Patent ID: 7793138

Claim:
A method of detecting anomalies in a storage area network (SAN) comprising at least a network device, a plurality of servers, and a plurality of storage devices accessible by the plurality of servers, the method comprising: at the network device, providing an anomaly type and corresponding action to be performed when the anomaly type is detected for traffic received by the network device of the SAN and such received traffic pertains to a particular server of the SAN requesting that data be read to a particular storage device of the SAN or written to the particular storage device of the SAN, wherein the particular server of the SAN is logged into the particular storage device of the SAN; at the network device, monitoring traffic that is received by the network device sent from the particular server to the particular storage device so as to detect the provided anomaly type in the monitored traffic; and when the provided anomaly type is detected, performing the corresponding action.