System and method for tamper resistant reliable logging of network traffic
View Patent ↗A network interface device includes a memory and a processor operable to receive a malicious packet marker, store the malicious packet marker to the memory, monitor network data packets flowing in the network interface device, determine that a packet matches the malicious packet marker, and store log information from the packet to the memory.
1. A network interface device comprising:
a first communication interface coupled to an information handling system;
a second communication interface coupled to a management controller;
a network port coupled to a network;
a memory including first code and second code; and
a processor operable to execute the first code to communicate network data packets between the first communication interface and the network port, and to execute the second code to:
launch a log module in response to a command from the management controller;
receive, by the log module, a malicious packet marker from the information handling system;
store, by the log module, the malicious packet marker to the memory;
receive, by the log module, a job entry from a management system separate from the management controller, wherein the job entry is received via the management controller via the second communication interface; and
in response to receiving the job entry, to:
monitor, by the log module, the network data packets flowing between the first communication interface and the network port;
determine, by the log module, that a packet matches the malicious packet marker;
store, by the log module, log information from the packet to the memory in response to determining that the packet matches the malicious packet marker; and
send, by the log module, the log information to the management controller via the second communication interface.
2. The network interface device of claim 1 , wherein the second communication interface comprises a Reduced Media Independent Interface.
3. The network interface device of claim 1 , wherein the malicious packet marker is received via the network port.
4. The network interface device of claim 3 , wherein the processor is further operable to send the log information to the network via the network port.
5. The network interface device of claim 1 , wherein the malicious packet marker is received from a log module of the information handling system.
6. The network interface device of claim 5 , wherein the processor is further operable to send the log information to the log module of the information handling system.
7. The network interface device of claim 1 , wherein the second code is isolated from the information handling system.
8. The network interface device of claim 1 , wherein the malicious packet marker is received via the second communication interface.
9. A method comprising:
communicating, by a network interface device, network data packets between a first communication interface of a network interface device and a network port of the network interface device;
launching, by a launch controller of a management controller, a log module on the network interface device, wherein the management controller is coupled to the network interface device via a second communication interface;
receiving, by the log module, a malicious packet marker;
storing, by the log module, the malicious packet marker in a memory of the network interface device;
receiving, by the management controller, a job entry from a management system external to the management controller;
sending, by the launch controller, the job entry to the log module; and
in response to sending the job entry:
monitoring, by the log module, network data packets flowing between the first communication interface and the network port;
determining, by the log module, that a packet matches the malicious packet marker;
storing, by the log module, log information from the packet to the memory in response to determining that the packet matches the malicious packet marker;
sending the log information to the management controller via the second communication interface; and
sending, by the log module, the log information to the management system.
10. The method of claim 9 , wherein the second communication interface comprises a Network Communication Service Interface.
11. The method of claim 9 , wherein malicious packet marker is received via the network port.
12. The method of claim 11 , further comprising:
sending the log information to the network via the network port.
13. The method of claim 9 , wherein the malicious packet marker is received from a log module of the information handling system.
14. The method of claim 13 , further comprising:
sending the log information to the log module of the information handling system.
15. The method of claim 9 , wherein the malicious packet marker is received via the second communication interface.
16. A non-transitory computer-readable medium including code for performing a method, the method comprising:
communicating network data packets between a first communication interface of a network interface device and a network port of the network interface device;
launching, by a launch controller of a management controller, a log module on the network interface device, wherein the management controller is coupled to the network interface device via a second communication interface;
receiving, by the log module, a malicious packet marker via the first communication interface;
storing, by the log module, the malicious packet marker in a memory of the network interface device;
receiving, by the management controller, a job entry from a management system external to the management controller; and
sending, by the launch controller, the job entry to the log module; and
in response to receiving the job entry:
monitoring, by the log module, network data packets flowing between the first communication interface and the network port;
determining, by the log module, that a packet matches the malicious packet marker;
storing, by the log module, log information from the packet to the memory in response to determining that the packet matches the malicious packet marker;
sending, by the log module, the log information to the management controller via the second communication interface; and
sending, by the log module, the log information to the management system.
17. The computer readable medium of claim 16 , wherein the malicious packet marker is received via the second communication interface.