A system comprising:na first interface for receiving at least one of a plurality of packets to obtain at least one received packet from a network;a second interface for placing at least a subset of the at least one received packet onto a link;a bus communicatively coupled to the first interface and the second interface;a memory communicatively coupled to the bus, the memory for storing information about the at least one received packet in a machine-readable form;a processor communicatively coupled to the bus and the memory, the processor configured for executing machine-readable instructions for processing the at least one received packet;wherein the system is operable such that the memory is capable of storing the information in a form of one or more first representations for the at least one received packet, each of the one or more first representations determined from a corresponding one of the at least one received packet respectively;wherein the system is operable to receive a query message including a second representation associated with a target packet in the network and use the stored one or more first representations in the memory in processing the query message to determine if the target packet has been encountered; andwherein the system is operable to generate a reply after comparing the second representation to the stored one or more first representations; wherein the reply is capable of being used for locating an intrusion point associated with the target packet in the network.
›12.↳ 11The system of claim 11, wherein the first interface and the second interface are combined into a single bi-directional interface.d2
The system of claim 11, wherein the first interface and the second interface are combined into a single bi-directional interface.
›13.↳ 11The system of claim 11, wherein the reply is made available to another network.d2
The system of claim 11, wherein the reply is made available to another network.
›14.↳ 11The system of claim 11, wherein the network is a wireless network.d2
The system of claim 11, wherein the network is a wireless network.
›15.↳ 11The system of claim 11, wherein the network is an Internet Protocol (IP) network.d2
The system of claim 11, wherein the network is an Internet Protocol (IP) network.
›16.↳ 11The system of claim 11, wherein the processor is an ASIC.d2
The system of claim 11, wherein the processor is an ASIC.
›17.↳ 11The system of claim 11, wherein the reply is a positive reply if the second representation matches at least one of the plurality of first representati…d2
The system of claim 11, wherein the reply is a positive reply if the second representation matches at least one of the plurality of first representations.
›18.↳ 11The system of claim 11, wherein the reply is forwarded to those of a plurality of devices one hop away in the network.d2
The system of claim 11, wherein the reply is forwarded to those of a plurality of devices one hop away in the network.
›19.↳ 11The system of claim 11, wherein the system is operable such that the reply is forwarded to an isolation server responsive to operation of an intrusion…d2+1
The system of claim 11, wherein the system is operable such that the reply is forwarded to an isolation server responsive to operation of an intrusion detection system, for isolating a malicious packet.
›20.↳ 19The system of claim 19, wherein the system is operable such that the reply is related to building a trace of potential paths taken by the malicious pa…d3
The system of claim 19, wherein the system is operable such that the reply is related to building a trace of potential paths taken by the malicious packet.
›21.↳ 11The system of claim 11, wherein the system is operable such that the first representations include hash values.d2
The system of claim 11, wherein the system is operable such that the first representations include hash values.
›22.↳ 11The system of claim 11, wherein the system is operable such that the processor executes machine-readable instructions for establishing a bit map of th…d2
The system of claim 11, wherein the system is operable such that the processor executes machine-readable instructions for establishing a bit map of the first representations representative of the at least one received packet.
›23.↳ 11The system of claim 11, wherein the system is operable such that the second representation is a hash of at least a portion of the at least one receive…d2
The system of claim 11, wherein the system is operable such that the second representation is a hash of at least a portion of the at least one received packet.
›24.↳ 11The system of claim 11, wherein the system is operable such that the processor executes machine-readable instructions for determining whether a target…d2+3
The system of claim 11, wherein the system is operable such that the processor executes machine-readable instructions for determining whether a target packet has been encountered in the network.
›25.↳ 24The system of claim 24, wherein the system is operable such that the determining is accomplished using a source path isolation technique.d3+2
The system of claim 24, wherein the system is operable such that the determining is accomplished using a source path isolation technique.
›26.↳ 25The system of claim 25, wherein the system is operable such that the source path isolation technique includes a breadth-first search.d4
The system of claim 25, wherein the system is operable such that the source path isolation technique includes a breadth-first search.
›27.↳ 25The system of claim 25, wherein the system is operable such that the source path isolation technique includes a depth-first search.d4
The system of claim 25, wherein the system is operable such that the source path isolation technique includes a depth-first search.
›28.↳ 11The system of claim 11, wherein the reply is used to determine a point of entry of at least one target packet.d2+1
The system of claim 11, wherein the reply is used to determine a point of entry of at least one target packet.
›29.↳ 28The system of claim 28, wherein the at least one target packet is a malicious packet.d3
The system of claim 28, wherein the at least one target packet is a malicious packet.
›30.↳ 11The system of claim 11, wherein the information includes a time-of-arrival.d2
The system of claim 11, wherein the information includes a time-of-arrival.
›31.↳ 11The system of claim 11, wherein the information includes encapsulation link information.d2
The system of claim 11, wherein the information includes encapsulation link information.
›32.↳ 11The system of claim 11, wherein the comparing the second representation to the one or more of the plurality of first representations includes using a …d2
The system of claim 11, wherein the comparing the second representation to the one or more of the plurality of first representations includes using a bit map of hash values representative of the one or more of the plurality of first representations.
›33.↳ 11The system of claim 11, wherein the reply includes an address of a router.d2+1
The system of claim 11, wherein the reply includes an address of a router.
›34.↳ 33The system of claim 33, wherein the router is the system.d3
The system of claim 33, wherein the router is the system.
›35.↳ 11The system of claim 11, wherein the reply includes information about observed packets.d2
The system of claim 11, wherein the reply includes information about observed packets.
›36.↳ 11The system of claim 11, wherein the reply includes information about transformed packets.d2+1
The system of claim 11, wherein the reply includes information about transformed packets.
›37.↳ 36The system of claim 36, wherein the transformed packets have passed through the system.d3
The system of claim 36, wherein the transformed packets have passed through the system.
›38.↳ 11The system of claim 11, wherein the system is operable to receive at least one executable instruction for instructing the system to modify the operati…d2
The system of claim 11, wherein the system is operable to receive at least one executable instruction for instructing the system to modify the operation of the system, and wherein the at least one executable instruction facilitates a response to network intrusion.
