System and Method for Tamper Resistant Reliable Logging of Network Traffic

摘要

A network interface device includes a memory and a processor operable to receive a malicious packet marker, store the malicious packet marker to the memory, monitor network data packets flowing in the network interface device, determine that a packet matches the malicious packet marker, and store log information from the packet to the memory.

主权项

1. A network interface device comprising:
a first communication interface coupled to an information handling system; a second communication interface coupled to a management controller; a memory including first code and second code; and a processor operable to execute the first code to communicate network data packets on the first communication interface, and to execute the second code to:
receive a malicious packet marker via the second communication interface;store the malicious packet marker to the memory;monitor the network data packets flowing in the first communication interface;determine that a packet matches the malicious packet marker;store log information from the packet to the memory in response to determining that the packet matches the malicious packet marker; andsend the log information to the management controller via the second communication interface.