Switch monitoring system and method of use
A system is disclosed that monitors endpoints such as video cameras and audio devices for malfunction through a novel TDMA device allocation format. The system isolates and analyzes a set of groups of video streams in a rotating and recurring fashion and generates alerts and remedial commands based on the analysis. The system also provides endpoint management functions such as password analysis and firewall functions.
1. An appliance for monitoring a set of endpoint devices, operatively connected to a switch, the appliance comprising:
a processor;
a memory connected to the processor;
the memory containing instructions that, when executed by the processor cause the appliance to carry out the steps of:
detecting a count of endpoint devices in the set of endpoint devices;
dynamically allocating, based on the count of endpoint devices, temporary memory for each mirroring and processing cycle to reduce switch processing burden; wherein each mirroring and processing cycle comprises:
receiving a set of mirrored data streams from the switch;
dividing the set of mirrored data streams into a set of groups; and
analyzing, in a time division multiple access (TDMA) format, each group of the set of groups individually for a predetermined condition; and,
generating an error message upon detection of the predetermined condition.
2. The appliance of claim 1 wherein the memory contains further instructions, that when executed by the processor cause the appliance to carry out the steps of:
generating a remedial command based on the predetermined condition; and, sending the remedial command to the switch.
3. The appliance of claim 1 wherein the step of analyzing further comprises:
identifying a first SSRC from a first datagram packet;
identifying a second SSRC from a second datagram packet;
comparing the first SSRC to the second SSRC;
incrementing a counter based on the comparison; and,
reporting an error if the counter exceeds a predetermined number.
4. The appliance of claim 1 wherein the step of analyzing further comprises:
identifying a video bit rate from the set of mirrored data streams;
determining whether or not the video bit rate is less than or equal to zero; and,
reporting an error if the video bit rate is less than or equal to zero.
5. The appliance of claim 1 wherein the step of analyzing further comprises:
identifying an audio bit rate from the set of mirrored data streams;
determining whether or not the audio bit rate is less than or equal to zero; and,
reporting an error if the audio bit rate is less than or equal to zero.
6. The appliance of claim 1 wherein the step of analyzing further comprises:
isolating a first data stream from the set of data streams using an SSRC;
analyzing the first data stream for a media parameter;
analyzing the first data stream for a quality parameter;
analyzing the first data stream for a rule violation; and,
sending an alert based on one of the group of the media parameter, the quality parameter and the rule violation.
7. The appliance of claim 1 wherein the appliance is further operatively connected to a user device, wherein the memory further contains instructions that, when executed by the processor cause the appliance to carry out the steps of:
receiving a list of chosen MAC address IDs from the user device;
receiving a list of chosen UDP/TCP ports from the user device;
generating a filter instruction based on the list of chosen MAC address IDs and the list of the chosen UDP/TCP ports;
sending the filter instruction to the switch;
whereby the mirrored data streams in a group of the set of groups are filtered.
8. The appliance of claim 7 wherein the memory further contains instructions that, when executed by the processor cause the appliance to carry out the steps of:
receiving a list of services to enable;
receiving a list of devices to enable;
receiving a list of protocols to enable;
receiving a port range to enable;
generating an enable command including the services to enable, the devices to enable, the protocols to enable and the port range;
sending the enable command to the switch; and,
whereby a set of services identified in the list of services to enable, a set of devices identified in the list of devices to enable, a set of protocols identified in the list of protocols to enable and a set of ports in the port range to enable are activated.
9. The appliance of claim 7 wherein the memory further contains instructions that, when executed by the processor cause the appliance to carry out the steps of:
receiving an IPV4 address list from the user device;
receiving an IANA restricted address list from the user device;
generating a restriction command based on the IPV4 address list and the IANA restricted address list; and,
sending the restriction command to the switch, whereby an IPV4 address and an IANA restricted address are activated for use.
10. The appliance of claim 1 wherein the memory further contains instructions that when executed by the processor cause the appliance to carry out the steps of:
receiving a first encrypted hash signature of a current device password;
deriving a second encrypted hash signature of a forbidden password;
comparing the first encrypted hash signature to the second encrypted hash signature;
generating a command message based on the comparison; and,
sending the command message to the switch.
