Abstract: Techniques for inspecting encrypted network communications are presented. The techniques include: intercepting a binary file sent from a resource server to a host computer, where the binary file is configured to facilitate communications between the host computer and a remote server computer; identifying a trust anchor, where the trust anchor is configured to authenticate the remote server computer; replacing the trust anchor in the binary file with a replacement trust anchor, to produce an altered binary file; storing the trust anchor in association with the replacement trust anchor, an identifier of the binary file, and an identifier of the host computer; and passing the altered binary file to the host computer, where the host computer receives the altered binary file instead of the binary file, and where the replacement trust anchor is usable by the host computer to authenticate information in a communication sent by the remote server computer.

Abstract: Techniques for discovering a network using a sensor installed in the network, where the network is communicatively coupled to an external network by a router, are presented. The techniques can include: determining, automatically and by the sensor, a network address of the router; detecting, automatically and by the sensor, a network address of a client in the network; assessing, automatically and by the sensor, that the client in the network is actively communicating on the network; communicating, by the sensor, with the network address of the router; and participating, by the sensor, in communications on the network by emulating the network address of the client and by using the network address of the router.

Abstract: A computer-implemented method of identifying associated communications between a first network with a first addressing scheme and a second network with a second addressing scheme is presented. The technique can include: detecting a first protocol data unit addressed from a first device in the first network and addressed to a destination in the second network, prior to translation by a network address translator; inserting, prior to translation from the first addressing scheme to the second addressing scheme, a breadcrumb protocol data unit that is addressed to the second network, the breadcrumb protocol data unit including, in a location immune from address translation by the network address translator, the source address of the first protocol data unit; receiving a translated breadcrumb protocol data unit; and reporting an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.

Abstract: Techniques for discovering a network using a sensor installed in the network, where the network is communicatively coupled to an external network by a router, are presented. The techniques can include: determining, automatically and by the sensor, a network address of the router; detecting, automatically and by the sensor, a network address of a client in the network; assessing, automatically and by the sensor, that the client in the network is actively communicating on the network; communicating, by the sensor, with the network address of the router; and participating, by the sensor, in communications on the network by emulating the network address of the client and by using the network address of the router.

Abstract: A computer-implemented method of identifying associated communications between a first network with a first addressing scheme and a second network with a second addressing scheme is presented. The technique can include: detecting a first protocol data unit addressed from a first device in the first network and addressed to a destination in the second network, prior to translation by a network address translator; inserting, prior to translation from the first addressing scheme to the second addressing scheme, a breadcrumb protocol data unit that is addressed to the second network, the breadcrumb protocol data unit including, in a location immune from address translation by the network address translator, the source address of the first protocol data unit; receiving a translated breadcrumb protocol data unit; and reporting an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.