Patent ID: 7895326

Claim:
In a computer network wherein packets are communicated between devices on to the computer network, a method for a network monitoring appliance to provide an alarm signal indicating unauthorized network usage by a device on the computer network, comprising the steps of: providing a configuration file for use by the network monitoring appliance that includes data reflecting prior assignment of a plurality of devices into a plurality of zones where devices assigned to a first zone are not authorized to communicate with devices assigned to a second zone, a zone comprising a plurality of devices that are selected without regard to which physical network the devices are associated with and without regard to whether the devices in a same zone are in a same physical network or in another physical network, a zone comprising a plurality of devices that are authorized to communicate: (i) with other devices in the same zone that are on the same physical network, and (ii) with other devices in the same zone that are on different physical networks isolated by a network device, but (iii) not with other devices in the same physical network that are in different zones; the configuration file further including unauthorized zone data specifying designated zones for which devices in a particular zone are not authorized to communicate with other devices in a different unauthorized zone; passively monitoring network communications of the computer network by monitoring packets communicated between devices that have been assigned to the plurality of zones with the network monitoring appliance; capturing packet header information from monitored network communications; in response to captured packet header information from a device on the computer network, accessing the configuration file to determine whether said device is authorized to communicate packets with another device in the computer network; determining the zones participating in the monitored network communications based on information in the configuration file; determining unauthorized network usage based upon the unauthorized zone data in the configuration file and captured packet header information indicating that a device in a first zone is attempting to communicate with a device in a second but unauthorized zone; and upon detection of unauthorized network usage, generating an alarm from the network monitoring appliance for use by external equipment.