TCP traceroute using RST and SYN-ACK to determine destination reachability

Patent metadata

Field	Value
Publication number	US-11770319-B2
Application number	US-202117149082-A
Country	US
Kind code	B2
Filing date	Jan 14, 2021
Priority date	Jan 14, 2021
Publication date	Sep 26, 2023
Grant date	Sep 26, 2023

Abstract

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods implemented by a traceroute application implementing a Transmission Control Protocol (TCP) stack in a processing device include sending a plurality of TCP packets via a raw socket to perform a trace to a destination; receiving responses to the plurality of TCP packets; detecting the responses in the TCP stack and diverting the responses to the raw socket; and aggregating the responses by the traceroute application to determine details of a service path from the processing device to the destination.

First claim

What is claimed is:

1. A method implemented by a traceroute application implementing a modified Transmission Control Protocol (TCP) stack in a processing device, the method comprising:
sending a plurality of TCP packets via a raw socket to perform a trace to a destination;
receiving responses to the plurality of TCP packets;
inspecting responses consumed by the modified TCP stack, wherein the modified TCP stack is adapted to recognize TCP traceroute traffic;
recognizing one of a Synchronize-Acknowledgment (SYN-ACK) or a Reset (RST) from the destination in the responses based on the inspecting;
responsive to recognizing the SYN-ACK or RST in the responses, diverting the SYN-ACK or RST responses to the raw socket; and
aggregating the responses by the traceroute application to determine details of a service path from the processing device to the destination.

2. The method of claim 1 , wherein the plurality of TCP packets include TCP Synchronize (SYN) messages, and the responses include TCP SYN-Acknowledgement (ACK) or Reset (RST) messages.

3. The method of claim 2 , further comprising receiving, at the modified TCP stack in the processing device, a TCP SYN-ACK message from the destination; and
sending a TCP RST packet to the destination based on the modified TCP stack recognizing the TCP SYN-ACL message.

4. The method of claim 3 , wherein a TCP checksum, sequence, and ACK in the TCP RST packet are implemented by the traceroute application.

5. The method of claim 1 , wherein the raw socket is used in lieu of a TCP socket to determine the reachability to the destination when TCP traceroute traffic is recognized based on the scanning of the TCP stack.

6. The method of claim 1 , wherein a port for the raw socket is allocated by the TCP stack from a pool of ports based on the destination.

7. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors associated with a processing device that executes a traceroute application implementing a modified Transmission Control Protocol (TCP) stack to perform steps of:
sending a plurality of TCP packets via a raw socket to perform a trace to a destination;
receiving responses to the plurality of TCP packets;
inspecting responses consumed by the modified TCP stack, wherein the modified TCP stack is adapted to recognize TCP traceroute traffic;
recognizing one of a Synchronize-Acknowledgment (SYN-ACK) or a Reset (RST) from the destination in the responses based on the inspecting;
responsive to recognizing the SYN-ACK or RST in the responses, diverting the SYN-ACK or RST responses to the raw socket; and
aggregating the responses by the traceroute application to determine details of a service path from the processing device to the destination.

8. The non-transitory computer-readable medium of claim 7 , wherein the plurality of TCP packets include TCP Synchronize (SYN) messages, and the responses include TCP SYN-Acknowledgement (ACK) or Reset (RST) messages.

9. The non-transitory computer-readable medium of claim 8 , wherein the steps further include
receiving, at the modified TCP stack in the processing device, a TCP SYN-ACK message from the destination; and
sending a TCP RST packet to the destination based on the modified TCP stack recognizing the TCP SYN-ACK message.

10. The non-transitory computer-readable medium of claim 9 , wherein a TCP checksum, sequence, and ACK in the TCP RST packet are implemented by the traceroute application.

11. The non-transitory computer-readable medium of claim 7 , wherein the raw socket is used in lieu of a TCP socket to determine the reachability to the destination when TCP traceroute traffic is recognized based on the scanning of the TCP stack.

12. The non-transitory computer-readable medium of claim 7 , wherein a port for the raw socket is allocated by the TCP stack from a pool of ports based on the destination.

13. A processing device with a traceroute application that implements a modified Transmission Control Protocol (TCP) stack, the processing device comprising:
one or more processors and memory comprising instructions that, when executed, cause the one or more processors to
send a plurality of TCP packets via a raw socket to perform a trace to a destination;
receive responses to the plurality of TCP packets;
inspect responses consumed by the modified TCP stack, wherein the modified TCP stack is adapted to recognize TCP traceroute traffic;
recognize one of a Synchronize-Acknowledgment (SYN-ACK) or a Reset (RST) from the destination in the responses based on the inspecting;
responsive to recognizing the SYN-ACK or RST in the responses, divert the SYN-ACK or RST responses to the raw socket; and
aggregate the responses by the traceroute application to determine details of a service path from the processing device to the destination.

14. The processing device of claim 13 , wherein the plurality of TCP packets include TCP Synchronize (SYN) messages, and the responses include TCP SYN-Acknowledgement (ACK) or Reset (RST) messages.

15. The processing device of claim 14 , wherein the instructions that, when executed, cause the one or more processors to
receive, at the modified TCP stack in the processing device, a TCP SYN-ACK message from the destination; and
send a TCP RST packet to the destination based on the modified TCP stack recognizing the TCP SYN-ACK message.

16. The processing device of claim 15 , wherein a TCP checksum, sequence, and ACK in the TCP RST packet are implemented by the traceroute application.

17. The processing device of claim 13 , wherein the raw socket is used in lieu of a TCP socket to determine the reachability to the destination when TCP traceroute traffic is recognized based on the scanning of the TCP stack.

18. The processing device of claim 13 , wherein a port for the raw socket is allocated by the TCP stack from a pool of ports based on the destination.

Assignees

• Zscaler Inc

Inventors

• Kamath Sandeep
• Zheng Chenglong
• Stepanenko Vladimir
• Devarajan Srikanth

Classifications

• H04L43/10 Primary

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L69/162

  involving adaptations of sockets based mechanisms (secure socket layer H04L63/168) · CPC title

• H04L43/0852

  Delays · CPC title

• H04L43/0829

  Packet loss · CPC title