Patent ID: 7801980
Filing Date: 2010-09-21
Classification: H04L

Abstract:
1. A method for automatically and passively determining the characteristics of a network, comprising: passively reading, at a processor disposed between two endpoints, packets passively transmitted on the network from one of the two endpoints to the other; identifying a network device on the network indicated in the packets which were passively transmitted, the network device being identified from a context of the packet as a client and a client-specific fingerprint table being selected for comparison when plural protocol fields in the packet identify the network device as a client, the network device being identified from the context of the packet as a server and a server-specific fingerprint table being selected for comparison when the plural protocol fields in the packet identify the network device as a server; matching plural protocol field values in the packet to the selected client-specific or server-specific fingerprint table to identify an operating system specific to the network device as server or client; selecting an application-specific fingerprint table for comparison when the packet contains application protocol fields, and matching the application protocol fields to the selected application-specific fingerprint table to identify an operating system specific to the application of the network device; recording the matched operating system as the network device's operating system; and recording an identity of the network device, the plural protocol field values being matched when all of the protocol fields traversed in-order match a branch of the table as the table is walked, the plural protocol field values not being matched when a row of the table is traversed without a match, wherein the table is a tree or a linked list.