Patent ID: 7895326
Filing Date: 2011-02-22
Classification: G06F,H04L

Abstract:
1. In a computer network wherein packets are communicated between devices on to the computer network, a method for a network monitoring appliance to provide an alarm signal indicating unauthorized network usage by a device on the computer network, comprising the steps of: providing a configuration file for use by the network monitoring appliance that includes data reflecting prior assignment of a plurality of devices into a plurality of zones where devices assigned to a first zone are not authorized to communicate with devices assigned to a second zone, a zone comprising a plurality of devices that are selected without regard to which physical network the devices are associated with and without regard to whether the devices in a same zone are in a same physical network or in another physical network, a zone comprising a plurality of devices that are authorized to communicate: the configuration file further including unauthorized zone data specifying designated zones for which devices in a particular zone are not authorized to communicate with other devices in a different unauthorized zone; passively monitoring network communications of the computer network by monitoring packets communicated between devices that have been assigned to the plurality of zones with the network monitoring appliance; capturing packet header information from monitored network communications; in response to captured packet header information from a device on the computer network, accessing the configuration file to determine whether said device is authorized to communicate packets with another device in the computer network; determining the zones participating in the monitored network communications based on information in the configuration file; determining unauthorized network usage based upon the unauthorized zone data in the configuration file and captured packet header information indicating that a device in a first zone is attempting to communicate with a device in a second but unauthorized zone; and upon detection of unauthorized network usage, generating an alarm from the network monitoring appliance for use by external equipment.