Abstract: One embodiment in accordance with the invention is a method that includes detecting a failure in a ring network and transmitting a multicast message across the ring network that includes information regarding the failure. Additionally, a new ring master of the ring network is designated. Furthermore, a ring port coupled to the failure is blocked.

Abstract: Methods and apparatus are disclosed for locating and disabling the switch port of a rogue wireless access point. In one embodiment, a network management device is configured to detect the presence of a rogue access point on a managed wireless network. Once detected, the management device may then instruct a special client, such as a scanning AP, to associate with the rogue access point and send a discovery packet through the rogue access point to network management device. The network management device upon receiving the discovery packet may thereby determine that the rogue access point is connected to a network managed by said network device. The network device may then utilize information contained in the discovery packet to locate the switch port to which the rogue access point is connected, and ultimately disable the switch port to which the rogue access point is connected.

Abstract: This invention provides for an apparatus and method to isolate ports on layer 2 switches on the same VLAN to restrict traffic flow. The apparatus comprises a switch having said plurality of ports, each port configured as a protected port or a non-protected port. An address table memory stores an address table having a destination address and port number pair. A forwarding map generator generates a forwarding map which is responsive to a destination address of a data packet. The method for isolating ports on a layer 2 switch comprises configuring each of the ports on the layer 2 switch as a protected port or a non-protected port. A destination address on an data packet is matched with a physical address on said layer 2 switch and a forwarding map is generated for the data packet based upon the destination address on the data packet.

Abstract: A method and apparatus for providing security to factory automation devices in a switched Ethernet network. Traffic between factory automation devices and an Ethernet switch is limited to packets including approved TCP/UDP port numbers and to selected data rates.

Abstract: A detection-based defense to a wireless network. Elements of the infrastructure, e.g., access points or scanning-only access points, detect intruders by detecting spoofed frames, such as from rogue access points. Access points include a signature, such as a message integrity check, with their management frames in a manner that enables neighboring access points to be able to validate the management frames, and to detect spoofed frames. When a neighboring access point receives a management frame, obtains a key for the access point sending the frame, and validates the management frame using the key.

Abstract: An internetwork including a plurality of local area networks may include wireless and hard-wired local area networks. The internetwork may also include wide area network links between routers. The system includes routers between networks, which may be bridged networks. Certain routers are configured as home routers. Home routers bind two addresses for each mobile node on a given network when that node logs-in with a home router. Mobile nodes log-in with a home router that assigns a virtual address that does not change throughout a session. Each time, a mobile node roams to another network across a router boundary, the virtual address remains the same and all packets directed to the mobile node are received by the home router which advertises that it can reach the mobile node. As the mobile node roams, it reports back to the home router a local address to which the home router forwards all packets directed originally by correspondent nodes to the virtual address.