Abstract: A method, system, apparatus, and computer-readable medium to enable a set of security device interfaces within a broadcast domain to identify and mitigate attacks. For each address of a device communicating within the broadcast domain, a responsible interface is determined by a zero hop ownership determination algorithm. The algorithm operates by counting a respective number of replies observed by each of multiple interfaces. Each reply is made in response to a respective request for one address. A responsible interface is assigned to the one address using the respective number of replies observed by each respective interface. The algorithm approximates the security device interface physically closest to the address in question without querying the switches themselves and without requiring the security device interface to be in-line on the network.

Abstract: A method, system, apparatus, and computer-readable medium to determine whether a device having access to a network is wireless. A method for determining whether a device is wireless includes sending a specially-constructed packet to the device via a network. The packet is constructed so that the source address for the packet is a physical address on the network for the device. If the device does not send a response to the packet, a determination is made that the device is wireless. If the device sends a response to the packet, a determination is made that the device is wired. In one embodiment of the invention, the physical address for the device is a Media Access Control (MAC) address. The initial packet may, for example, request the physical address for the device and may be sent in response to detecting a communication to or from the suspect device.