Identifying network flows under network address translation

Patent metadata

Field	Value
Publication number	US-9800542-B2
Application number	US-201313829177-A
Country	US
Kind code	B2
Filing date	Mar 14, 2013
Priority date	Mar 14, 2013
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

The present disclosure relates generally to the field of identifying network flows (e.g., IP flows) under network address translation. In various examples, identifying network flows (e.g., IP flows) under network address translation may be implemented in the form of systems and/or algorithms.

First claim

What is claimed is:

1. A non-transitory storage device for correlating a network flow seen at a plurality of observation points in a network, the storage device comprising program instructions that, when executing, configure a first processing element at a first one of the plurality of observation points to perform:
obtaining a first packet of the network flow;
extracting one or more invariant fields from the first packet;
sending a first address of the first packet and information of the one or more invariant fields of the first packet to a second processing element at a second one of the plurality of observation points,
wherein the program instructions configure the first processing element to perform the extracting the one or more invariant fields of the first packet and the sending the first address in response to the first address being unknown,
wherein the program instructions further configure the second processing element to perform:
receiving the first address of the first packet and the information of the one or more invariant fields of the first packet;
obtaining locally a second packet of the network flow;
extracting one or more invariant fields from the second packet;
comparing each of the one or more invariant fields received from the first processing element with a corresponding one of the one or more invariant fields obtained by the second processing element;
determining a match between the first address of the first packet and a second address of the second packet based on a determination of the one or more invariant fields of the first packet being matched with the one or more invariant fields of the second packet within a predetermined percentage; and
notifying the first processing element of the match between the first address of the first packet and the second address of the second packet,
wherein the program instructions configure the second processing element to perform the extracting the one or more invariant fields of the second packet, the sending the second address, the comparing, and the determining the match, and the notifying, in response to the second address being unknown.

2. The storage device of claim 1 , wherein each invariant field comprises at least one of:
(a) a field in an IP header that is not subject to network address translation;
(b) a field in a TCP header that is not subject to network address translation;
(c) a field in an UDP header that is not subject to network address translation; and
(d) information from a data field of the IP, TCP, or UDP packet.

3. The storage device of claim 2 , wherein:
(a) the field in the IP header that is not subject to network address translation comprises at least one of: (i) a packet length; (ii) a header checksum; (iii) a flag; (iv) a protocol number; (v) a source IP address if only a destination IP address has undergone network address translation; and (vi) a destination IP address if only a source IP address has undergone network address translation;
(b) the field in the TCP header that is not subject to network address translation comprises at least one of: (i) a sequence number; (ii) an acknowledgement number; (iii) a window size; (iv) a checksum; (v) a flag; (vi) a source port number if only a destination port number has undergone network address translation; and (vii) a destination port number if only a source port number has undergone network address translation;
(c) the field in the UDP header that is not subject to network address translation comprises at least one of: (i) a length; (ii) a checksum; (iii) a source port number if only the destination port number has undergone network address translation; and (iv) a destination port number if only a source port number has undergone network address translation; and
(d) the information from the data field of the IP, TCP, or UDP packet comprises a signature of the data field.

4. The storage device of claim 1 , wherein the program instructions further configure at least one of the first and second processing elements to perform:
storing mapping information between the first address and the second address.

5. The storage device of claim 1 , wherein the program instructions further configure the first processing element to perform:
stopping sending of one or more invariant fields associated with a third packet belonging to the network flow to the second processing element.

6. A computer-implemented system for correlating a network flow seen at a plurality of observation points in a network, the system comprising:
a hardware processor, associated with a first one of the plurality of observation points, configured to:
obtain a first packet of the network flow;
extract one or more invariant fields from the first packet in response to a first address being unknown; and
send the first address of the first packet and information of the one or more invariant fields of the first packet to another hardware processor associated with a second one of the plurality of observation points in response to the first address being unknown,
wherein the system further comprising:
the another hardware processor configured to:
obtain a second packet of the network flow;
extract one or more another invariant fields from the second packet in response to a second address of the second packet being unknown;
compare each of the one or more invariant fields of the first packet received from the hardware processor with a corresponding one of the one or more invariant fields of the second packet obtained by the another hardware processor in response to the second address being unknown;
determine a match between the first address of the first packet and the second address of the second packet based on a determination of the one or more invariant fields of the first packet being matched with the one or more invariant fields of the second packet within a predetermined percentage in response to the second address being unknown; and
notify the hardware processor of the match between the first address of the first packet and the second address of the second packet in response to the second address being unknown.

7. The system of claim 6 , wherein each invariant field comprises at least one of:
(a) a field in an IP header that is not subject to network address translation;
(b) a field in a TCP header that is not subject to network address translation;
(c) a field in an UDP header that is not subject to network address translation; and
(d) information from a data field of the IP, TCP, or UDP packet.

8. The system of claim 6 , wherein:
(a) the field in the IP header that is not subject to network address translation comprises at least one of: (i) a packet length; (ii) a header checksum; (iii) a flag; (iv) a protocol number; (v) a source IP address if only a destination IP address has undergone network address translation; and (vi) a destination IP address if only a source IP address has undergone network address translation;
(b) the field in the TCP header that is not subject to network address translation comprises at least one of: (i) a sequence number; (ii) an acknowledgement number; (iii) a window size; (iv) a checksum; (v) a flag; (vi) a source port number if only a destination port number has undergone network address translation; and (vii) a destination port number if only a source port number has undergone network address translation;
(c) the field in the UDP header that is not subject to network address translation comprises at least one of: (i) a length; (ii) a checksum; (iii) a source port number if only the destination port number has undergone network address translation; and (iv) a destination port number if only a source port number has undergone network address translation; and
(d) the information fr

Assignees

• IBM

Inventors

• Agrawal Dakshi
• Ko Bong Jun
• Le Thai Franck
• Nicholson Robert B
• Pappas Vasileios
• Verma Dinesh C

Classifications

• H04L61/2514 Primary

  between local and global IP addresses · CPC title