Plug-and-play network filter
A method of configuring an appliance to be a plug-and-play network filter includes the steps of configuring an appliance to alter the flow of network traffic when the appliance is connected to a network. The appliance is configured to change the address resolution protocol ARP so that it assumes the role of a router by issuing an ARP packet. The appliance is configured to establish itself between the router and end user terminals. The appliance is configured to respond to any ARP Request on the Gateway IP address. The appliance is configured to monitor Internet traffic, and filter certain predefined types of Internet traffic. The appliance is configured to transparently proxy web packets on TCP with destination port 80.
1. A method of filtering outbound Internet traffic for end user terminals that utilize a router to connect to a network, the method comprising:
physically connecting an appliance to the router in a wired or wireless manner;
assuming, with the appliance, the role of the router to an end user terminal on the network;
responsive to physically connecting the appliance to the router, altering a flow of network traffic by issuing from the appliance a first gratuitous ARP packet, wherein the first gratuitous ARP packet includes an IP address of the router as the source IP address and includes a MAC address of the appliance as the source MAC address;
monitoring outbound Internet traffic on the network with the appliance, wherein the outbound Internet traffic is traffic to remote servers from the end user terminal;
filtering, with the appliance, certain predefined types of the outbound Internet traffic on the network; and
sending, with the appliance, subsequent gratuitous ARP packets, wherein each subsequent gratuitous ARP packet includes the IP address of the router as the source IP address and includes the MAC address of the appliance as the source MAC address.
2. The method of claim 1 , further comprising receiving, with the appliance instead of the router, the outbound Internet traffic from the end user terminal on the network.
3. The method of claim 1 , wherein the sending includes sending the subsequent gratuitous ARP packets on a regular interval.
4. The method of claim 1 , wherein the router is a network gateway, the method further comprising responding, with the appliance, to an ARP request on the network gateway IP address.
5. The method of claim 1 , wherein the sending includes sending the subsequent gratuitous ARP packets more frequently than once every minute.
6. The method of claim 1 , further comprising responding, with the appliance, to an ARP Request on an IP address of the router by issuing a gratuitous ARP packet from the appliance to direct the end user terminal to route the outbound Internet traffic through the appliance instead of the router.
7. The method of claim 1 , wherein the filtering includes proxying web packets.
8. The method of claim 1 , wherein the filtering includes logging TCP activities.
9. The method of claim 1 , wherein the filtering includes logging IP addresses and port numbers of the remote servers.
10. The method of claim 1 , wherein the filtering includes enforcing at least one of a domain blacklist, a URL blacklist, a domain whitelist, and a URL whitelist.
11. The method of claim 1 , wherein the first gratuitous ARP packet is an ARP-RESPONSE packet or an ARP-REQUEST packet.
12. The method of claim 1 , wherein the filtering includes proxying IM packets.
13. The method of claim 1 , wherein the filtering includes proxying DNS queries.
14. An appliance for filtering outbound Internet traffic of end user terminals that utilize a router to connect to a network, the appliance programmed to:
physically connect the appliance to the router in a wired or wireless manner;
assume, with the appliance, the role of the router to an end user terminal on the network;
alter, responsive to physically connecting the appliance to the router, a flow of network traffic by issuing from the appliance a first gratuitous ARP packet, wherein the first gratuitous ARP packet includes an IP address of the router as the source IP address and includes a MAC address of the appliance as the source MAC address;
monitor outbound Internet traffic on the network with the appliance, wherein the outbound Internet traffic is traffic to remote servers from the end user terminal;
filter, with the appliance, certain predefined types of the outbound Internet traffic on the network; and
send, with the appliance, subsequent gratuitous ARP packets, wherein each subsequent gratuitous ARP packet includes the IP address of the router as the source IP address and includes the MAC address of the appliance as the source MAC address.