Patent ID: 8369346

Claim:
A method of restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes, each of the first node and the one or more other nodes having a respective translation table that maps an IP address to a respective physical address of all nodes, with which the first node and the one or more other nodes communicated, wherein the method is provided through a computerized apparatus operatively coupled to the IP network, the method comprising: obtaining communicated data, said communicated data comprising address resolution messages; accessing a virtual address resolution table, which is representative of an address resolution activity in the IP network; responsive to said communicated data, indicating that the first node is communicating with other nodes, restricting said first node from communicating by generating and conveying a restricting address resolution message by using information stored in said virtual address resolution table, said restricting address resolution message comprising a substitute physical address; and updating information stored in the virtual address resolution table so as to represent changes to the information stored in the translation tables respective of the first node and the one or more other nodes, wherein updating information stored in the virtual address resolution table comprises updating respective of an operating system running on each corresponding node over the IP network.