Abstract: Systems and methods for detecting and/or preventing intrusions in a wireless network based on location information of wireless devices are provided. According to one embodiment, a database is maintained by a wireless network security system that includes historical location information and a media access control (MAC) address for multiple wireless devices observed by wireless access points (APs) of a wireless network of an enterprise. Information regarding one or more probe signals originated by a wireless device of the multiple wireless devices is received by the wireless network security system from the multiple APs. A location of the wireless device is determined by the wireless network security system based on the information. A potential attack being conducted by the wireless device or in which the wireless device is involved is identified based on one or more of behavior exhibited by the wireless device, the location and the database.

Abstract: Systems and methods for detecting and/or preventing intrusions in a wireless network based on location information of wireless devices are provided. According to one embodiment, a database is maintained by a wireless network security system that includes historical location information and a media access control (MAC) address for multiple wireless devices observed by wireless access points (APs) of a wireless network of an enterprise. Information regarding one or more probe signals originated by a wireless device of the multiple wireless devices is received by the wireless network security system from the multiple APs. A location of the wireless device is determined by the wireless network security system based on the information. A potential attack being conducted by the wireless device or in which the wireless device is involved is identified based on one or more of behavior exhibited by the wireless device, the location and the database.

Abstract: A plurality of sniffing policies describing deep packet inspection processes performed on network traffic at sniffing access points from the plurality of access points is received. Network traffic levels are monitored at the plurality of access points and a level of sniffed traffic backhauled over the Wi-Fi network for analysis. A change can be detected in network traffic affecting a sniffing policy. Responsive to exceeding a certain level of sniffed traffic being backhauled, an amount of sniffed traffic sent upstream for analysis is adjusted. More specifically, a programmable policy engine at each of a sniffing access points serving as intrusion detection sensors to sniff traffic at various locations on the Wi-Fi network are reprogrammed dynamically. The adjustments reprogram a sniffing pipeline at each of the intrusion detection sensors including adjusting an endpoint device for sending sniffed traffic and dropping more traffic during deep packet inspection.

Abstract: A plurality of sniffing policies describing deep packet inspection processes performed on network traffic at sniffing access points from the plurality of access points is received. Network traffic levels are monitored at the plurality of access points and a level of sniffed traffic backhauled over the Wi-Fi network for analysis. A change can be detected in network traffic affecting a sniffing policy. Responsive to exceeding a certain level of sniffed traffic being backhauled, an amount of sniffed traffic sent upstream for analysis is adjusted. More specifically, a programmable policy engine at each of a sniffing access points serving as intrusion detection sensors to sniff traffic at various locations on the Wi-Fi network are reprogrammed dynamically. The adjustments reprogram a sniffing pipeline at each of the intrusion detection sensors including adjusting an endpoint device for sending sniffed traffic and dropping more traffic during deep packet inspection.

Abstract: In one implementation, a method for tap traffic redirection can include identification of a request protocol and a source network element, selection of a redirector protocol based on a list of device capabilities, instruction of the source network element to send a first copy of network traffic to an intermediary network element using the redirector protocol, and instruction of the intermediary network element to forward a second copy of the network traffic using the request protocol.

Abstract: In one implementation, a method for tap technology can include identification of a plurality of network element primitives of a tap request, a determination of a set of selection criteria based on the plurality of network element primitives, a selection of a tap technology based on a comparison of the set of selection criteria to a tap technology profile, and a configuration of the tap domain to copy packets based on the set of selection criteria.

Abstract: Multicast packets from streaming services on a data network are reduced. A packet conversion policy distributes OpenFlow rules to network components involved in multicasting services. In coordination with, and responsive to, detecting a matching service provider advertisement and service receiver request, executing an SDN policy governing a multicast streaming service. Specifically, multicast packets from a flow for streaming the multicast service are converted from multicast to unicast when sent from the network component associated with the service provider, and then are converted from unicast to multicast when received at the network component associated with the station.

Abstract: Multicast packets from streaming services on a data network are reduced. A packet conversion policy distributes OpenFlow rules to network components involved in multicasting services. In coordination with, and responsive to, detecting a matching service provider advertisement and service receiver request, executing an SDN policy governing a multicast streaming service. Specifically, multicast packets from a flow for streaming the multicast service are converted from multicast to unicast when sent from the network component associated with the service provider, and then are converted from unicast to multicast when received at the network component associated with the station.

Abstract: In one implementation, a method for tap traffic redirection can include identification of a request protocol and a source network element, selection of a redirector protocol based on a list of device capabilities, instruction of the source network element to send a first copy of network traffic to an intermediary network element using the redirector protocol, and instruction of the intermediary network element to forward a second copy of the network traffic using the request protocol.

Abstract: In one implementation, a method for tap technology can include identification of a plurality of network element primitives of a tap request, a determination of a set of selection criteria based on the plurality of network element primitives, a selection of a tap technology based on a comparison of the set of selection criteria to a tap technology profile, and a configuration of the tap domain to copy packets based on the set of selection criteria.