Layer 2 Host Tracking via ARP Probing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Layer 2 network access devices face challenges in tracking end host machines effectively, as they lack the ability to monitor all types of hosts due to limitations in data traffic switching and require IP connectivity, which is not always available, and installing client software on various devices is impractical, especially in large networks with diverse host types.
Innovation Solution
The method involves using Address Resolution Protocol (ARP) requests and replies to learn and validate media access control (MAC) addresses of hosts, allowing network access devices to maintain a tracking list and enforce admission control privileges at layer 2 without requiring IP routing capabilities, by sending ARP requests with missing information and validating responses against stored MAC addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If switches constantly monitor switched data traffic from connected hosts, then host tracking capability is improved, but the control plane processor cannot access hardware-switched traffic making this approach infeasible
Solution Approach 1:
The patent introduces ARP requests as an intermediary mechanism to enable host tracking. Instead of directly monitoring hardware-switched traffic which is inaccessible to the control plane, the system uses ARP requests sent to hosts and their replies as a mediator to obtain host presence information, thereby resolving the access complexity issue while maintaining tracking capability
Solution Approach 2:
The patent implements self-service by having hosts automatically respond to ARP requests with their MAC addresses. This eliminates the need for complex monitoring infrastructure, as hosts themselves provide the tracking information through their normal ARP protocol operations, simplifying the overall system complexity
2Reliability
If end hosts periodically send keep alive messages using layer 4 to layer 7 software applications, then host liveliness tracking is improved, but IP connectivity is required which is not always available on pure layer 2 NADs
Solution Approach 1:
Instead of having hosts initiate keep-alive messages using higher-layer protocols (layer 4-7), the patent inverts the approach by having the NAD send ARP requests to hosts and rely on hosts to respond. This layer 2 approach eliminates the requirement for IP connectivity while maintaining reliable host liveliness tracking
Solution Approach 2:
The patent changes the protocol layer parameter from layer 4-7 applications to layer 2 ARP protocol. This parameter change enables the system to operate on pure layer 2 NADs without requiring IP connectivity, while still achieving host tracking through ARP request-reply exchanges
3Measurement precision
If client specific application software is installed on all end hosts for host tracking, then tracking accuracy is improved, but installation and configuration becomes impractical in large scale networks with diverse host types
Solution Approach 1:
The patent applies universality by using the ARP protocol, which is a standard network protocol universally supported by all IP hosts regardless of type or operating system. This eliminates the need for host-specific application software, making deployment feasible in large-scale networks with diverse devices such as PCs, IP phones, and printers
Solution Approach 2:
Instead of installing custom application software on each host, the patent uses the existing ARP protocol copying mechanism. The NAD copies the host's MAC address information from their ARP replies, achieving tracking accuracy without requiring any additional software installation or configuration on end hosts
4Duration of action of stationary object
If conventional supplicant application software uses large reassessment timeout values, then re-authentication is achieved, but host tracking becomes rendered useless for tracking host liveliness
Solution Approach 1:
The patent implements periodic action by sending ARP requests at regular, frequent intervals to track host liveliness. This periodic ARP probing mechanism provides continuous host presence detection with appropriate timing, unlike the large timeout values in conventional supplicant software, thereby ensuring reliable host liveliness tracking
Solution Approach 2:
The patent uses feedback by monitoring whether hosts respond to periodic ARP requests. When a host fails to respond within expected timeframes, the system receives feedback indicating the host is no longer lively or connected, enabling timely revocation of access privileges and maintaining reliable host liveliness tracking
Data Source
AI summary
A method and an apparatus to detect end host machines in a layer 2 Ethernet network are provided. The knowledge of the detected hosts may then be utilized by various security applications operating on layer 2 devices at the access and the distribution layers of the network for host session monitoring. Hosts that are no longer connected or do not respond to a layer 2 query may have their access privileges revoked.