NAT Proxy Device Detection via IPID Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining the number of devices behind a Network Address Translation (NAT) device are inadequate, especially for businesses with significant Intranet traffic, as they fail to accurately identify multiple devices sharing a common IP address, leading to inaccurate bandwidth allocation and contractual compliance issues.
Innovation Solution
An IP stack-based NAT proxy device detection algorithm that samples outbound packets and analyzes the IP Identification (IPID) field values to differentiate between devices by comparing sequential IPID values, maintaining a list of identified devices and updating their information based on packet sampling, and using a predetermined difference threshold to determine device identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT is used to increase IP address utility, then the number of devices that can share a common IP address increases, but the ability to accurately identify and count individual devices deteriorates
Solution Approach 1:
The patent uses the IPID field as an intermediary identifier to indirectly identify devices behind NAT. Since direct device identification is blocked by NAT, the method leverages the IPID field contained in IP packets as a mediator that preserves device-specific information while passing through the NAT device, enabling accurate device counting without compromising NAT's address sharing capability
Solution Approach 2:
The patent treats the IPID field values as distinctive markers or 'colors' that differentiate devices. Each device generates packets with characteristic IPID sequences, and by analyzing these IPID patterns, the system can distinguish between different devices sharing the same NAT address, effectively using IPID variation as a device identification mechanism
2Measurement precision
If all outbound packets are analyzed to accurately identify devices, then measurement precision improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by sampling only a portion of outbound packets rather than analyzing every packet. The method extracts IPID information from selected packets and uses this partial data to infer device identity, achieving sufficient measurement precision while significantly reducing processing time and computational overhead compared to complete packet analysis
Solution Approach 2:
The patent extracts only the essential IPID field information from packets rather than analyzing complete packet contents. By taking out just the necessary identification element (IPID) and ignoring other packet data, the method achieves accurate device identification with minimal processing requirements
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Multiple networked devices (22) behind a NAT device (20) are identified by sampling a proportion of data packets traversing the network and comparing the packet IP Identification fields. Depending on proximity of the values in different packets, each sampled packet is associated with one of currently known devices using the NAT, or identified with a newly recognized device.