Blacklisting based on a traffic rule violation
View Patent ↗In some embodiments, a network system includes an access point to wirelessly associate with a client that provides signals with traffic specification attributes to the access point. The system also includes circuitry detect if at least one of the signals violates a traffic rule through considering at least one of the traffic specification attributes and to instruct the access point to disassociate the client in response to a particular number of violations. Other embodiments are described.
1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors of a network device operating in a network, cause the network device to:
determine that one or more attributes characterizing a communication between a first client device that was previously authenticated to operate on the network and a second client device, violate one or more of a set of traffic rules that describe traffic attributes;
responsive to determining that the one or more transmissions violate one or more of the set of traffic rules:
transmit a disassociation frame or a de-authentication frame for the first client device; and
add the first client device to a blacklist;
receive by an access point from the first client device, one or more requests;
determine that the first client device is included in the blacklist; and
responsive at least to determining that the first client device is included in the blacklist:
prevent the first client device from completing an association with the access point.
2. The medium of claim 1 , comprising further instructions that when executed by the one or more hardware processors of the network device, cause the network device to:
transmit the blacklist to a plurality of access points to prevent association of client devices in the blacklist with any of the plurality of access points.
3. The medium of claim 1 , wherein the instructions that cause the network device to receive, determine that the first client device is included in the blacklist, and prevent are performed subsequent to causing a disassociation of the first client device from the access point.
4. The medium of claim 1 , wherein preventing the first client device from completing the association with the access point comprises preventing the first client device from completing the association for a temporary period of time.
5. The medium of claim 1 , wherein preventing the first client device from completing the association with the access point comprises permanently preventing the first client device from completing the association.
6. The medium of claim 1 , wherein (a) the determining that one or more attributes characterizing the communication between the first client device that was previously authenticated to operate on the network and the second client device, violate one or more of the set of traffic rules that describe traffic attributes and (b) the transmitting the disassociation frame or the de-authentication frame for the first client device are performed prior to receiving the one or more requests.
7. The medium of claim 1 , wherein the disassociation frame for the first client device causes the first client device to disassociate from the access point.
8. The medium of claim 1 , wherein determining that the first client device is included in a blacklist comprises determining that a Media Access Control (MAC) address of the first client device is included in the blacklist.
9. The medium of claim 1 , wherein the network device is the access point.
10. The medium of claim 1 , wherein the network device is different from the access point.
11. A network device, comprising;
a hardware processor that is configured to;
determine that one or more attributes characterizing a communication between a first client device that was previously authenticated to operate on the network and a second client device, violate one or more of a set of traffic rules that describe traffic attributes;
responsive to determining that the one or more transmissions violate one or more of the set of traffic rules:
transmit a disassociation frame or a de-authentication frame for the first client device; and
add the first client device to a blacklist;
receive by an access point from the first client device, one or more requests;
determine that the first client device is included in the blacklist; and
responsive at least to determining that the first client device is included in the blacklist:
prevent the first client device from completing an association with the access point.
12. The network device of claim 11 further configured to:
transmit the blacklist to a plurality of access points to prevent association of client devices in the blacklist with any of the plurality of access points.
13. The network device of claim 11 , wherein receiving, determining that the first client device is included in the blacklist, and preventing are performed subsequent to causing a disassociation of the first client device from the access point.
14. The network device of claim 11 , wherein preventing the first client device from completing the association with the access point comprises preventing the first client device from completing the association for a temporary period of time.
15. The network device of claim 11 , wherein preventing the first client device from completing the association with the access point comprises permanently preventing the first client device from completing the association.
16. The network device of claim 11 , wherein (a) the determining that one or more attributes characterizing the communication between the first client device that was previously authenticated to operate on the network and the second client device, violate one or more of the set of traffic rules that describe traffic attributes and (b) the transmitting the disassociation frame or the de-authentication frame for the first client device are performed prior to receiving the one or more requests.
17. The network device of claim 11 , wherein the disassociation frame for the first client device causes the first client device to disassociate from the access point.
18. The network device of claim 11 , wherein determining that the first client device is included in a blacklist comprises determining that a Media Access Control (MAC) address of the first client device is included in the blacklist.
19. The network device of claim 11 , wherein the network device is the access point.
20. The network device of claim 11 , wherein the network device is different from the access point.
21. The medium of claim 1 , wherein the set of traffic rules include a set of destination addresses that are unacceptable for transmissions by the first client device.
22. The medium of claim 1 , wherein preventing the first client device from completing an association with the access point is performed in response to determining that two or more rules from the set of traffic rules have been violated.
23. The medium of claim 1 , wherein the set of traffic rules are selected based on the type of the first client device.