Abstract: A method and apparatus for identifying a device acting as a server on a network is disclosed which uses network data representing communications on the network. The network data contains source device, destination device, data transfer protocol and data volume information for each communication represented therein and may be collected by network traffic monitors or packet capture devices such as RMON2 probes on the network. Data relating to relevant server protocols is identified within the network data, and using the identified data, a device is determined to be acting as a server if it has the highest data volume for communications in which it is the source or destination device and which communications involve at least a threshold number of other devices. The method may be conveniently implemented in a computer program and may be used in conjunction with a network management application.

Abstract: In a computer network of devices, at least some of the devices (i.e. the DCHP devices) have a static (e.g. MAC) address which does not change over time and a dynamic (e.g. IP) address which may change over time. There is disclosed a method and computer program for mapping the static address and dynamic address for the devices comprising polling said devices using said IP addresses and during said polling determining the MAC addresses of the devices, and providing a set of mapped static and dynamic addresses, said method including repeating the steps of the method at intervals. Using the method of the invention, it is possible, when entering a particular conversation in a database, to access the IP addresses, to determine which is the current DHCP device that address maps to, and assign the conversation to that device and store it in the database assigned to that device. Therefore, for each DHCP device, one can store a history of the conversations or traffic involved in that device.

Abstract: A computer program detects a potential attack on a computer network. A list E is made from network traffic data including source and destination addresses of traffic on the network. The list E includes all source addresses in the data which are not allocated to the network and are not in a list X. A first address in list E is chosen. A number of data entries including A and B and representing network traffic passing between source address A, chosen from list E, and destination address B, allocated to the network, is counted. If the number of such data entries is more than T, address A is output, thereby identifying address A as a potential source of attack. If it is determined that any entries in list E are left, the next address in list E is moved to, and the counting, outputting and determining is repeated, otherwise, stopping.