Abstract: A wireless computer network includes components cooperating together to prevent access intrusions by detecting unauthorized devices connected to the network, disabling the network connections to the devices, and then physically locating the devices. The network can detect both unauthorized client stations and unauthorized edge devices such as wireless access points (APs). The network can detect intruders by monitoring information transferred over wireless channels, identifying protocol state machine violations, tracking roaming behavior of clients, and detecting network addresses being improperly used in multiple locations. Upon detecting an intruder, the network can automatically locate and shut off the physical/logical port to which the intruder is connected.

Abstract: A wireless computer network includes components cooperating together to prevent access intrusions by detecting unauthorized devices connected to the network, disabling the network connections to the devices, and then physically locating the devices. The network can detect both unauthorized client stations and unauthorized edge devices such as wireless access points (APs). The network can detect intruders by monitoring information transferred over wireless channels, identifying protocol state machine violations, tracking roaming behavior of clients, and detecting network addresses being improperly used in multiple locations. Upon detecting an intruder, the network can automatically locate and shut off the physical/logical port to which the intruder is connected.

Abstract: Devices, systems and related methods are disclosed for improving operational security of a network and/or network devices, such as wireless access points (APs). In the disclosed systems, a network device is not fully operational until it is attached to a network and downloads sensitive information. The information is stored in the network device so that when the device is disconnected from the network, the sensitive information is erased from the device, making the device inoperative and removing sensitive information, such as passwords, network security keys, or the like. Disabling the network device in this manner not only prevents the theft of sensitive network access information, by also discourages theft of the device itself because it cannot be used on another network without the configuration information. In addition to downloading configuration information, the network device can also download an executable image that is likewise not permanently resident on the device.

Abstract: A network switch having a unified, adaptive management paradigm for wireless network devices is disclosed. The switch includes configurable ports for connecting devices. A software application running on the switch allows a network administrator to selectively configure each port to support either a wired device or wireless device. Configuration information and software images that are needed for operation of the wireless device are associated with the port. When a wireless device is first plugged into the switch port, it downloads its configuration directly from the switch port. By storing the configuration information and images at the switch and automatically downloading them to the wireless devices, the task of configuring the devices is greatly simplified for the network administrator. This is particularly advantageous in heterogeneous network environments that support both wired and wireless devices, and where wireless device are readily moved to different ports.

Abstract: An improvement to the spanning tree protocol provides for identifying a port on the bridge in the alternate port role which qualifies as a candidate root port. Upon an event causing a topology change resulting in a particular port changing from the candidate root port role to the root port role and the previous root port changing to the designated port role, the process allows the previous root port to have the forwarding state without requiring transition through the listening and forwarding states. Qualification as a suitable candidate root port according is based upon propagating a message from the root bridge, such as a bridge protocol data unit (“BPDU”) message, carrying the identifier of the port on the root bridge from which the message originates. Logic in the bridges is able to identify the branch of the tree from which the message originates, and to select the candidate root port in response to the branch information.

Abstract: An improvement to the spanning tree protocol provides for identifying a port on the bridge in the alternate port role which qualifies as a candidate root port. Upon an event causing a topology change resulting in a particular port changing from the candidate root port role to the root port role and the previous root port changing to the designated port role, the process allows the previous root port to have the forwarding state without requiring transition through the listening and forwarding states. Qualification as a suitable candidate root port according is based upon propagating a message from the root bridge, such as a bridge protocol data unit (“BPDU”) message, carrying the identifier of the port on the root bridge from which the message originates. Logic in the bridges is able to identify the branch of the tree from which the message originates, and to select the candidate root port in response to the branch information.

Abstract: A dedicated link between the intermediate system or other network device and the end system is detected prior to exchanging the authentication/identification information of the user, thereby ensuring that the information is seen only by the network device and the end system and by no one else. The method determines whether a network device has a direct connection to an end station using a test of a physical layer link active signaling mechanism. The method includes sending a message via the network from the network device to the end station indicating initiation of a test of the physical layer link active signaling mechanism. The network device then determines whether the end station participates in the test prior to proceeding with the authentication/identification processes.

Abstract: Management of forwarding databases in the case of link failures on bridges according to the all improved spanning tree, limits the propagation of notifications of topology change to only those parts of the network which are affected by the link failures, and trigger partial flushing as opposed to complete forwarding database flushing of learned MAC addresses to relearn the sets of addresses associated with ports affected by the change in topology. When a bridge moves its root port to a new port, the bridge can move the addresses learned through the original root port to the new root port without any relearning. The sets of addresses associated with the designated ports on upstream bridges from the old root port, are subject to flushing. Also when the bridge attaches to the new branch, it triggers a message to the root instructing all bridges in the new path to the root to flush addresses learned on their root ports.

Abstract: An improvement to the spanning tree protocol provides for identifying a port on the bridge in the alternate port role which qualifies as a next best root port. Upon detection of a failure at the root port, or other event causing a change in the root port to a blocking state, the next best root port transitions to the root port role, and forwarding state immediately without traversing the listening and learning states of the standard protocol. Also, in networks in which there is a possibility of shared media links between bridges, ports that have the alternate port role, and connect to a LAN which is also connected through a designated port on the same bridge are identified as a backup. The algorithm prevents such backup ports from transitioning to the forwarding state before the designated port connected to the same LAN segment transitions to a blocking state.