Auto discovery of network proxies

Patent metadata

Field	Value
Publication number	US-11522765-B2
Application number	US-202117176328-A
Country	US
Kind code	B2
Filing date	Feb 16, 2021
Priority date	Oct 31, 2017
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

According to one or more embodiments of the disclosure, techniques herein provide for auto discovery of network proxies. In particular, in one embodiment, a controller in a computer network receives, from both source devices and destination devices, corresponding Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) for packets sent by the source devices and for packets received at the destination devices. The controller may then correlate particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same, and can compare the correlated source TCP/IP information and destination TCP/IP information in order to determine whether a proxy device exists (e.g., and which particular type of proxy device exists) between the source device and the destination device.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a controller in a computer network from a source device, source Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) that are indicative of a distributed business transaction for packets sent by the source device;
receiving, at the controller from a destination device, destination TCP/IP information and associated transaction IDs that are indicative of the distributed business transaction for packets received at the destination device;
correlating, at the controller, particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same;
comparing, at the controller, the correlated source TCP/IP information and destination TCP/IP information to determine whether header information of the correlated source TCP/IP information and destination TCP/IP information remains unchanged after a layer-3 (L3) network address translation (NAT) proxy device; and
determining, at the controller based on the comparing, a) whether a proxy device exists between the source device and the destination device and b), if the proxy device exists, a type and a network layer location of the proxy device.

2. The method as in claim 1 , wherein determining whether a proxy device exists comprises:
determining that no proxy device exists between the source device and the destination device in response to the header information of correlated source TCP/IP information and destination TCP/IP information being the same; and
determining that a proxy device does exist between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information being different.

3. The method as in claim 1 , wherein determining whether a proxy device exists comprises:
determining that a layer-3 (L3) network address translation (NAT) proxy device exists between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information having different IP information but the same TCP information; and
determining that one of either a layer-4 or layer-7 (L4/L7) proxy device exists between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information having different TCP information.

4. The method as in claim 3 , further comprising:
determining that the L3 NAT proxy device is a reverse proxy in response to the destination TCP/IP information having a same source address as the source TCP/IP information but a different destination address from the source TCP/IP information; and
determining that the L3 NAT proxy device is a forward proxy in response to the destination TCP/IP information having a same destination address as the source TCP/IP information but a different source address from the source TCP/IP information.

5. The method as in claim 1 , wherein the source TCP/IP information and destination TCP/IP information each comprise either an IPv4 or an IPv6 packet.

6. The method as in claim 1 , wherein the associated transaction IDs are appended to the header information of the correlated source TCP/IP information and destination TCP/IP information.

7. The method as in claim 1 , wherein receiving the source and destination TCP/IP information comprises receiving the source and destination TCP/IP information from a source agent on the source device and a destination agent on the destination device, respectively.

8. A tangible, non-transitory, computer-readable medium storing program instructions that cause a controller in a computer network to execute a process comprising:
receiving, from a source device, source Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) that are indicative of a distributed business transaction for packets sent by the source device;
receiving, from a destination device, destination TCP/IP information and associated transaction IDs that are indicative of the distributed business transaction for packets received at the destination device;
correlating particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same;
comparing the correlated source TCP/IP information and destination TCP/IP information to determine whether header information of the correlated source TCP/IP information and destination TCP/IP information remains unchanged after a layer-3 (L3) network address translation (NAT) proxy device; and
determining, based on the comparing, a) whether a proxy device exists between the source device and the destination device and b), if the proxy device exists, a type and a network layer location of the proxy device.

9. The computer-readable medium as in claim 8 , wherein determining whether a proxy device exists comprises:
determining that no proxy device exists between the source device and the destination device in response to the header information of correlated source TCP/IP information and destination TCP/IP information being the same; and
determining that a proxy device does exist between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information being different.

10. The computer-readable medium as in claim 8 , wherein determining whether a proxy device exists comprises:
determining that a layer-3 (L3) network address translation (NAT) proxy device exists between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information having different IP information but the same TCP information; and
determining that one of either a layer-4 or layer-7 (L4/L7) proxy device exists between the source device and the destination device in response to the header information of the correlated source TCP/IP information and destination TCP/IP information having different TCP information.

11. The computer-readable medium as in claim 10 , wherein the process further comprises:
determining that the L3 NAT proxy device is a reverse proxy in response to the destination TCP/IP information having a same source address as the source TCP/IP information but a different destination address from the source TCP/IP information; and
determining that the L3 NAT proxy device is a forward proxy in response to the destination TCP/IP information having a same destination address as the source TCP/IP information but a different source address from the source TCP/IP information.

12. The computer-readable medium as in claim 8 , wherein the source TCP/IP information and destination TCP/IP information each comprise either an IPv4 or an IPv6 packet.

13. The computer-readable medium as in claim 8 , wherein the associated transaction IDs are appended to the header information of the correlated source TCP/IP information and destination TCP/IP information.

14. The computer-readable medium as in claim 8 , wherein receiving the source and destination TCP/IP information comprises receiving the source and destination TCP/IP information from a source agent on the source device and a destination agent on the destination device, respectively.

15. An apparatus, comprising:
one or more network interfaces to communicate with a computer network;
a processor coupled to the network interfaces and configured to ex

Assignees

• Cisco Tech Inc

Inventors

• Nataraj Harish
• Chandel Ajay
• Saxena Nikhar Rakesh
• Kondapalli Naveen
• Kaligotla Prakash

Classifications

• H04L43/028

  by filtering · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L43/026

  using flow identification · CPC title