Method and system for restricting a node from communicating with other nodes in a broadcast domain of an IP (internet protocol) network
View Patent ↗Method and system for restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes. Each of the first node and the one or more other nodes has a respective translation table that maps an IP address to a respective physical address of all nodes with which the first node and the one or more other nodes have communicated. Embodiments of the invention describe obtaining communicated data including address resolution messages and accessing an address resolution table representative of address resolution activity in the network. Responsive to the communicated data indicating that the first node is communicating with other nodes, restricting the first node from communicating by generating and conveying a restricting address resolution message using information stored in the address resolution table, the restricting address resolution message including a substitute physical address.
1. A method of restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, wherein the method is provided through a computerized apparatus operatively coupled to the IP network, the method comprising:
obtaining communicated data, said communicated data comprising address resolution messages;
accessing a virtual address resolution table, which is representative of an address resolution activity in the IP network;
responsive to said communicated data, indicating that the first node is communicating with other nodes, restricting said first node from communicating by generating and conveying a restricting address resolution message by using information stored in said virtual address resolution table, said restricting address resolution message comprising a substitute physical address; and
updating information stored in the virtual address resolution table so as to represent changes to the information stored in the translation tables respective of the first node and the one or more other nodes, wherein updating information stored in the virtual address resolution table comprises updating respective of an operating system running on each corresponding node over the IP network.
2. The method according to claim 1 , further comprising providing within the restricting address resolution message an IP address of the first node.
3. The method according to claim 1 , further comprising conveying the restricting address resolution message to the first node and/or to the one or more other nodes.
4. The method according to claim 1 , further comprising providing within the restricting address resolution message an IP address of one of the other nodes.
5. The method according to claim 1 , further comprising updating information stored in the virtual address resolution table respective of indirect updating of translation tables in nodes operating in the broadcast domain.
6. The method according to claim 1 , further comprising providing the address resolution message as an address resolution request, an address resolution reply and a gratuitous address resolution message.
7. The method according to claim 1 , wherein the substitute physical address is a nonexistent physical address that does not exist in the broadcast domain.
8. The method according to claim 1 , wherein the substitute physical address is a physical address of a node operating in the broadcast domain.
9. The method according to claim 1 , wherein the one or more other nodes are all other nodes operating in the broadcast domain.
10. The method according to claim 1 , further comprising selecting the one or more other nodes from amongst all nodes operating in the broadcast domain.
11. The method according to claim 1 , further comprising providing, within the one or more other nodes, at least one node that is operating out of the broadcast domain.
12. The method according to claim 1 , further comprising providing the address resolution message as the communicated data, said communicated data being indicative that the first node is communicating with other nodes.
13. A method of restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, wherein the method is provided through a computerized apparatus operatively coupled to the IP network, the method comprising:
obtaining communicated data, said communicated data comprising address resolution messages;
accessing a virtual address resolution table, which is representative of an address resolution activity in the IP network;
responsive to said communicated data, indicating that the first node is communicating with other nodes, restricting said first node from communicating by generating and conveying a restricting address resolution message by using information stored in said virtual address resolution table wherein the information stored in said virtual address resolution table comprises information maintained respective of an operating system running on each corresponding node of the IP network, said restricting address resolution message comprising a substitute physical address; and
providing non-address resolution communication as the communicated data, said communicated data indicating that the first node is communicating with other nodes.
14. The method according to claim 13 , further comprising providing the layer three communication as non-address resolution communication.
15. A method of restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, wherein the method is provided through a computerized apparatus operatively coupled to the IP network the method comprising:
obtaining communicated data, said communicated data comprising address resolution messages;
accessing a virtual address resolution table, which is representative of an address resolution activity in the IP network;
responsive to said communicated data indicating that the first node is communicating with other nodes, restricting said first node from communicating by generating and conveying a restricting address resolution message by using information stored in said virtual address resolution table, said restricting address resolution message comprising a substitute physical address;
generating and conveying the restricting address resolution message in response to expiry of a restricting-timer; and
affecting the restricting-timer by an ARP-check-timeout being predetermined by an operating system that operates on the first node.
16. A method of maintaining a virtual address resolution table that is representative of an address resolution activity in a network, wherein the method is provided through a computerized apparatus operatively coupled to the network, the method comprising:
obtaining communicated data that comprises an address resolution message, exchanged between a first node and one or more other nodes, each one of the first node and the one or more other nodes having a respective translation table that maps an IP (Internet Protocol) address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated; and
updating information stored in said virtual address resolution table so as to represent changes to information stored in the translation tables respective of the first nodes and the one or more other nodes, wherein updating information stored in the virtual address resolution table comprises updating respective of an operating system running on each corresponding node over the IP network.
