NAT (Network Address Translation) host number detection method based on IPID and probability statistics model

Abstract

The invention relates to an NAT (Network Address Translation) host number detection method based on an IPID and a probability statistics model. According to the method, data packets during a period of time are equally divided into data packets during n time slots to be processed; an IPID method is used to obtain an IPID sequence set during each time slot; the number of crossing sequences of every two adjacent time slots is calculated; and finally, the total number of hosts after NAT equipment is calculated. The method provided by the invention can solve problems of sequence confusion and sequence interruption in the IPID detection method, and improves the accuracy of calculation of the NAT host number.

Description

technical field [0001] The invention belongs to the field of network technology, and in particular relates to a method for detecting the number of NAT hosts based on IPID and probability statistics model. Background technique [0002] With the rapid growth of the number of computers connected to the Internet, IP address resources are becoming more and more tense. Ordinary users can hardly apply for the entire class C IP address. Even for large-scale LAN users with hundreds of computers, when they apply for IP addresses, the addresses allocated are only a few or a dozen IP addresses. Obviously, such a small number of IP addresses cannot meet the needs of network users at all, so the NAT technology was born. [0003] NAT (Network Address Translation, Network Address Translation) technology is a transitional technology to temporarily solve the shortage of IP addresses. It is an IETF standard, which allows all users in an organization to connect to the Internet through a limite...

AI Technical Summary

Problems solved by technology

[0007] The defect of the IPID sequence detection method is that the sequence of the host that communicates within the NAT will change, the package will be retransmitted, and the impact of the reverse order will cause confusion between the sequences of each host.

The acquisition of the IPID track depends too much on whether the data packets sent by the target IP can be continuously obtained. When the host uses a multi-threaded download tool, the IPID value will change, making the IPID value lose its regularity. Generally, it is the same host. The sequence is interrupted and becomes multiple sequences, which affects the accuracy of the IPID sequence detection method, resulting in misjudgment or multiple detection

[0008] The defect of the CookieID technology host detection method is that when some hosts do not visit the analyzed CookieID website, the number of hosts cannot be determined, so it cannot satisfy the situation that users randomly visit the website, so the host access behind NAT In the case of large randomness and wide distribution of websites, the accuracy of the calculation method of the number of hosts of this technology is difficult to meet the demand, and the calculation time is relatively long

Images