Patent ID: 8615785
Filing Date: 2013-12-24
Classification: H04L

Abstract:
1. A method operating within a security management device, wherein the method comprises: receiving mirrored traffic at the security management device from a network switch communicably interfaced with the security management device, the mirrored traffic comprising a copy of incoming traffic received at the network switch from a threat source; analyzing the mirrored traffic for a threat to the network switch; redirecting the incoming traffic to the security management device in place of the network switch by causing the incoming traffic initially received at the network switch to be sent from the threat source to the security management device instead of the network switch without passing through the network switch by using a reformulated ARP table of the threat source and based further on one or more of Access Control Lists (ACLs), policy-based routing, Virtual Local Area Network Identifications (VLAN IDs), HyperText Transfer Protocol (HTTP) information, or Extensible Markup Language (XML) tags; and sending a mitigation policy to the network switch based at least in part on the analyzing.