Network Interface Controller Promiscuous Packet Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security monitoring systems often fail to detect and log network intrusions effectively, leading to undetected breaches and difficulties in identifying affected system components, as they may lose important information due to bandwidth reduction and lack of detailed network traffic examination.
Innovation Solution
A method and system for logging communication packets using a network interface controller in real promiscuous mode, capturing packets in transitory memory, and writing them to non-transitory memory without filtering, allowing for complete and accurate recording of network traffic, including inbound and outbound packets, to facilitate thorough intrusion analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If filtering and processing are performed on captured network traffic data, then bandwidth consumption is reduced, but important information may be lost
Solution Approach 1:
The system segments network traffic capture into two independent paths: a first network interface captures and stores all traffic in promiscuous mode without filtering, while a second network interface applies filtering and processing. This segmentation allows the system to reduce bandwidth consumption through filtering while preserving complete information in the first path, resolving the contradiction between information loss and energy efficiency.
2Ease of operation
If a network monitoring system is made accessible locally, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system applies local quality by making the network monitoring system accessible locally at specific perimeter locations rather than providing universal access. Each perimeter location has controlled access rights, allowing operators to examine traffic at their designated points while maintaining security through location-specific access restrictions. This resolves the contradiction by providing ease of operation where needed while maintaining security through localized control.
3Measurement precision
If promiscuous mode is enabled for packet capture, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The system segments the packet capture function across multiple network interface controllers, with only the first NIC operating in promiscuous mode to capture complete traffic. The second NIC handles filtered traffic with standard capture settings. This segmentation allows high measurement precision where required while reducing device complexity in other parts of the system, as the second NIC does not need promiscuous mode capabilities.
Data Source
Figure 1a~1b
Figure 2
Figure 3
AI summary
The invention relates to a method, system and computer program product for logging communication packets from a communication signal in a communication network. The communication network comprises one or more perimeters. A split signal is formed of said communication signal, the communication signal comprising information, and the split signal being identical in information content to the communication signal. The communication packets of the split signal are captured using a network interface controller into a transitory memory. The network interface controller operates in real promiscuous mode. A virtual network interface controller may be operated from an isolated user space container, the isolated user space container having access to said transitory memory as an isolated memory range. The communication packets may be captured into the isolated memory range and the data of the communication packets may be written from the isolated memory range to the non-transitory memory.