Packet Analyzer Duplicate Filtering via Handshake Counting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networks using IPv6, distinguishing between duplicate packets and retransmitted packets is challenging due to the absence of a unique identification field in the packet header, leading to difficulties for mirroring devices in filtering out duplicates.
Innovation Solution
A packet analyzer employs a handshake process, specifically the TCP three-way handshake, to differentiate between duplicate and retransmitted packets by counting the number of packets associated with the handshake process, allowing it to filter out duplicates accurately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet mirroring is implemented in IPv6 networks, then network traffic analysis capability is improved, but the ability to distinguish duplicate packets from retransmitted packets deteriorates due to absence of identification field
Solution Approach 1:
The patent introduces an intermediary mechanism (handshake packet counter) that mediates between the mirrored packets and the filtering decision. By counting packets associated with handshake processes and comparing against expected values, the system indirectly identifies duplicate packets without requiring direct identification fields in IPv6 headers.
Solution Approach 2:
The system implements feedback by continuously monitoring the count of handshake packets and adjusting filtering decisions based on whether the count matches expected values. When the count exceeds expectations, the system infers presence of duplicates and adjusts mirroring/filtering behavior accordingly.
2Reliability
If TCP three-way handshake counting is used to filter duplicate packets, then duplicate packet filtering accuracy is improved, but processing overhead and complexity increase
Solution Approach 1:
The system uses the existing TCP handshake protocol itself as the mechanism for identification. The handshake packets contain their own sequence numbers and acknowledgment numbers that naturally serve as identifiers, eliminating the need for external identification fields or additional protocol modifications.
Solution Approach 2:
The patent changes the approach from using static identification fields to using dynamic parameter comparison (sequence numbers and acknowledgment numbers) that change with each handshake instance. This allows reliable differentiation of duplicate packets through parameter analysis rather than fixed identifiers.
3Loss of information
If all mirrored packets are analyzed without filtering, then complete traffic analysis is achieved, but processing load and resource consumption increase
Solution Approach 1:
The system applies partial filtering by selectively removing only those packets that are identified as duplicates through handshake counting, while preserving all non-duplicate packets including retransmissions. This partial action approach maintains analysis completeness for legitimate traffic while reducing load from redundant duplicates.
Solution Approach 2:
The filtering decision is made in advance based on handshake packet counts before individual packets are fully processed for analysis. By preliminarily identifying and filtering duplicates early in the packet flow, the system reduces the overall processing load on subsequent analysis stages.
Data Source
AI summary
Ingress and egress port packets for a connection between a first node and second node are mirrored to a mirroring port on a network switch. A count of ingress and egress port packets associated with a handshake process is determined. Duplicate mirrored packets associated with the connection are filtered based at least in part on the count.