TW201840165A - Management and control system for automatically detecting existence of Internet protocol address device and management and control method thereof automatically detecting the existence of an Internet protocol address device - Google Patents

Abstract

This invention provides a management and control system for automatically detecting the existence of an Internet protocol address device and a management and control method thereof. The management and control system is used for knowing an Internet protocol address of a networking device by executing scanning operation and connecting a networking device not listed in a managed and controlled list to a management and control network by executing permanent passive scanning operation so as to acquire the Internet protocol address in real time. Compared with a management and control scheme of the prior art, the management and control system and the management and control method thereof provided by this invention have more excellent real-time management and control effects.

Description

 Management system for automatically detecting the existence of internet protocol address device and control method thereof  

The invention relates to a network management technology solution, in particular to a management and control scheme for automatically detecting the existence of an internet protocol address device.

In order to effectively monitor the security of a specific network (for example, the internal network of the enterprise), the conventional technology will be periodically scanned by the monitoring host to connect to the connection device of the specific network, and analyze whether the connected device has legitimate access. Permissions.

However, when the number of connected devices is extremely large, the time required for the above-mentioned monitoring scheme to complete a single scan will be severely lengthened, so that the conventional monitoring scheme cannot achieve the purpose of real-time monitoring in this connected environment, and to a considerable extent. Threats to the security of network access.

In summary, how to provide a solution to the aforementioned problems is a technical problem that needs to be solved in the field.

In order to solve the problems disclosed above, it is an object of the present invention to provide a technical solution for automatically detecting the existence of an Internet Protocol address device.

To achieve the above object, the present invention proposes a management and control system that automatically detects the presence of an Internet Protocol address device. The aforementioned control system includes a detection host and a control server. The detecting host is connected to a control network that provides external plurality of networking devices for connection, and the detecting host automatically performs a scanning operation to know the Internet Protocol address of the networked device. The foregoing control server is connected to the control network to obtain the Internet Protocol address and the corresponding networked device is listed in the controlled list, and the control server performs the resident passive monitoring scan operation, so that the The networked device of the control list is connected to the control network to instantly obtain the Internet Protocol address.

To achieve the above object, the present invention proposes a management method for automatically detecting the existence of an Internet Protocol address device. The control method is applied to the control network of the connection detection host, the control server and the external plurality of network devices. The control method includes the following steps: the detection host automatically performs the scan operation to know the internet connection of the network device The protocol address, and the management server obtains the Internet Protocol address and lists the corresponding networked device on the managed list, and the management server performs the resident passive monitoring scan operation so that it is not listed in the controlled The list of connected devices is connected to the managed network to instantly obtain the Internet Protocol address.

In summary, the present invention automatically detects the existence of the network protocol address device control system and its control method by the management server to perform the resident passive monitoring scan operation, allowing the uncontrolled network connection device to connect to the control network Down the road, get the Internet Protocol address instantly.

1‧‧‧Automatic detection of the control system of the Internet Protocol address device

11‧‧‧Detecting host

12‧‧‧Control network

13‧‧‧Control server

2‧‧‧Networking device

1 is a system block diagram of a control system for automatically detecting an Internet Protocol address device in accordance with a first embodiment of the present invention.

2 is a flow chart of a method for automatically detecting a management method of an internet protocol address device in a second embodiment of the present invention.

3 is a flow chart showing the operation of the control system for automatically detecting the presence of an Internet Protocol address device in the present invention.

The specific embodiments are described below to illustrate the embodiments of the invention, but are not intended to limit the scope of the invention.

Please refer to FIG. 1, which is a system block diagram of a management system 1 for automatically detecting an Internet Protocol (IP) address device according to a first embodiment of the present invention. The foregoing control system 1 includes a detection host 11 and a management server 13. The detecting host 11 is connected to the control network 12, and the control network 12 provides external plurality of networking devices 2 for connection, and the detecting host 11 automatically performs a scanning operation to learn the network device of the networking device 2. Road agreement address. The foregoing control server 13 is connected to the management network 12 to obtain the Internet Protocol address and the corresponding network device 2 is listed in the managed list, and the management server 13 performs the resident passive monitoring operation to allow the The networked device 2 listed in the controlled list is connected to the control network 12 to instantly obtain the Internet Protocol address.

