Flow Information Analysis for Tunnel Packet Header Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traffic analysis technologies using flow information face difficulties in analyzing detailed information of user packets within tunnels, especially when tunneling protocols like L2TP or GRE are employed, as they typically only provide limited information related to the tunnel header.
Innovation Solution
A flow information analysis apparatus and method that identifies and extracts detailed information from user packets within tunnels by using templates and search data to match specific byte sequences in the tunnel headers, allowing for the analysis of transmission/reception IP addresses, protocols, and port numbers, even when tunneling protocols are used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional flow information analysis methods (NetFlow v9) are used, then the analysis process is simple, but detailed information on user packets in tunnels cannot be obtained
Solution Approach 1:
The patent segments the tunnel packet analysis into distinct parts: identifying the tunnel header, determining its length, and extracting the user packet that follows. This segmentation allows the system to handle the complexity of variable-length tunnel headers systematically while accessing detailed user packet information.
Solution Approach 2:
The patent performs preliminary actions by first identifying and analyzing the tunnel header structure before extracting the user packet. The system preliminarily determines the tunnel header length and structure, which enables subsequent accurate extraction of user packet details without requiring complex real-time analysis.
2Reliability
If tunneling protocols (L2TP, GRE) are used, then network security and encapsulation are improved, but detailed packet information becomes inaccessible
Solution Approach 1:
The patent uses the tunnel header itself as an intermediary to access the user packet information. By analyzing the tunnel header structure and length fields, the system mediates between the encrypted/encapsulated user data and the analysis requirements, enabling information extraction while maintaining the security benefits of tunneling.
Solution Approach 2:
The patent extracts detailed information from within the tunnel encapsulation by identifying the tunnel header boundaries and pulling out the user packet data that follows. This extraction process retrieves transmission/reception IP addresses, protocols, and port numbers while the tunneling protocol remains intact for security purposes.
3Adaptability or versatility
If variable-length tunnel headers are handled, then adaptability to different protocols is improved, but analysis complexity increases
Solution Approach 1:
The patent applies dynamic analysis by adapting the tunnel header parsing process to the specific protocol being used. The system dynamically determines the tunnel header length and structure based on the identified protocol type (L2TP, GRE, etc.), allowing flexible handling of variable-length headers without requiring static, complex analysis for all possible protocols.
Solution Approach 2:
The patent changes the analysis parameters based on the tunnel protocol type. By identifying the specific tunneling protocol first, the system adjusts the header length interpretation and structure analysis parameters accordingly, enabling efficient handling of different variable-length tunnel headers through parameter adaptation rather than complex universal parsing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A flow information analysis apparatus (10) receives flow information containing a header sample, determines whether the header sample of the flow information matches any of templates that are based on tunneling protocols, and when determining that the header sample matches any of the templates, extract information on a header of the IP packet from the header sample on the basis of the matched template. Further, when determining that the header sample does not match any of the templates, the flow information analysis apparatus (10) extracts information on the header of the IP packet from the header sample on the basis of a result of a search through the header sample for a byte sequence that matches search data in which a value that is set in a specific field of the tunnel header and a value that is set in a specific field of the IP packet are combined.