Adaptive Tracing Protocol Selection for Cloud Network Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traceroute methods are inadequate for accurately measuring network performance across cloud-based systems with encrypted tunnels, as they often fail to detect network hops, packet loss, and latency due to opaque protocols and firewall restrictions, leading to incomplete data and misconfiguration issues.
Innovation Solution
The approach involves adaptively selecting the best protocol (ICMP, UDP, or TCP) for tracing by performing multiple traces based on policy information, evaluating reachability, latency, and packet loss, and using a 'cloudpath' that is protocol-independent to segment the network into legs and aggregate data for a holistic view, including the use of APIs to detect proxies and firewalls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional traceroute methods are used with multiple protocols (ICMP, UDP, TCP), then protocol compatibility and firewall penetration improve, but the number of probes increases and measurement accuracy deteriorates due to incomplete data from blocked protocols
Solution Approach 1:
The system dynamically adapts the traceroute protocol based on real-time network conditions and firewall policies. It begins with ICMP probes, and if blocked, automatically transitions to UDP or TCP probes. This dynamic adaptation allows the system to maintain measurement accuracy by selecting the protocol that actually works in the current network environment, rather than statically using multiple protocols that may all be blocked.
Solution Approach 2:
The system changes the protocol parameter (ICMP, UDP, or TCP) based on network response. When ICMP probes are blocked by firewalls, the system changes to alternative protocols to maintain traceroute functionality. This parameter change approach ensures measurement accuracy is preserved by adapting to firewall restrictions rather than attempting to penetrate them with multiple fixed protocols.
2Loss of information
If multiple probes are sent to ensure complete network path detection, then network path visibility improves, but the number of probes increases causing more firewall blocking and reduced productivity
Solution Approach 1:
The system performs traceroute with a reduced number of probes by using protocol adaptation instead of sending multiple probes with each protocol. Rather than exhaustively testing ICMP, UDP, and TCP with multiple probes each, the system sends probes adaptively, switching protocols only when necessary. This partial action approach maintains network path visibility while improving productivity by reducing the total number of probes sent.
Solution Approach 2:
The system uses feedback from probe responses to determine whether to continue with the current protocol or switch to an alternative protocol. When probes are blocked or no response is received, the system receives negative feedback and adapts by trying a different protocol. This feedback mechanism ensures complete network path detection with fewer probes, as the system learns from each probe outcome and adjusts its approach accordingly.
3Reliability
If administrators block certain protocols (ICMP, UDP, TCP) for security purposes, then network security improves, but traceroute data completeness deteriorates leading to partial network path information
Solution Approach 1:
The system dynamically adapts to firewall blocking by switching protocols based on which ones are allowed. When ICMP is blocked for security, the system transitions to UDP or TCP probes. When UDP is blocked, it tries TCP. This dynamic adaptation allows the system to obtain complete traceroute data while respecting security policies, as it uses only the protocols that are permitted in the current network environment.
Solution Approach 2:
The system acts as an intermediary that adapts between the traceroute function and firewall restrictions. Rather than attempting to bypass security blocks, the system mediates by selecting from alternative protocols that achieve the same traceroute objective without violating security policies. This intermediary approach maintains both network security and traceroute data completeness.
Data Source
AI summary
Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include determining a number of hops from a source that is the user device and a destination, including determining metrics from the source to the destination; performing a trace to all intermediate nodes between the source and the destination, including determining metrics from the source to each of the intermediate nodes; and combining and presenting the metrics from the source to the destination and from the source to each of the intermediate nodes.