Misconfigured mirror port detection

Patent metadata

Field	Value
Publication number	US-2024179043-A1
Application number	US-202218071132-A
Country	US
Kind code	A1
Filing date	Nov 29, 2022
Priority date	Nov 29, 2022
Publication date	May 30, 2024
Grant date	—

Abstract

A method includes monitoring a plurality of packets received by a network sensor associated with a port of a network, determining a ratio of unicast, multicast or broadcast packets to a total number of packets for the plurality of packets, determining that the ratio is outside the bounds of a threshold range, detecting that a port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range, and automatically notifying a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of a threshold range. Further disclosed is a computer system and computer program product configured to perform the method.

First claim

1 . A method for detecting a misconfigured port in a packet forwarding configuration comprising:
monitoring, by one or more processors of a computer system, a plurality of packets received by a network sensor associated with a port of a network; determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received; determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range; detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range; and automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of the threshold range.

2 . The method of claim 1 , wherein the determining the ratio of unicast, multicast or broadcast packets to a total number of packets for the plurality of packets comprises determining the ratio of unicast packets to a total number of packets, and wherein the determining that the ratio is outside the bounds of the threshold range includes determining that the ratio is less than a threshold.

3 . The method of claim 2 , wherein the threshold is less than one percent.

4 . The method of claim 1 , further comprising:
triggering, by the one or more processors of the computer system, an automated response after the detection that the port is misconfigured.

5 . The method of claim 4 , wherein the automated response includes:
inspecting, by the one or more processors of the computer system, a unicast packet received by the port; determining, by the one or more processors of the computer system, a switch port number associated with the unicast packet; and using, by the one or more processors of the computer system, one or more application programming interfaces to change a configuration associated with the port of the network.

6 . The method of claim 1 , further comprising:
providing, by the one or more processors of the computer system, a sensitivity option for the threshold range to a user; and receiving, by the one or more processors of the computer system, a sensitivity from the user after the sensitivity option is provided.

7 . The method of claim 1 , wherein the automatically notifying includes providing a warning to a user interface of an application associated with the network sensor.

8 . The method of claim 1 , wherein the port of the network is a virtual port on a virtual switch.

9 . The method of claim 1 , wherein the port of the network is a physical port on a physical switch.

10 . A computer system, comprising:
one or more processors; one or more computer readable storage media; and computer readable code stored collectively in the one or more computer readable storage media, with the computer readable code including data and instructions to cause the one or more computer processors to perform a method for detecting a misconfigured port in a packet forwarding configuration comprising:
monitoring, by the one or more processors of the computer system, a plurality of packets received by a network sensor associated with a port of a network;
determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received;
determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range;
detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range; and
automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination that the ratio is outside the bounds of the threshold range.

11 . The computer system of claim 10 , wherein the determining the ratio of unicast, multicast or broadcast packets to a total number of packets for the plurality of packets comprises determining the ratio of unicast packets to a total number of packets, and wherein the determining that the ratio is outside the bounds of the threshold range includes determining that the ratio is less than a threshold.

12 . The computer system of claim 11 , wherein the threshold is less than one percent.

13 . The computer system of claim 10 , the method further comprising:
triggering, by the one or more processors of the computer system, an automated response after the detection that the port is misconfigured.

14 . The computer system of claim 13 , wherein the automated response of the method further includes:
inspecting, by the one or more processors of the computer system, a unicast packet received by the port; determining, by the one or more processors of the computer system, a switch port number associated with the unicast packet; and using, by the one or more processors of the computer system, one or more application programming interfaces to change a configuration associated with the port of the network.

15 . The computer system of claim 10 , wherein the method further comprises:
providing, by the one or more processors of the computer system, a sensitivity option for the threshold range to a user; and receiving, by the one or more processors of the computer system, a sensitivity from the user after the sensitivity option is provided.

16 . The computer system of claim 10 , wherein the automatically notifying includes providing a warning to a user interface of an application associated with the network sensor.

17 . The computer system of claim 10 , wherein the port of the network is a virtual port on a virtual switch.

18 . The computer system of claim 10 , wherein the port of the network is a physical port on a physical switch.

19 . A computer program product comprising:
one or more non-transitory computer readable storage media having computer readable program instructions collectively stored on the one or more computer readable storage media, the computer readable program instructions being executed by one or more processors of a computer system to cause the computer system to perform a method for detecting a misconfigured port in a packet forwarding configuration comprising:
monitoring, by the one or more processors of the computer system, a plurality of packets received by a network sensor associated with a port of a network;
determining, by the one or more processors of the computer system, a ratio of unicast, multicast or broadcast packets from the plurality of packets received to the total number of all of the plurality of packets received;
determining, by the one or more processors of the computer system, that the ratio is outside the bounds of a threshold range;
detecting, by the one or more processors of the computer system, that a port is misconfigured for the packet forwarding configuration based on the determination that the ratio is outside the bounds of the threshold range; and
automatically notifying, by the one or more processors of the computer system, a network administrator that the port is misconfigured based on the determination t

Assignees

• Sophos Ltd

Inventors

• Terry Neil Richard

Classifications

• H04L49/208

  Port mirroring · CPC title

• H04L43/16 Primary

  Threshold monitoring · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L43/062

  related to network traffic · CPC title