Unauthorized Router Detection via MAC Address and TTL Inversion

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods, such as traceroute, are ineffective in detecting unauthorized routers in a network when the subnet is unknown or the machines on the subnet are silent or down, as they require known IP addresses to determine if a machine is routing.

Innovation Solution

A computer-implemented method that creates a data packet with a physical address of a suspected router, a bogus IP address, and a time-to-live field set to 1, which is sent to the router, and if an ICMP time exceeded message is received, it indicates that the device is enabled for routing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traceroute utility is used to detect routers by sending packets with limited TTL values, then routers in the network path can be discovered, but the method fails when the subnet is unknown or machines on the subnet are silent or down

Engineering Contradiction:
Improverouter detection accuracyVSAvoiddetection method applicability
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

Instead of sending packets from a known source to a known destination to detect routers along the path, the invention inverts the approach by sending packets directly to suspected router devices using their physical addresses. The packet is designed with a bogus IP address and TTL=1, causing the suspected router to respond with an ICMP time exceeded message if it is indeed routing, thereby directly identifying rogue routers without needing to know subnet information or rely on destination machines being active.

Inventive Principle:
Principle #13The other way round (Inversion)

2Reliability

If known IP addresses are required to determine if a machine is routing, then router detection can be performed using traditional methods, but unauthorized routers cannot be discovered when their subnet IP addresses are unknown

Engineering Contradiction:
Improvedetection method effectivenessVSAvoidsubnet IP address information
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The invention uses physical addresses (MAC addresses) as an intermediary to identify and communicate with suspected router devices, bypassing the need for IP address information. By constructing packets with the physical address in the destination media access control field and a bogus IP address, the method enables direct communication with potential rogue routers even when subnet IP addresses are completely unknown, thereby eliminating the information loss barrier.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Adaptability or versatility

If a data packet with bogus IP address and TTL=1 is sent to a suspected router, then unauthorized routers can be detected without knowing subnet IP addresses, but the method requires creating specially formatted packets

Engineering Contradiction:
Improvedetection method flexibilityVSAvoidpacket construction complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The invention changes key parameters of the data packet to achieve the detection goal: setting TTL to 1 to ensure the packet is discarded by the first router (generating an ICMP time exceeded response), using a bogus IP address that won't match any legitimate destination, and placing the suspected router's physical address in the destination MAC field. These parameter changes enable the packet to specifically trigger a response from rogue routers while maintaining manageable construction complexity.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP2201738B1Router detection
Publication Date: 2014.07.30 INTERNATIONAL BUSINESS MACHINE CORPORATION
  • EP2201738B1 patent drawingFigure 1~2
  • EP2201738B1 patent drawingFigure 3~6
  • EP2201738B1 patent drawingFigure 7

AI summary

A computer implemented method, data processing system, and computer program product for discovering an unauthorized router in a network. The process in the illustrative embodiments first obtains a physical address of a suspected router or destination device. A data packet is created which comprises at least a destination media access control field, a destination internet protocol field, and a time-to-live field, wherein the destination media access control field comprises the physical address of the destination device, wherein the destination internet protocol field comprises a bogus internet protocol address, and wherein the time-to-live field comprises a value indicating the data packet has exceeded a time limit. The data packet is sent to the destination device using the physical address in the destination media access control field. If a time exceeded message is received from the destination device, the destination device is determined to be enabled for routing.