The aforementioned detection host 11 and the management server 13 are computer devices. The aforementioned networking device 2 may be a computer or a connectable smart phone, a tablet, etc.

In another embodiment, the management server 13 obtains a reverse address recognition protocol reply package that is not listed in the networked device 2 of the managed list, so as to obtain the Internet in real time. Network protocol address. In another embodiment, the foregoing control server 13 filters the reverse address identification protocol response packet to include the networked device 2 that meets the screening conditions.

In another embodiment, the foregoing screening condition further includes at least one of a packet source end physical address, a packet source end internet protocol address, a packet destination end physical address, and a packet destination end internet protocol address.

In another embodiment, the management server 13 sends NETBIOS/NETBEUI protocol information to the network device 2 not listed in the managed list to obtain host name information for inclusion in the managed list.

Please refer to FIG. 2, which is a flowchart of a method for automatically detecting a management method of an Internet Protocol address device in accordance with a second embodiment of the present invention. The foregoing control method is applied to a control network, and the control network is a connection detection host, a control server, and an external plurality of network devices. The control method consists of the following steps:

S101: The detecting host automatically performs a scanning operation to learn the internet protocol address of the networked device.

S102: The management server obtains the Internet Protocol address and lists the corresponding networked device in the controlled list, and the management server performs the resident passive monitoring scan operation to enable the connection that is not listed in the controlled list. The network device is connected to the control network to instantly obtain the Internet Protocol address.

In another embodiment, the management server of the foregoing control method obtains a reverse address identification protocol response packet that is not listed in the connected device connection list to obtain the Internet Protocol address in real time. In another embodiment, the control server of the foregoing control method filters the reverse address identification protocol response packet to include the networked device that meets the screening condition.

In another embodiment, the screening condition of the foregoing control method further includes: a packet source end physical address, a packet source end internet protocol address, a packet destination end physical address, and a packet destination end internet protocol address. One.

In another embodiment, the management server of the foregoing control method sends NETBIOS/NETBEUI protocol information to the networked device not listed in the managed list to obtain host name information for inclusion in the managed list.

The following is a description of the management system 1 for automatically detecting the presence of an Internet Protocol address device in the first embodiment. However, the second embodiment automatically detects that the control method of the Internet Protocol address device is the same or similar. Technical efficacy.

Please refer to FIG. 1 and FIG. 3 together. FIG. 3 is a flow chart of the operation of the control system (S201~S206 are the operation flow of detecting the host 11, and S207~S209 are the operation flow of the control server 13). The flow is as follows:

The operation flow of detecting the host 11 starts

S201: The detecting host 11 performs a one-time active scanning of all active IP programs.

S202: Return the current active IP list information to the control server 13.

S203: Perform a resident passive monitoring IP status program.

S204: Determine whether a new active IP is found? If it is S205; if not, execute S203.

S205: Perform a one-time active scanning activity IP program.

S206: The new active IP information is returned to the management server 13.

End of the operation process of detecting the host 11

The operation flow of the control server 13 begins

S207: Receive current or latest active IP list information returned by the detection host 11.

S208: Does the new active IP information need to be controlled? If yes, execute S209; if not, end.

S209: Perform the setting of controlling the new activity IP.

End of the operation flow of the control server 13

If the management network 12 is an enterprise network, there is one management server 13 (IP: 10.1.1.1) and two connection devices, wherein the connection device with IP 10.1.1.2 is the detection host 11, and The connection device with IP 10.1.1.3 is the networked device 2 that has been controlled. At this time, after the active scanning operation of the detecting host 11 is executed, the current network IP usage status of the enterprise can be known from the returned scanning result. The detecting host 11 automatically discriminates the Gateway IP, Gateway MAC and subnet mask information configured by the host by capturing the location of the network entity set by the network card. Then, based on the Gateway IP, Gateway MAC, and subnet mask information, and using ICMP Ping, ARP Ping, or NETBIOS/NETBEUI to scan each IP device in the network segment, if it is an active IP, it will obtain IP information, network card MAC information or Host name information.

