Patent ID: 7761918

Claim:
A method for passively scanning a network, comprising: distributing a passive scanner configured to observe network traffic on the network, wherein the network traffic includes one or more network sessions between at least one client network device and at least one server network device on the network; dropping, by the passive scanner, one or more of the network sessions in response to resources associated with the passive scanner being taxed; sniffing, by the passive scanner, a plurality of packets traveling across the network, wherein: in response to determining that the resources associated with the passive scanner are not being taxed, the plurality of sniffed packets are associated with the one or more network sessions between the at least one client network device and the at least one server network device, and in response to determining that the resources associated with the passive scanner are being taxed, the plurality of sniffed packets are associated with one or more subsequent network sessions that are substantially similar to the dropped network sessions in response to the resources associated with the passive scanner no longer being taxed; reconstructing, by the passive scanner, the one or more network sessions or the one or more subsequent network sessions from information in the plurality of sniffed packets; building a topology of the network from the reconstructed network sessions, wherein the topology of the network includes the at least one client network device, the at least one server network device, at least one service running on the at least one client network device, and at least one service running on the at least one server network device; analyzing, by the passive scanner, the information in the plurality of sniffed packets to determine a version of the service running on the at least one client network device and a version of the service running on the at least one server network device; identifying, by the passive scanner, one or more vulnerabilities associated with the version of the service running on the at least one client network device or one or more vulnerabilities associated with the version of the service running on the at least one server network device; and preparing, by the passive scanner, a report containing the identified vulnerabilities and the topology of the network.