NAT boundary discovery method based on terminal time changes

Abstract

The invention is applied to the technical field of network security, and discloses an NAT boundary discovery method based on terminal time changes. The Nat boundary is distinguished by acquiring the time characteristics of a terminal on the basis of bypass hijacking. The method comprises the steps that a boundary hardware device is bypassed on a core switch; the boundary hardware device monitors data packets which are transmitted by all terminal devices through the switch in a mirroring mode and intercepts a .js-type GET request packet in an HTTP protocol in a mirror data packet and returns an HTTP response packet matched with the intercepted GET request packet to the terminal devices; after the terminal devices start to execute the HTTP response packet, a specified server can receive information including an IP address, the terminal operation time on the IP address and the like, and by means of analysis and counting of the specified server, the IP address is determined as the NAT boundary point if the same IP address has multiple simultaneously-existing time linear characteristics. According to the method, the NAT boundary point is accurately distinguished according to the time change characteristics of the terminal, and therefore the method is beneficial for network maintenance and management and normal operation of the network.

Description

【Technical field】 [0001] The invention relates to the technical field of network security monitoring, in particular to a NAT boundary discovery method based on terminal time changes. 【Background technique】 [0002] NAT (Network Address Translation), that is, network address translation. As a temporary solution to the current depletion of IPv4 address resources, network address translation technology is widely used, ranging from operators to home networks. Its main function is to make multiple end users on the intranet share an egress IP address through network address translation, so from the perspective of network egress, almost all network data packets are stripped of their terminal-specific information. While saving a lot of IPv4 address resources, it also increases the difficulty of network maintenance and management, especially in some larger networks such as metropolitan area networks, private and random connections to NAT networks can be seen everywhere, which has ca...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to overcome the deficiencies of the above-mentioned prior art, and provide a method for discovering NAT boundaries based on terminal time changes, which aims to solve the problem of network address translation technology increasing the difficulty of network maintenance and management in the prior art, and private and random connections. NAT networks can be seen everywhere, which has a negative impact on the normal operation of the network, and the technical problems of NAT boundary points can hardly be discerned from the network egress

Images