Robert Marcus Krohn

US Patent:

7546635, Jun 9, 2009

Filed:

Aug 11, 2004

Appl. No.:

10/916021

Inventors:

Robert M. Krohn - Palo Alto CA, US
Sankar Ramamoorthi - San Jose CA, US
Michael Freed - Fremont CA, US
Keith Holleman - Santa Clara CA, US

Assignee:

Juniper Networks, Inc. - Sunnyvale CA

International Classification:

G06F 9/00

US Classification:

726 11, 726 14, 709223, 709224, 709227, 709229, 709238, 709240, 709241, 709242, 370351, 370392, 370400, 370401, 370428

Abstract:

A network device receives control plane packets and data plane packets from a network. The network device includes a forwarding component that forwards the data plane packets in accordance with routing information maintained by a routing component. The forwarding component directs the control plane packets to a firewall component that processes the control plane packets to apply firewall services and detect network attacks. After processing, the firewall component loops the control plane packets back to the forwarding components for forwarding to the routing component. The firewall component may be a security service card.

US Patent:

7664855, Feb 16, 2010

Filed:

May 5, 2004

Appl. No.:

10/839187

Inventors:

Michael Freed - Pleasanton CA, US
Robert M. Krohn - Palo Alto CA, US

Assignee:

Juniper Networks, Inc. - Sunnyvale CA

International Classification:

G06F 15/173
G06F 9/00
G06F 15/16
G06F 17/00
G06F 11/00
G06F 12/14
G06F 12/16
G08B 23/00

US Classification:

709225, 726 12, 726 23

Abstract:

Techniques are described for mitigating adverse effects of port scanning within a network device. For example, an apparatus, such as a router, responds to all network connection request packets received from a client for all ports on an attached server as if all of the server's ports are open. Once a network connection is established between the router and the client, a network connection request is transmitted to the server for a requested port. Using the router to establish a full network connection with the client eliminates a unscrupulous client from sending numerous decoy network connection request messages in an effort to hide the identity of the client. By responding to all network connection requests by establishing a TCP full connection before a network connection request is forwarded to a server, a client receives no useful information regarding the state of a port on the server before providing a valid and detectable IP address. Stealth port scanning is rendered ineffective. Only connect scan-type port scanning, which is both detectible and defendable, may be used to identify open ports on a server.

US Patent:

8020200, Sep 13, 2011

Filed:

Jun 1, 2009

Appl. No.:

12/476083

Inventors:

Robert M. Krohn - Palo Alto CA, US
Sankar Ramamoorthi - San Jose CA, US
Michael Freed - Pleasanton CA, US
Keith Holleman - Santa Clara CA, US

Assignee:

Juniper Networks, Inc. - Sunnyvale CA

International Classification:

G06F 9/00

US Classification:

726 11, 726 14, 709223, 709224, 709227, 709229, 709238, 709240, 709241, 709242, 370351, 370392, 370400, 370401, 370428

Abstract:

A network device receives control plane packets and data plane packets from a network. The network device includes a forwarding component that forwards the data plane packets in accordance with routing information maintained by a routing component. The forwarding component directs the control plane packets to a firewall component that processes the control plane packets to apply firewall services and detect network attacks. After processing, the firewall component loops the control plane packets back to the forwarding components for forwarding to the routing component. The firewall component may be a security service card.