Stealth network

Secure network architectures with monitoring systems configured to detect hackers.

Monitoring equipment such as network “sniffers”, protocol analyzers, intrusion detection systems, network forensics systems, or other network analysis systems can be connected to data networks to monitor for intrusion, hackers, or other types of network problems. By connecting such equipment to a network, however, there is a danger that the security of the monitoring equipment itself can become compromised. In other words, there is a danger that a hacker could detect the existence of the monitoring equipment and jam or otherwise control or disrupt the operation of that equipment.

Described in this application is a system and device in which taps, which mirror or provide a copy of network traffic, are connected to monitoring equipment through shadowing units. The shadowing units allow inbound traffic from the first network to be passed, substantially unaltered, to the monitoring equipment, but block outbound transmissions from the monitoring equipment side of the shadowing units.

The shadowing units are connected through bypass switches, which allow the signals to either pass through an aggregation/dissemination unit to one or more monitoring units, or directly to the monitoring units. The selective bypassing allows the traffic that must be handled by the aggregation/dissemination unit to be controlled to account for traffic load or other variables.

FIG. 1A is a network architecture diagram, showing multiple networks 102. The security/monitoring equipment 100 illustrated in FIG. 1A provides monitoring of the networks 102 and the traffic between those networks 102. More specifically, the monitoring equipment 100 provides a system and method to protect and/or monitor a network 102 from attacks of the network by external “hackers.”

The monitoring equipment 114 is shown in this embodiment at an interface 103 between computer networks 102. The monitoring equipment 114, however, does not need to be located specifically at a network interface. The systems, devices and method described in this application can be used effectively for network protection and monitoring while connected to a data network at any location.

Embodiments described in this application allow for the secure aggregation and/or dissemination of network traffic for monitoring. The monitoring equipment 114 is connected to the networks 102 through the interface 103. This connection is made through network devices such as switches or routers 104 or through other network devices. The connections to those devices are functionally made by taps 106. The function of the taps 106 could be included within network switches or routers 104, or it could be provided through separate devices connected at the outputs of those network devices 104.