IP Address De-aliasing via ICMP Response Timing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for IP address de-aliasing in network topology diagnostics are inaccurate and labor-intensive, requiring strong assumptions about the network and often relying on outdated or human-entered information, which is not suitable for large networks.
Innovation Solution
A method involving repeated pinging of IP address pairs to determine the relationship between packet sending and return orders, using a statistic like SABBA to differentiate between aliased and non-aliased addresses, which reduces the number of necessary tests and provides an accurate representation of network topology without requiring extensive manual verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If standard methods (SNMP, TELNET) are used for IP de-aliasing, then device information can be obtained, but they require device passwords and manual entry which makes them difficult to apply consistently and automatically on large networks
Solution Approach 1:
The system uses publicly accessible ICMP echo operations that devices respond to automatically without requiring authentication. The de-aliasing process is self-service in that it relies on the devices' own response behavior rather than requiring external authentication mechanisms
Solution Approach 2:
The patent replaces manual information entry and authentication-based methods with an automated statistical analysis system that uses packet timing data to infer device identities, substituting mechanical manual operations with automated computational analysis
2Measurement precision
If methods relying on strong network assumptions (NTP, sequential packet IDs, IP Record Route) are used, then device identities can be revealed, but these methods require strong assumptions about the network that limit their applicability
Solution Approach 1:
The patent changes the measurement parameter from relying on protocol-specific features (NTP timestamps, packet ID sequences) to using ICMP echo response timing, which is a more universal parameter that works across different network configurations and protocols without requiring specific network assumptions
Solution Approach 2:
Instead of assuming specific network behaviors (sequential packet IDs, NTP synchronization) to identify devices, the patent inverts the approach by using the observed response timing patterns themselves as the basis for identification, without requiring assumptions about how the network should behave
3Loss of information
If traceroute is used to obtain network topology information, then a list of IP addresses can be created, but there is no way to tell that two IP addresses are interfaces on the same router
Solution Approach 1:
The patent introduces an intermediary statistical analysis layer that processes traceroute IP address data. This intermediary system uses timing correlation analysis to infer device-level topology from interface-level data, bridging the gap between raw IP addresses and meaningful device classification without requiring direct device access
Data Source
AI summary
A method of internet protocol (IP) address de-aliasing that involves obtaining IP addresses from devices in a network, pinging pairs of the IP addresses by sending packets to pairs of the IP addresses, obtaining ping response orders for the packets, and determining whether the pairs of IP addresses are aliases of the same network device based on the obtained ping response orders.