The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Aug. 16, 2011
Filed:
Oct. 25, 2006
Alastair Wolman, Seattle, WA (US);
Brian D. Zill, Redmond, WA (US);
Jitendra D. Padhye, Redmond, WA (US);
Ranveer Chandra, Kirkland, WA (US);
Paramvir Bahl, Sammamish, WA (US);
Manpreet Singh, New York, NY (US);
Lenin Ravindranath Sivalingam, Chennai, IN;
Alastair Wolman, Seattle, WA (US);
Brian D. Zill, Redmond, WA (US);
Jitendra D. Padhye, Redmond, WA (US);
Ranveer Chandra, Kirkland, WA (US);
Paramvir Bahl, Sammamish, WA (US);
Manpreet Singh, New York, NY (US);
Lenin Ravindranath Sivalingam, Chennai, IN;
Microsoft Corporation, Redmond, WA (US);
Abstract
A method of detecting rogue devices that are coupled to a wired network without generating false negative or false positive alerts is provided. When a wireless monitor detects an observed SSID and/or BSSID, various tests are run to determine whether the observed device is actually coupled to the wired network. To guard against the suspect device spoofing an authorized SSID and/or BSSID, location information is gathered so that the network administrator can pinpoint the location of the rogue device. If the device is not recognized, various other tests are run to determine whether the unrecognized device is actually connected to the wired network. These tests include an association test, a MAC address test, an ARP test, a packet replay test, a correlation test, and/or a DHCP fingerprint test. Once it is determined that the suspect device is a rogue connected to the wired network, an appropriate alert is generated.