Network service monitoring

1. A method for monitoring network services, comprising:

examining a number of packets received by a first network device to determine whether a protocol of a packet corresponds to a network service;

forwarding packet service type information and packet address information to a second network device in response to a determination that the protocol of the packet corresponds to the network service;

comparing the packet service type information and an associated service type address to a list of service types and addresses on the second network device; and

executing a remedial action if, based on the comparing, it is determined that the network service is an unauthorized service and that a provider of the network service is an unauthorized provider.

2. The method of claim 1 , wherein the remedial action is selected from a number of remedial actions, and wherein a particular remedial action executed is based on a service type of the unauthorized service.

3. The method of claim 1 , wherein forwarding packet address information includes forwarding packet address information selected from the group of:

a source address of the packet; and

a destination address of the packet.

4. The method of claim 3 , wherein the list includes a number of entries that include a service type and an associated service type address, and wherein the method includes determining whether the network service is an authorized service by comparing the packet service type information to the number of entries.

5. The method of claim 4 , wherein the method includes first determining whether the network service is an authorized service and, if it is determined that the network service is an authorized service, then determining whether a provider of the network service is an authorized provider.

6. The method of claim 5 , wherein the method includes determining whether the provider of the network service is an authorized provider by comparing the packet address information to the number of entries.

7. The method of claim 1 , wherein the method includes distinguishing between a number of different network services by using the protocol and a port of the packet.

8. A non-transitory computer readable medium comprising an electronic memory including computer executable instructions stored thereon that can be executed by a computing device to perform a method, comprising:

examining a number of packets received by a first network device to identify packets corresponding to network services based on a protocol specified in a header of the packets;

forwarding packet service type information and packet address information to a second network device in response to a packet identified as corresponding to a network service based on the protocol specified in a header of the packet;

comparing the packet service type information and the packet address information to a list of authorized service types and authorized service provider addresses associated with the authorized service types; and

executing a remedial action policy when, based on the comparing, it is determined that the network service is an unauthorized service and that a provider of the network service is an unauthorized provider.

9. The medium of claim 8 , wherein method includes determining whether a provider of the network service is an authorized provider by comparing the packet address information to the list, the packet address information selected from the group of:

a source address of the packet; and

a destination address of the packet.

10. The medium of claim 8 , wherein executing the remedial action policy includes executing an action based on a type of the unauthorized service.

11. The medium of claim 8 , wherein examining the number of packets includes identifying packets corresponding to network services selected from the group of:

a dynamic host configuration protocol (DHCP) service;

a domain name system (DNS) service; and

a gateway service.

12. The medium of claim 8 , wherein examining the number of packets to identify packets corresponding to network services includes distinguishing between different network service types by identifying a protocol of the packets.

13. A network system, comprising:

a first network device including logic stored in memory as firmware, the logic operable to:

determine whether a packet among a number of packets received by the first network device is a network service packet based on a protocol field of a header of that packet; and

transmit packet service type information and packet address information to a second network device in response to a determination that the packet a network service packet; and

wherein the second network device is connected over the network system to the first network device, and wherein the second network device includes a memory coupled to a processor and has computer executable instructions stored on the memory and executed by the processor to:

receive the packet service type information and the packet address information;

compare the packet service type information and an associated service type address to a list of service types and addresses on the second network device; and

execute a remedial action if, based on the comparing, it is determined that the network service is an unauthorized service and that a provider of the network service is an unauthorized provider.

14. The network system of claim 13 , wherein a network service packet is selected from the group of:

a packet associated with a dynamic host configuration protocol (DHCP) service;

a packet associated with a domain name system (DNS) service; and

a packet associated with a gateway service.

15. The network system of claim 13 , wherein the remedial action is selected from a number of remedial actions, and wherein a particular remedial action executed is based on a service type of the unauthorized service.

16. The network system of claim 13 , wherein the second network device includes computer executable instructions stored in the memory and executed by the processor to determine whether a particular associated network service provider address is on the list if the service type is determined to correspond to an authorized network service.

17. The network system of claim 16 , wherein the second network device includes computer executable instructions stored in the memory and executed by the processor to inhibit network traffic associated with the particular network service provider address if the particular network service provider address is not on the list.

18. The network system of claim 16 , wherein the network device includes computer executable instructions stored in the memory and executed by the processor to determine whether the packet is a network service packet by examining a port address of the packet.

19. A method for monitoring network services, comprising:

examining a number of packets received by a first network device to determine whether a protocol field of a packet header corresponds to a network service to distinguish packets corresponding to a network service;

forwarding packet service type information and packet address information to a second network device in response to a determination that the protocol field of that packet corresponds to a network service;

comparing the packet service type information and an associated service type address to a list of service types and addresses on the second network device; and

executing a remedial action if, based on the comparing, it is determined that the network service is an unauthorized service.