Correlating IP Flows Across NAT Firewalls Using Checksum Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network monitoring devices struggle to correlate packets across a NAT firewall due to address modifications, which prevents effective end-to-end tracking of user sessions in telecommunications networks.
Innovation Solution
A system and method that uses invariant OSI Layer 5 or Layer 7 data to create checksum keys, allowing for packet correlation across NAT firewalls without requiring NAT translation table data, utilizing a 5-tuple association mechanism and checksum keys to identify related packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT firewall modifies IP addresses in packet headers, then network address translation and port number translation are achieved, but packet correlation across the firewall becomes impossible using traditional address-based methods
Solution Approach 1:
The patent introduces an intermediary correlation key (such as a connection tracker identifier or flow label) that acts as a mediator between pre-NAT and post-NAT packets. This intermediary element remains consistent across the NAT boundary, allowing monitoring devices to correlate packets without directly comparing modified address information. The correlation key serves as a bridge that connects the original packet identity with its translated form.
Solution Approach 2:
The patent creates a copy of the correlation key from pre-NAT packet metadata and uses this copy to identify matching post-NAT packets. Instead of attempting to match the original packet attributes that have been modified by NAT, the system copies the immutable correlation identifier and uses it to find corresponding packets on the other side of the firewall, effectively bypassing the address modification problem.
2Ease of operation
If monitoring devices use IP address information to identify packets, then packet association works on single-side networks, but correlation fails across NAT firewall boundaries where addresses differ
Solution Approach 1:
The correlation key serves as an intermediary identifier that decouples the simple IP address matching mechanism from the complex NAT translation process. Monitoring devices continue to use simple identifier comparison (the correlation key) rather than complex address analysis, maintaining ease of operation while achieving reliable cross-firewall correlation.
Solution Approach 2:
Instead of trying to match packets by their changing address information (the traditional approach), the patent inverts the approach by using the unchanging correlation key as the primary matching criterion. This inversion transforms the problem from matching modified attributes to matching preserved identifiers, achieving both simplicity and reliability.
3Measurement precision
If entire packet payloads are compared for correlation, then accurate packet matching is achieved, but processing speed decreases due to large data volume
Solution Approach 1:
The patent extracts only the essential correlation key from the full packet data structure, separating this critical identifier from the rest of the packet payload. By extracting and using only this small, essential element for correlation purposes, the system achieves accurate packet matching without the computational burden of comparing entire large payloads, thus maintaining both precision and productivity.
Data Source
AI summary
Systems and methods are disclosed for correlating IP flows across a NAT firewall. Data packets are captured from a first interface using a monitor probe coupled to the first interface and are correlated into a first group of session records. For each of the first group of session records, a correlation key is created using data in one of the packets in the session record. Data packets are captured from a second interface using a monitor probe coupled to the second interface and are correlated into a second group of session records. For each of the second group of session records, a correlation key is created using data in one of the packets in the session record. The correlation key for one of the first group is compared to the correlation keys for each of the second group of session records to identify session records with matching correlation keys.