Method and apparatus for the classification of ports on a data communication network node
View Patent ↗A method and apparatus for classifying a port on a node in a data communications network, such as a router. The node, itself or in some embodiments though another network device, determines whether the port in question is currently receiving packets from a single address, for example a MAC address, only. If so, incoming packets of at least a first type are selected for inspection. The inspection criteria may vary with the type or types of packets selected, but in any case the results of the inspection are used to determine whether the single address corresponds with a client device. If so, selective security measures may be applied to the port. If security measures are applied to a port, the port is preferably monitored periodically to ensure that it remains a client port. The frequency of inspections or monitoring may vary depending on the port's classification history.
1. A method of classifying a port on a node in a data communication network, comprising:
(a) determining by a packet monitor whether the port is receiving packets from a single MAC (medium access control) address by polling at least one layer 2 hardware table;
(b) if so, selecting during a defined training period packets of at least a first type from those incoming at the port;
(c) inspecting the selected packets; and
(d) determining from the inspection whether the single address corresponds to a client device.
2. The method of claim 1 , further comprising terminating the selection of packets for inspection at the conclusion of the defined training period.
3. The method of claim 1 , further comprising repeating (a) through (d) after a predetermined interval following the determination of whether the single address corresponds to a client device.
4. The method of claim 1 , wherein the first type of packets are NetBIOS-Datagram Service (DS) packets.
5. The method of claim 1 , wherein the first type packets are Server Message Block (SMB) packets.
6. The method of claim 1 , wherein the first type of packets are Dynamic Host Configuration protocol (DHCP) packets.
7. The method of claim 1 , further comprising wherein selecting packets of at least a first type from those incoming at the port comprises also selecting packets of a second type.
8. The method of claim 1 , further comprising monitoring of the port following the determination that the single address corresponds to a client device.
9. The method of claim 8 , further comprising copying all ingress traffic at the port from an address different from the source IP address associated with the client device.
10. The method of claim 9 , wherein the copied traffic is copied by a Ternary Content Addressable Memory (TCAM).
11. The method of claim 1 , further comprising selecting at least one security measure and applying the at least one selected security measure to the port if the single address is determined to be associated with a client device.
12. The method of claim 1 , wherein (a) through (d) are performed by the node.
13. The method of claim 12 , wherein the node is a router.
14. A method of selectively providing enhanced security in a data communication network, comprising:
(a) determining by a packet monitor whether a network node port is receiving packets from a single IP (Internet Protocol) address;
(b) if so, selecting incoming packets of at least a first type during a defined training period;
(c) inspecting the selected packets;
(d) determining from the inspection whether the port is a client port;
(e) applying at least one security measure to incoming traffic on the port; and
(f) monitoring the port following application of the at least one security measure by copying all traffic received at the port from a source IP address that is different from the source IP address associated with determination that the port is a client port.
15. The method of claim 14 , thither comprising removing the at least one security measure if the monitoring determines that packets received on the port are from a plurality of source addresses.
16. A network node, comprising:
at least one port;
a packet monitor comprising a TCAM (ternary content addressable memory), the packet monitor for determining whether all packets being received on the at least one port are associated with a single source address;
a packet selector for selecting packets for inspection during a defined training period if the packet monitor determines that all packets being received on the at least one port are associated with a single source address;
a packet inspector for inspecting the packets selected by the packet selector; and
a classification manager for classifying the at least one port based on the inspection by the packet inspector.
17. The network node of claim 16 , wherein the network node is a router.
18. The network node of claim 16 , wherein the classification manager generates an instruction for applying security measures to any port classified as a client port.
19. The network node of claim 18 , wherein the classification manager instructs the port monitor to periodically monitor any port to which security measures have been applied.