Detection and mitigation of rapidly propagating threats from P2P, IRC and gaming
A network switch detects at least two simultaneous connections on a single network port. The simultaneous connections use different protocols despite using the same port. The network switch mirrors network traffic associated with the simultaneous connections to a security management device on the network. The security management device then determines a source or destination of the network traffic.
1. A method in a network switch operating within a network, the method comprising:
identifying, within traffic flowing through the network switch, potentially harmful traffic constituting a threat to operation of the network by detecting at least two simultaneous connections on a service port of the network switch, wherein a first protocol is used for a first connection on the service port and a second protocol is used for a second connection on the service port, herein the first protocol is different than the second protocol;
mirroring the potentially harmful traffic associated with the service port to a separately located security management device via the network, wherein it is not necessary for the traffic flowing thorough the network switch to pass through the security management device to reach a destination as only copies of the potentially harmful traffic are passed to the security management device;
redirecting the potentially harmful traffic to the separately located security management device via the network responsive to a threat mitigation policy from the separately located security management device; and
reducing network bandwidth consumed by the potentially harmful traffic associated with the service port responsive to receiving the threat mitigation policy from the separately located security management device by blocking the potentially harmful traffic associated with the service port according to the threat mitigation policy.
2. The method of claim 1 , wherein the first and second protocols are transport layer protocols.
3. The method of claim 1 , wherein the first protocol is Transmission Control Protocol (TCP) and the second protocol is User Datagram Protocol (UDP).
4. The method of claim 1 , wherein mirroring the potentially harmful traffic associated with the service port to the separately located security management device on the network comprises doing so in accordance with a security policy.
5. The method of claim 1 , further comprising reducing network bandwidth consumed by applications on known connection ports for the applications, the applications selected from the group consisting of Peer-to-Peer (P2P) applications, Internet Relay Chat (IRC) applications and gaming applications.
6. The method of claim 1 , further comprising reducing network bandwidth consumed by applications on known connection ports for the applications, the applications selected from the group consisting of Peer-to-Peer (P2P) applications, Internet Relay Chat (IRC) applications and gaming applications.
7. The method of claim 1 , wherein the separately located security management device operates virtually in-line with the network switch without requiring the traffic flowing through IP based network switch which is not identified as the potentially harmful traffic to travel through the separately located security management device.
8. The method of claim 1 :
wherein mirroring the potentially harmful traffic associated with the service port to the separately located security management device via the network comprises the network switch mirroring the potentially harmful traffic to a port of the security management device dedicated to receiving mirrored threat traffic; and
further wherein the traffic flowing through the network switch which does not violate the threat mitigation policy is handled by the network switch.
9. A system, comprising:
an Internet Protocol (IP) based network switch to identify, within traffic flowing through the network switch, potentially harmful traffic constituting a threat to efficient operation of the network via detection of at least two simultaneous connections on a service port of the network switch, wherein a first protocol is used for a first connection on the service port and a second protocol is used for a second connection on the service port, wherein the first protocol is different than the second protocol;
a security management device separately located from the network switch and communicatively interfaced with the network switch via the network,
wherein the security management device is to receive a mirrored copy of the potentially harmful traffic from the network switch via the network, the potentially harmful traffic associated with the at least two simultaneous connections detected on the service port of the network switch, wherein it is not necessary for the traffic flowing thorough the network switch to pass through the security management device to reach a destination as only copies of the potentially harmful traffic are passed to the security management device, and
wherein the security management device is further to send a threat mitigation policy to the network switch instructing the network switch to redirect the potentially harmful traffic to the separately located security management device via the network; and
wherein the IP based network switch is further to reduce network bandwidth consumed by the potentially harmful traffic associated with the service port responsive to receiving the threat mitigation policy from the separately located security management device by blocking the potentially harmful traffic associated with the service port according to the threat mitigation policy.
10. The system of claim 9 , wherein the first and second protocols are transport layer protocols.
11. The method of claim 9 , wherein the first protocol is Transmission Control Protocol (TCP) and the second protocol is User Datagram Protocol (UDP).
12. The system of claim 9 , where the separately located security management device operates virtually in-line with the network switch without requiring the traffic flowing through IP based network switch which is not identified as the potentially harmful traffic to travel through the separately located security management device.
13. The system of claim 9 :
wherein the security management device separately to receive the mirrored copy of the potentially harmful traffic from the IP based network switch via the network comprises the security management device to receive the mirrored copy of the potentially harmful traffic at a port of the security management device dedicated to receive mirrored threat traffic; and
further wherein the traffic flowing through the network switch which does not violate the threat mitigation policy is handled by the IP based network switch.
14. A network switch to operate within an Internet Protocol (IP) based network, the network switch comprising:
means for identifying, within traffic flowing through the network switch, potentially harmful traffic constituting a threat to efficient operation of the network by detecting at least two simultaneous connections on a service port of the network switch, wherein a first protocol is used for a first connection on the service port and a second protocol is used for a second connection on the service port, wherein the first protocol is different than the second protocol;
means for mirroring the potentially harmful traffic associated with the service port to a separately located security management device via the network, wherein it is not necessary for the traffic flowing thorough the network switch to pass through the security management device to reach a destination as only copies of the potentially harmful traffic are passed to the security management device;
means for redirecting the potentially harmful traffic to the separately located security management device via the network responsive to a threat mitigation policy from the separately located security management device; and
means for reducing network bandwidth consumed by the potentially harmful traffic associated with the service port responsive to receiving the threat mitigation policy from the separately located security management device by blocking the potentially harmful traffic associated with the service port according to the threat mitigation policy.
15. The network switch of claim 14 , wherein the means for mirroring the potentially harmful traffic associated with the service port to the separately located security management device comprises doing so in accordance with a security policy.
16. The network switch of claim 14 , wherein the separately located security management device operates virtually in-line with the network switch without requiring the traffic flowing through IP based network switch which is not identified as the potentially harmful traffic to travel through the separately located security management device.
17. The network switch of claim 14 :
wherein the means for mirroring the potentially harmful traffic associated with the service port to the separately located security management device via the network comprises means for mirroring the potentially harmful traffic to a port of the separately located security management device dedicated to receiving mirrored threat traffic; and
further wherein the traffic flowing through the network switch which does not violate the threat mitigation policy is handled by the network switch.