Patent Application
20190007293
This invention relates generally to communications in computer networks. More particularly, this invention is directed to correlating network traffic flows on opposite sides of a network address translator.
The network address translator 106 remaps the IP address into another IP address by modifying network address information in IP datagram packet headers. The network address translator 106 also changes port designations (e.g., Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port designations).
The network address translator 106 maintains a mapping of IP addresses between its ingress and egress ports. However, monitoring traffic flows on either side of the network address translator 106 is challenging since different IP addresses and port designations are used on opposite sides of the network address translator 106.
Accordingly, there is a need for correlating network traffic flows on opposite sides of a network address translator.
A machine has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to evaluate internal packets from a first side of a network address translator with a first internet protocol address and a first port designation. External packets from a second side of a network address translator with a second internet protocol address and a second port designation are evaluated. A session start packet match is identified within the internal packets and the external packets. A session entry with a session start time is created in response to the session start packet match. A session end match is identified within the internal packets and the external packets. A session end time is recorded in response to the session end match.
A machine has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to classify packets as transmission control protocol signaling packets or transmission control protocol non-signaling packets. Further processing of the transmission control protocol non-signaling packets is omitted. Trailers are appended to the transmission control protocol signaling packets. The transmission control protocol signaling packets and the trailers are forwarded to a network connected device for further evaluation.
The invention is more fully appreciated in connection with the following detailed description taken in conjunction with the accompanying drawings, in which:
Like reference numerals refer to corresponding parts throughout the several views of the drawings.
The network monitoring devices 202A-202N and 206A-206N are connected to a forensic network device 210. The forensic network device 210 processes information from opposite sides of the network address translator 106 (i.e., from the network monitoring devices 202A-202N and from the network monitoring devices 206A-206N) to correlate traffic flows on opposite sides of the network address translator. As previously indicated, this is a challenge because the IP addresses and port designations are different on opposite sides of the network address translator 106.
In one embodiment, the forensic network device 210 is connected to a management platform 212. The management platform 212 may be used to perform additional traffic analytics and provide visualizations of network activity.
U.S. Pat. No. 9,407,518 (the '518 patent), which is owned by the current applicant, discloses a network monitoring device that may be configured in accordance with embodiments of the invention. The contents of the '518 patent are incorporated herein by reference.
The device of the '518 patent or a device with a similar configuration may be programmed to perform the operations of
If the packet is not a TCP signaling packet (302—No), the packet is skipped 304. Control then returns to block 300 for evaluation of the next packet. That is, for the purposes of correlating network traffic flows on opposite sides of a network address translator, only TCP signaling packets are processed. This approach reduces the amount of data that needs to be forwarded and analyzed.
If the packet is a TCP signaling packet (302—Yes), a trailer is added to the packet 306. The packet and the trailer are then sent to the forensic network device 308.
The forensic analysis module 518 may maintain a database of such session entries. The start time is collected from the timestamp field 406 of the trailer 402. If a session start packet is not identified (602—No), control returns to block 600.
After a session entry is created, internal and external packets are evaluated 606 to track a session on either side of the network address translator. A correlation between sessions is identified by identifying a packet from the internal side of the network address translator and the external side of the network address translator that meet a correlation rule, such as “same destination different source” on the egress side and “different destination same source” on the ingress side. The two packets should also have a time stamp that is very close, e.g., within a millisecond threshold. The two packets should also have the same hash, which indicates identical packets, except for the source and IP destinations, which are excluded from the hash. One or more of these correlation rules may be used in accordance with embodiments of the invention.
Packets are processed to identify a session end packet (e.g., a TCP signal of FIN, FIN-ACK or RST). When a session end packet is identified (608—Yes), the session end time is recorded 610. The session time is then computed 612 by taking the difference between the session start time and the session end time. A session size is also estimated 614. The session size may be calculated by writing the TCP sequence numbers and subtracting the end sequence number from the initial sequence number. If the connection is not bigger than 2 GB, then the session size estimate is accurate. If the session size is greater than 2 GB, a heuristic based upon time is used to estimate the session size.
An embodiment of the present invention relates to a computer storage product with a computer readable storage medium having computer code thereon for performing various computer-implemented operations. The media and computer code may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well known and available to those having skill in the computer software arts. Examples of computer-readable media include, but are not limited to: magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs, DVDs and holographic devices; magneto-optical media; and hardware devices that are specially configured to store and execute program code, such as application-specific integrated circuits (“ASICs”), programmable logic devices (“PLDs”) and ROM and RAM devices. Examples of computer code include machine code, such as produced by a compiler, and files containing higher-level code that are executed by a computer using an interpreter. For example, an embodiment of the invention may be implemented using JAVA®, C++, or other object-oriented programming language and development tools. Another embodiment of the invention may be implemented in hardwired circuitry in place of, or in combination with, machine-executable software instructions.
The foregoing description, for purposes of explanation, used specific nomenclature to provide a thorough understanding of the invention. However, it will be apparent to one skilled in the art that specific details are not required in order to practice the invention. Thus, the foregoing descriptions of specific embodiments of the invention are presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed; obviously, many modifications and variations are possible in view of the above teachings. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications, they thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the following claims and their equivalents define the scope of the invention.
