered to be valid and the receiving switch waits for the next reachability. On the other hand, if the particular reachability has never been announced before the sending node, it is compared to the reachability in the database for all other nodes of the peer group. If the reachability causes the reachability from other node to be overlapped and the overlapping is suspicious, then an alarm is raised.