Systems and methods for determining characteristics of a network and enforcing policy
A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.
1. A method for passively and automatically enforcing a network configuration and usage policy on a network, comprising:
predefining the network configuration and usage policy for a service specific to network devices on the network;
passively determining, at a processor disposed between a source device and a destination device, in response to plural protocol fields in one packet transmitted on the network from the source device to the destination device, that one of the network devices on the network is running the service by reading, decoding, and analyzing one or more packets transmitted on the network, by comparing the plural protocol fields in the one packet to a service identifying structure to determine the service, wherein the packet is in traffic passively moving across the network;
performing an action at the processor, the action being identified by the network configuration and usage policy as being for the service specific to the one of the network devices that was passively determined from the packet, the action being different for different services; and
identifying two or more service events by reading, decoding, and analyzing two or more packets transmitted on the network for each of the two or more service events,
the protocol fields being network, transport, and application protocol fields,
wherein the network configuration and usage policy for the service comprises identifying if the two or more service events are of a same type and if a number of the two or more service events of the same type exceeds a threshold number of service events within a predefined time period.
2. A method for passively and automatically enforcing a network configuration and usage policy on a network, comprising:
predefining the network configuration and usage policy for a service specific to network devices on the network;
passively determining, at a processor disposed between a source device and a destination device, in response to plural protocol fields in one packet transmitted on the network from the source device to the destination device, that one of the network devices on the network is running the service by reading, decoding, and analyzing one or more packets transmitted on the network, by comparing the plural protocol fields in the one packet to a service identifying structure to determine the service, wherein the packet is in traffic passively moving across the network;
performing an action at the processor, the action being identified by the network configuration and usage policy as being for the service specific to the one of the network devices that was passively determined from the packet, the action being different for different services; and
identifying two or more service events by reading, decoding, and analyzing two or more packets transmitted on the network for each of the two or more service events,
the protocol fields being network, transport, and application protocol fields,
wherein the network configuration and usage policy for the service comprises determining if a number of the two or more service events is within a range of predefined numbers for the service.
3. A non-transitory computer-readable medium comprising instructions for execution by a processor, the instructions including a computer-implemented method for passively and automatically enforcing a network configuration and usage policy on a network, the instructions for implementing:
predefining the network configuration and usage policy for a service specific to network devices on the network;
passively determining, at a processor disposed between a source device and a destination device, in response to plural protocol fields in one packet transmitted on the network from the source device to the destination device, that one of the network devices on the network is running the service by reading, decoding, and analyzing one or more packets transmitted on the network, to determine the service being run by the network device, by comparing the plural protocol fields in the one packet to a service identifying structure to determine the service wherein the packet is in traffic passively moving across the network, the service identifying structure being previously stored at the processor and maintained at the processor;
performing an action at the processor, the action being identified by the network configuration and usage policy as being for the service specific to the one of the network devices that was passively determined from the packet, the action being different for different services,
the protocol fields being network, transport, and application protocol fields; and
identifying two or more service events by reading, decoding, and analyzing two or more packets transmitted on the network for each of the two or more service events,
wherein the network configuration and usage policy for the service comprises identifying if the two or more service events are of a same type and if a number of the two or more service events of the same type exceeds a threshold number of service events within a predefined time period.
4. A non-transitory computer-readable medium comprising instructions for execution by a processor, the instructions including a computer-implemented method for passively and automatically enforcing a network configuration and usage policy on a network, the instructions for implementing:
predefining the network configuration and usage policy for user/ice specific network devices on the network;
passively determining, at a processor disposed between a source device and a destination device, in response to plural protocol fields in one packet transmitted on the network from the source device to the destination device, that one of the network devices on the network is running the service by reading, decoding, and analyzing one or more packets transmitted on the network, to determine the service being run by the network device, by comparing the plural protocol fields in the one packet to a service identifying structure to determine the service, wherein the packet is in traffic passively moving across the network, the service identifying structure being previously stored at the processor and maintained at the processor;
performing an action at the processor, the action being identified by the network configuration and usage policy as being for the service specific to the one of the network devices that was passively determined from the packet, the action being different for different services,
the protocol fields being network, transport and application protocol fields; and
identifying two or more service events by reading, decoding, and analyzing two or more packets transmitted on the network for each of the two or more service events,
wherein the network configuration and usage policy for the service comprises determining if a number of the two or more service events is within a range of predefined numbers for the service.