Network Flow Tracing via Packet Header Duplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network systems, particularly in open flow networks, monitoring and controlling flows end-to-end is challenging due to network appliances like NAT and NAPT, which translate packet headers, making it difficult to maintain correspondence between flows before and after translation without modifying these appliances.
Innovation Solution
A network system and method that encapsulates packets using the same header before and after translation, allowing for the tracking of flows by duplicating and translating packet headers, enabling the controller to acquire header translation data without altering the network appliances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If packet headers are translated by NAT/NAPT appliances to enable network address translation, then network address reuse and security are improved, but flow correspondence between before and after translation is lost
Solution Approach 1:
The switch performs preliminary actions by duplicating packet headers before they enter the NAT/NAPT appliance and storing them in a header translation buffer. This preliminary duplication ensures that the original header information is preserved before translation occurs, enabling later flow correspondence tracking without interfering with the address translation functionality.
Solution Approach 2:
A header translation buffer acts as an intermediary between the NAT/NAPT appliance and the flow tracking system. This buffer stores both the original packet headers and the translated headers, mediating the information flow and enabling the controller to match flows before and after translation by comparing headers in the buffer without requiring modifications to the NAT/NAPT appliance itself.
2Measurement precision
If NAT/NAPT appliances are modified to maintain flow correspondence, then flow tracing capability is improved, but device complexity and modification requirements increase
Solution Approach 1:
The header translation buffer serves as an intermediary that captures and stores header information without requiring any modification to the NAT/NAPT appliance. The switch and controller work together to duplicate and track headers through this buffer, achieving precise flow tracing while keeping the NAT/NAPT appliance unchanged and avoiding increased device complexity.
Solution Approach 2:
Instead of modifying the NAT/NAPT appliance to maintain flow correspondence, the system creates copies of packet headers in the header translation buffer. The switch duplicates incoming headers before translation, and the controller uses these copies to track flows, achieving accurate flow tracing through copying rather than modification.
3Loss of information
If packet headers are duplicated and stored in header translation buffer, then flow correspondence is maintained, but memory usage increases
Solution Approach 1:
The system performs preliminary duplication of only the necessary header fields that are required for flow identification and matching, rather than storing entire packet copies. This selective duplication of critical header information maintains flow correspondence while minimizing the memory footprint in the header translation buffer.
Solution Approach 2:
The system creates simplified copies of packet headers containing only the essential fields needed for flow tracking (such as source/destination addresses and ports), rather than duplicating complete packet data. This copying approach maintains the ability to trace flows while reducing memory consumption compared to storing full packet copies.
Data Source
AI summary
A switch apparatus includes a storage storing a table, the table including rules and actions corresponding to the rules, and a controller including a memory storing instructions, and a processor configured to execute the instructions to receive the rules and the actions from a control apparatus, identify, based on the rules, a received packet, duplicate a part of a header of the identified packet as an additional header when the identified packet includes a target of encapsulation, encapsulate the identified packet by the additional header, and process, based on the actions, the identified packet.