Patent ID: 6954785
Filing Date: 2005-10-11
Classification: H04L

Abstract:
1. A method for identifying a device acting as a server on a network, the method comprising: receiving data representing communications on the network, the data containing source device, destination device, data transfer protocol and data volume information for communications represented therein; identifying, from the received data, data relating to one or more relevant server protocols; using the identified data, determining as a server device, the device which has the highest data volume for communications in which it is the source or destination device and in which at least a threshold number of other devices are involved; after the step of identifying data relating to relevant server protocols, identifying the devices involved in the communications represented in the identified data using the source device and destination device information, and for each identified device, determining the total volume of data transferred during communications represented in the identified data involving the device using the volume information; after the step of determining the total volume of data transferred for each device, identifying the device with the highest total volume; after the step of identifying the device with the highest total volume, determining the number of other devices involved in communications, represented in the identified data, with the identified device; after the step of determining the number of other devices, comparing the determined number against a predetermined threshold number, and if the determined number exceeds the predetermined threshold number, determining that the identified device with the highest total volume is a server device.