17. The method according to claim 16 , further comprising deleting from the virtual address resolution table the information that represents one or more expired nodes.
18. An apparatus configured to restrict a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, the apparatus comprising:
a network monitor configured to obtain communicated data that comprises address resolution messages;
a restricting processor coupled to said network monitor and having access to a virtual address resolution table representative of address resolution activity in the IP network, said restricting processor being responsive to said communicated data indicating that the first node is communicating with other nodes, and said restricting processor configured to restrict the first node from communicating by generating and conveying a restricting address resolution message by using information stored in the virtual address resolution table wherein the information stored in said virtual address resolution table comprises information maintained respective of an operating system running on each corresponding node of the IP network, said restricting address resolution message comprising a substitute physical address; and
a table manager coupled to said network monitor and responsive to the communicated data indicating that the first node is communicating with the one or more other nodes, said table manager configured to update information stored in the virtual address resolution table so as to represent changes to information stored in the translation tables respective of the first node and the one or more other nodes.
19. The apparatus according to claim 18 , wherein the restricting processor is configured to generate a restricting address resolution message that in addition to the substitute physical address comprises an IP address of the first node.
20. The apparatus according to claim 18 , wherein the restricting address resolution message is conveyed to the one or more other nodes.
21. The apparatus according to claim 18 , wherein the restricting processor is configured to generate a restricting address resolution message that in addition to the substitute physical address comprises an IP address of one of the other nodes.
22. The apparatus according to claim 18 , wherein the restricting address resolution message is conveyed to the first node.
23. An apparatus configured to restrict a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, the apparatus comprising:
a network monitor configured to obtain communicated data that comprises address resolution messages;
a restricting processor coupled to said network monitor and having access to a virtual address resolution table representative of address resolution activity in the IP network, said restricting processor being responsive to said communicated data indicating that the first node is communicating with other nodes, and said restricting processor configured to restrict the first node from communicating by generating and conveying a restricting address resolution message by using information stored in the virtual address resolution table, said restricting address resolution message comprising a substitute physical address; and
a table manager coupled to said network monitor and responsive to the communicated data indicating that the first node is communicating with the one or more other nodes, said table manager configured to update the information stored in the virtual address resolution table respective of an operating system running on each corresponding node over the IP network.
24. An apparatus configured to maintain a virtual address resolution table representative of address resolution activity in a network, the apparatus comprising:
a network monitor comprising a non-transitory computer readable medium storing computer readable program code for causing a computer to obtain communicated data that comprises an address resolution message exchanged between a first node and one or more other nodes, each one of the first node and the one or more other nodes having a respective translation table that maps an IP (Internet Protocol) address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated; and
a table manager coupled to said network monitor and responsive to said communicated data indicating that the first node is communicating with the one or more other nodes, said table manager comprising a non-transitory computer readable medium storing computer readable program code for causing a computer to update information stored in said virtual address resolution table so as to represent changes to information stored in the translation tables respective of the first node and the one or more other nodes, wherein the table manager is configured to update the information stored in the virtual address resolution table respective of an operating system running on each corresponding node over the network.
25. A non-transitory computer readable medium readable by machine, tangibly embodying a program of instructions executable by the machine for causing the machine to perform a method of restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, the method comprising:
obtaining communicated data, said communicated data comprising address resolution messages;
accessing a virtual address resolution table, which is representative of an address resolution activity in the IP network;
responsive to said communicated data, indicating that the first node is communicating with other nodes, restricting said first node from communicating by generating and conveying a restricting address resolution message by using information stored in said virtual address resolution table wherein the information stored in said virtual address resolution table comprises information maintained respective of an operating system running on each corresponding node of the IP network, said restricting address resolution message comprising a substitute physical address; and
updating information stored in the virtual address resolution table so as to represent changes to the information stored in the translation tables respective of the first node and the one or more other nodes.
26. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method of maintaining a virtual address resolution table that is representative of an address resolution activity in a network, the method comprising:
obtaining communicated data that comprises an address resolution message, exchanged between a first node and one or more other nodes, each one of the first node and the one or more other nodes having a respective translation table that maps an IP (Internet Protocol) address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated; and
updating information stored in said virtual address resolution table so as to represent changes to information stored in the translation tables respective of the first nodes and the one or more other nodes, wherein updating information stored in the virtual address resolution table comprises updating respective of an operating system running on each corresponding node over the IP network.