Pattern-Based Network Discovery for NAT Relationship Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer networks employing network address translation (NAT), identifying communication relationships between servers is challenging due to modifications made to network addresses and port information, making it difficult to determine relationships between servers separated by a NAT.
Innovation Solution
Implementing pattern-based techniques where agents on host devices are deployed to determine unique outbound transmission patterns, which are used to perform outbound transmissions and collect inbound data, allowing the network discovery manager to analyze and identify communication relationships without the need for packet inspection or additional identifying information in packet headers or bodies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network address translation (NAT) is used to translate network addresses and port information, then network connectivity and security are improved, but the ability to identify communication relationships between servers is worsened
Solution Approach 1:
The patent applies color changes by using distinctive transmission patterns as visual identifiers for different servers. Each server is assigned a unique transmission pattern (analogous to color coding) that remains consistent across NAT translations, allowing pattern recognition analyzers to identify server relationships despite IP address modifications by the NAT device
Solution Approach 2:
The patent introduces transmission patterns as an intermediary mechanism between servers and the pattern recognition analyzer. These patterns act as mediators that carry server identity information through the NAT device, enabling relationship discovery without requiring direct observation of modified packet headers or bodies
2Ease of operation
If IP addresses are used to identify server relationships, then relationship discovery is simplified, but accuracy is worsened when NAT is present
Solution Approach 1:
The patent creates a copy of server identity information in the form of transmission patterns. Instead of relying on the original IP addresses that are modified by NAT, the system creates pattern copies that preserve server identity and can be recognized consistently across different network locations, improving both ease of operation and measurement precision
3Difficulty of detecting and measuring
If packet inspection is performed to discover communication relationships, then relationship detection is improved, but system complexity and permission requirements are worsened
Solution Approach 1:
The patent extracts the essential identification information from complex packet inspections and isolates it into simplified transmission patterns. By taking out only the necessary pattern information (timing, sequence, duration) from the complex packet data, the system achieves effective relationship detection without requiring full packet inspection, reducing system complexity and permission requirements
Data Source
AI summary
A network discovery service provides pattern-based techniques to discover relationships between hosts in a network employing address translation. Agents are deployed to hosts of the network. To configure an agent, the discovery service obtains outbound transmission data from the agent, which indicates outbound network transmissions that were established by the host. One or more unique outbound transmission patterns are provided to the agent, based on analysis of the outbound transmission data. Inbound transmission data is then received from the agents. The inbound transmission data indicates transmission events at the host devices, as well as the source for each of the open and close events. The inbound transmission data is analyzed to identify occurrences of the outbound transmission patterns. Based on the analysis, communication relationships between the host devices is determined. In some cases, communication relationships between individual processes on different hosts may be determined.