Use of adaptive resonance theory to differentiate network device types (routers vs switches)

摘要

To determine a network communications device type, (switch or router) without reference to internal information within the network communications device, two packets having preselected, differing sizes (e.g., 64 bytes and 1500 bytes) are sequentially transmitted from one network node to another through the network communications device. The difference between the transmission start times for the two packets, determined by time references set up based on internal data processing system high resolution counters and placed in the IP packet payload, and the difference between the receipt stop times—that is, when the last portions of the two packets are received—are compared. If the two differences are substantially the same, the network communications device is classified as a switch. If the two differences are unequal by an appreciable amount, the network communications device is classified as a router. Classification may optionally be performed by a neural network trained with the expect relative relationship between the transmission start times difference and the receipt stop times difference for the preselected packet sizes when transmitted through switches and routers.