11. The appliance of claim 1 wherein the memory further contains instructions that when executed by the processor cause the appliance to carry out the steps of:
establishing an SNMP connection with the switch;
generating a command to filter a MAC address by a management information base;
sending the command to the switch;
whereby the switch compares an SNMP connection request to the management information base;
whereby the switch generates an SNMP trap message based on the comparison; and,
generating an alert based on the SNMP trap message.
12. The appliance of claim 1 wherein the memory further contains instructions that when executed by the processor cause the appliance to carry out the steps of:
receiving a first firmware list for a device of the set of endpoint devices;
comparing the first firmware list to a second firmware list;
generating a report based on the comparison;
generating a remedial command based on the comparison; and,
sending the remedial command to the switch.
13. A method of monitoring a set of endpoint devices, operatively connected to a switch, by an appliance operatively connected to the switch, the method comprising:
detecting a count of endpoint devices in the set of endpoint devices;
dynamically allocating, based on the count of endpoint devices, temporary memory for each mirroring and processing cycle to reduce switch processing burden; wherein each mirroring and processing cycle comprises:
receiving a set of mirrored data streams from the switch,
dividing the set of mirrored data streams into a set of groups, and
analyzing, in a time division multiple access (TDMA) format, each group of the set of groups individually for a predetermined condition; and,
generating an error message upon detection of the predetermined condition.
14. The method of claim 13 further comprising the steps of:
generating a remedial command based on the predetermined condition; and,
sending the remedial command to the switch.
15. The method of claim 13 further comprising the steps of:
identifying a first SSRC from a first datagram packet;
identifying a second SSRC from a second datagram packet;
comparing the first SSRC to the second SSRC;
incrementing a counter based on the comparison; and,
reporting an error if the counter exceeds a predetermined number.
16. The method of claim 13 further comprising the steps of:
identifying a video bit rate from the set of mirrored data streams;
determining whether or not the video bit rate is less than or equal to zero; and,
reporting an error if the video bit rate is less than or equal to zero.
17. The method of claim 13 further comprising the steps of:
identifying an audio bit rate from the set of mirrored data streams;
determining whether or not the audio bit rate is less than or equal to zero; and,
reporting an error if the audio bit rate is less than or equal to zero.
18. The method of claim 13 further comprising the steps of:
isolating a first data stream from the set of data streams using an SSRC;
analyzing the first data stream for a media parameter;
analyzing the first data stream for a quality parameter;
analyzing the first data stream for a rule violation; and,
sending an alert based on one of the group of the media parameter, the quality parameter and the rule violation.
19. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
receiving a list of chosen MAC address IDs from the user device;
receiving a list of chosen UDP/TCP ports from the user device;
generating a filter instruction based on the list of chosen MAC address IDs and the list of the chosen UDP/TCP ports;
sending the filter instruction to the switch;
whereby the mirrored data streams in a group of the set of groups are filtered.
20. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
receiving a list of services to enable;
receiving a list of devices to enable;
receiving a list of protocols to enable;
receiving a port range to enable;
generating an enable command including the services to enable, the devices to enable, the protocols to enable and the port range;
sending the enable command to the switch; and,
whereby a set of services identified in the list of services to enable, a set of devices identified in the list of devices to enable, a set of protocols identified in the list of protocols to enable and a set of ports in the port range to enable are activated.
21. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
receiving an IPV4 address list from the user device;
receiving an IANA restricted address list from the user device;
generating a restriction command based on the IPV4 address list and the IANA restricted address list; and,
sending the restriction command to the switch, whereby an IPV4 address and an IANA restricted address are activated for use.
22. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
receiving a current device password; receiving a forbidden password list and a set of rules;
comparing the current password to the forbidden password list and the set of rules;
generating a command message based on the comparison; and,
sending the command message to the switch.
23. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
establishing an SNMP connection with the switch;
generating a command to filter MAC address by a management information base;
sending the command to the switch;
whereby the switch compares an SNMP connection request to the management information base;
whereby the switch generates an SNMP trap message based on the comparison; and,
generating an alert based on the SNMP trap message.
24. The method of claim 13 wherein a user device is operatively connected to the appliance and further comprising the steps of:
receiving a first firmware list for a device of the set of endpoint devices;
comparing the first firmware list to a second firmware list;
generating a report based on the comparison;
generating a remedial command based on the comparison; and,
sending the remedial command to the switch.