Patent ID: 7644151

Claim:
In a computer network wherein packets are communicated between devices, a method for a network device to determine and block unauthorized network usage, comprising the steps within the network device of: reading the network device a configuration file that includes data selectively assigning a plurality of devices into a plurality of zones where devices in a first zone are not authorized to communicate with devices in a second zone, a zone comprising a plurality of devices that are authorized to communicate: (i) with other devices in the same zone that are on the same physical network, and (ii) with other devices in the same zone that are on different physical networks isolated by a network device, but (iii) not with other devices in the same physical network that are in different zones; receiving unauthorized zone data from the configuration file specifying designated zones for which devices in a particular zone are not authorized to communicate with other devices in a different unauthorized zone; passively monitoring network communications of the computer network by monitoring packets communicated between devices that have been assigned to the plurality of zones; capturing packet header information from monitored network communications; determining which devices are participating in the monitored network communications based on captured packet header information; determining the zones participating in the monitored zone communications based upon the unauthorized zone data; determining unauthorized network usage based upon the unauthorized zone data and captured packet header information indicating that a device in a first zone is attempting to communicate with a device in a second but unauthorized zone; and generating an alarm upon detection of unauthorized network usage, wherein the step of generating an alarm includes providing an address to a filtering table to block the unauthorized network usage.