Patent ID: 7567560

Claim:
A method for securing a communication network comprising: detecting a communication session established between a local media endpoint located in the communication network and a remote media endpoint; assigning a session identifier to the communication session; monitoring packets communicated to the communication network; during a predetermined time period, only passing packets that identify the session identifier, a network address of the local media endpoint, a port of the local media endpoint, a network address of the remote media endpoint, and any port of the remote media endpoint; and after the predetermined time period, only passing packets that identify the session identifier, the network address of the local media endpoint, the port of the local media endpoint, the network address of the remote media endpoint, and a specific one of the ports of the remote media endpoint identified in packets passed during the predetermined time period; building a topology map for the communication session using topology information included in packets communicated between the local media endpoint and the remote media endpoint, the topology map identifying network addresses and ports of network nodes through which packets travel, the network nodes including proxy servers and gateways; and only passing packets that include topology information that identifies a network address and a port of at least one of the network nodes in the topology map.