Network device identification

1 . A method comprising:

extracting, by a computing system, network traffic metadata related to a client computing device of a local network, wherein the network traffic metadata is required by a device fingerprinting process;

in response to detecting, by the computing system, a multicast DNS (mDNS) packet query in the network traffic metadata, extracting an mDNS hostname residing in the mDNS packet query, wherein the mDNS hostname is related to the client computing device that transmitted the mDNS packet query;

in response to determining, by the computing system at a first point in time, that a dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable in the network traffic metadata, storing, by the computing system, the mDNS hostname as an identifier of the client computing device; and

in response to extracting, by the computing system at a second point in time that is after the first point in time, the DHCP hostname related to the client computing device from the network traffic metadata, overwriting, by the computing system, the mDNS hostname previously stored by the computing system with the DHCP hostname as the identifier of the client computing device.

2 . The method according to claim 1 , further comprising:

generating one or more predetermined device identification rules for determining which hostname between the mDNS hostname and the DHCP hostname is selected to identify the client computing device.

3 . The method according to claim 2 , wherein if both the DHCP hostname and the mDNS hostname are available, storing the DHCP hostname as the identifier of the client computing device.

4 . The method according to claim 2 , wherein the mDNS hostname remains stored as the identifier of the client computing device even if the DHCP hostname becomes available.

5 . The method according to claim 2 , wherein, for generating the one or more predetermined device identification rules, one or more of the following are analyzed: a brand of the client computing device, a name of the client computing device, an operating system of the client computing device.

6 . The method according to claim 1 , wherein the mDNS hostname ends with “local”.

7 . An apparatus in a computer network system comprising:

one or more processor devices, the one or more processor devices configured to:

extract network traffic metadata related to a client computing device of a local network, wherein the network traffic metadata is required by a device fingerprinting process;

in response to detecting a multicast DNS (mDNS) packet query in the network traffic metadata, extract an mDNS hostname residing in the mDNS packet query, wherein the mDNS hostname is related to the client computing device that transmitted the mDNS packet query;

in response to determining, at a first point in time, that a dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable in the network traffic metadata, store the mDNS hostname as an identifier of the client computing device; and

in response to extracting, at a second point in time that is after the first point in time, the DHCP hostname related to the client computing device from the network traffic metadata, overwrite the mDNS hostname previously stored by the computing system with the DHCP hostname as the identifier of the client computing device.

8 . The apparatus according to claim 7 , the one or more processor devices being further configured to generate one or more predetermined device identification rules for determining which hostname between the mDNS hostname and the DHCP hostname is selected to identify the client computing device.

9 . The apparatus according to claim 8 , the one or more processor devices being further configured to store the DHCP hostname as the identifier of the client computing device if both the DHCP hostname and the mDNS hostname are available.

10 . The apparatus according to claim 8 , the one or more processor devices being further configured to allow the mDNS hostname to remain stored as the identifier of the client computing device even if the DHCP hostname becomes available.

11 . The apparatus according to claim 8 , wherein to generate the one or more predetermined device identification rules, the one or more processor devices being further configured to analyze one or more of the following: a brand of the client computing device, a name of the client computing device, an operating system of the client computing device.

12 . The apparatus according to claim 7 , wherein the mDNS hostname ends with “local”.

13 . A non-transitory computer-readable medium comprising stored program code, the program code comprised of computer-executable instructions that, when executed by a processor device, causes the processor device to:

extract network traffic metadata related to a client computing device of a local network, wherein the network traffic metadata is required by a device fingerprinting process;

in response to detecting a multicast DNS (mDNS) packet query in the network traffic metadata, extract an mDNS hostname residing in the mDNS packet query, wherein the mDNS hostname is related to the client computing device that transmitted the mDNS packet query;

in response to determining, at a first point in time, that a dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable in the network traffic metadata, store the mDNS hostname as an identifier of the client computing device; and

in response to extracting, at a second point in time that is after the first point in time, the DHCP hostname related to the client computing device from the network traffic metadata, overwrite the mDNS hostname previously stored by the computing system with the DHCP hostname as the identifier of the client computing device.