Abstract: In a network of managed devices, a method of processing network events to reduce the number of events to be displayed in an event log, comprising receiving information relating to network events, passing information regarding a network event to an event processor, determining if the information passed to the event processor relates to a type of event processed by that event processor, and if it is of such a type, processing said information if information on a related event has already been received by that event processor. The method also includes passing said information on to a further event processor if the information received does not relate to a type of event processed by said first event processor. A set of event processors for carrying out the method is described together with a computer program, or a program on a computer readable medium loadable into a digital computer, or embodied in a carrier wave, which computer program operates in accordance with the method.

Abstract: A method and apparatus for identifying a device acting as a server on a network is disclosed which uses network data representing communications on the network. The network data contains source device, destination device, data transfer protocol and data volume information for each communication represented therein and may be collected by network traffic monitors or packet capture devices such as RMON2 probes on the network. Data relating to relevant server protocols is identified within the network data, and using the identified data, a device is determined to be acting as a server if it has the highest data volume for communications in which it is the source or destination device and which communications involve at least a threshold number of other devices. The method may be conveniently implemented in a computer program and may be used in conjunction with a network management application.

Abstract: A computer program detects a potential attack on a computer network. A list E is made from network traffic data including source and destination addresses of traffic on the network. The list E includes all source addresses in the data which are not allocated to the network and are not in a list X. A first address in list E is chosen. A number of data entries including A and B and representing network traffic passing between source address A, chosen from list E, and destination address B, allocated to the network, is counted. If the number of such data entries is more than T, address A is output, thereby identifying address A as a potential source of attack. If it is determined that any entries in list E are left, the next address in list E is moved to, and the counting, outputting and determining is repeated, otherwise, stopping.