Then, the detecting host 11 transmits back the scanned active IP list (whose field contains IP information, network card MAC information, or host name information) to the management server 13.

The control server 13 compares the active scan results reported by the detection host 11 with the active IP list in the original database (the field contains IP information, network card MAC information, host name information, or control status). ). Then, the networked device 2 whose control state is uncontrolled is output to the list of control lists to control the list of devices that are not controlled.

When the detecting host 11 performs the passive detecting operation, it is assumed that an unmanaged networked device 2 (IP: 10.1.1.4) is connected to the enterprise network, and the detecting host 11 is directed to the gateway (Gateway). The RARP request packet is sent, so the detecting host 11 will monitor the intercepting gateway to reply the RARP Reply packet to the host, and the monitoring intercepting method can use the Driver hook technology to perform Sniffer based packet interception, and filter the RARP Reply packet, and match the screening. The condition (for example, 1. The physical address of the source of the packet = Gateway MAC, 2. The IP address of the source of the packet = Gateway IP), then the field of the RARP Reply packet is taken out (for example: 1. The destination end of the packet The physical address = the MAC of the new active device, 2. The IP address of the destination end of the packet = the IP of the new active device).

Next, the NETBIOS/NETBEUI communication protocol is issued to the IP of the new network device 2, and the host name information is obtained. Finally, the related information of the new networking device 2 (for example: 1.IP information, 2. network card MAC information, 3. host name information) is transmitted back to the management server 13.

The detailed description of the preferred embodiments of the present invention is intended to be limited to the scope of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

Claims (10)

 A control system for automatically detecting the presence of an Internet Protocol address device includes: detecting a host and connecting to a control network, the control network providing external plurality of networking devices for connection, the detection host is automatically executed Scanning the operation to know the Internet Protocol address of the networked device; and the management server, connecting the management network, obtaining the Internet Protocol address and listing the corresponding networked device on the managed list, The control server performs a resident passive monitoring scan operation to connect the networked device not listed in the managed list to the control network to obtain the Internet Protocol address in real time.    The control system for automatically detecting the presence of an internet protocol address device as described in claim 1, wherein the management server obtains a reverse address identification protocol response of the networked device connection not listed in the managed list Packet to get the Internet Protocol address in real time.    The control system for automatically detecting the presence of the Internet Protocol address device as described in claim 2, wherein the control server filters the reverse address identification protocol response packet to include the networked device that meets the screening condition.    The control system for automatically detecting the presence of the Internet Protocol address device as described in claim 3, wherein the screening condition further comprises a packet source end physical address, a packet source end internet protocol address, and a packet destination end physical address At least one of the packets of the destination end internet protocol address.    The control system for automatically detecting an Internet Protocol address device as described in claim 4, wherein the management server sends NETBIOS/NETBEUI protocol information to the network device not listed in the managed list Host name information to be included in this managed list.    A method for automatically detecting the existence of an Internet Protocol address device is applied to a control network, which is a connection detection host, a control server, and an external plurality of networking devices, including: Automatically performing a scan job to learn the Internet Protocol address of the networked device; and having the control server obtain the Internet Protocol address and list the corresponding networked device on the managed list, the control server The resident passive monitoring scan operation is performed to connect the networked device not listed in the controlled list to the control network to obtain the Internet Protocol address in real time.    The method for automatically detecting the existence of an internet protocol address device as described in claim 6, wherein the management server obtains a reverse address identification protocol response of the network connection device not listed in the managed list Packet to get the Internet Protocol address in real time.    The control method for automatically detecting the presence of the Internet Protocol address device as described in claim 7 is that the management server filters the reverse address identification protocol response packet to include the networked device that meets the screening condition.    The method for automatically detecting the existence of an internet protocol address device as described in claim 8, wherein the screening condition further comprises a packet source end physical address, a packet source end internet protocol address, and a packet destination end physical address At least one of the packets of the destination end internet protocol address.    The method for automatically detecting the presence of an Internet Protocol address device as described in claim 9, wherein the management server sends NETBIOS/NETBEUI protocol information to the network device not listed in the managed list. Host name information to be included in this managed list.