Abstract: In a computer network of devices, at least some of the devices (i.e. the DCHP devices) have a static (e.g. MAC) address which does not change over time and a dynamic (e.g. IP) address which may change over time. There is disclosed a method and computer program for mapping the static address and dynamic address for the devices comprising polling said devices using said IP addresses and during said polling determining the MAC addresses of the devices, and providing a set of mapped static and dynamic addresses, said method including repeating the steps of the method at intervals. Using the method of the invention, it is possible, when entering a particular conversation in a database, to access the IP addresses, to determine which is the current DHCP device that address maps to, and assign the conversation to that device and store it in the database assigned to that device. Therefore, for each DHCP device, one can store a history of the conversations or traffic involved in that device.

Abstract: A computer program detects a potential attack on a computer network. A list E is made from network traffic data including source and destination addresses of traffic on the network. The list E includes all source addresses in the data which are not allocated to the network and are not in a list X. A first address in list E is chosen. A number of data entries including A and B and representing network traffic passing between source address A, chosen from list E, and destination address B, allocated to the network, is counted. If the number of such data entries is more than T, address A is output, thereby identifying address A as a potential source of attack. If it is determined that any entries in list E are left, the next address in list E is moved to, and the counting, outputting and determining is repeated, otherwise, stopping.