Unauthorized Router Detection via MAC Address and TTL Inversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods, such as traceroute, are ineffective in detecting unauthorized routers in a network when the subnet is unknown or the machines on the subnet are silent or down, as they require known IP addresses to determine if a machine is routing.
Innovation Solution
A computer-implemented method that creates a data packet with a physical address of a suspected router, a bogus IP address, and a time-to-live field set to 1, which is sent to the router, and if an ICMP time exceeded message is received, it indicates that the device is enabled for routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traceroute utility is used to detect routers by sending packets with limited TTL values, then routers in the network path can be discovered, but the method fails when the subnet is unknown or machines on the subnet are silent or down
Solution Approach 1:
Instead of sending packets from a known source to a known destination to detect routers along the path, the invention inverts the approach by sending packets directly to suspected router devices using their physical addresses. The packet is designed with a bogus IP address and TTL=1, causing the suspected router to respond with an ICMP time exceeded message if it is indeed routing, thereby directly identifying rogue routers without needing to know subnet information or rely on destination machines being active.
2Reliability
If known IP addresses are required to determine if a machine is routing, then router detection can be performed using traditional methods, but unauthorized routers cannot be discovered when their subnet IP addresses are unknown
Solution Approach 1:
The invention uses physical addresses (MAC addresses) as an intermediary to identify and communicate with suspected router devices, bypassing the need for IP address information. By constructing packets with the physical address in the destination media access control field and a bogus IP address, the method enables direct communication with potential rogue routers even when subnet IP addresses are completely unknown, thereby eliminating the information loss barrier.
3Adaptability or versatility
If a data packet with bogus IP address and TTL=1 is sent to a suspected router, then unauthorized routers can be detected without knowing subnet IP addresses, but the method requires creating specially formatted packets
Solution Approach 1:
The invention changes key parameters of the data packet to achieve the detection goal: setting TTL to 1 to ensure the packet is discarded by the first router (generating an ICMP time exceeded response), using a bogus IP address that won't match any legitimate destination, and placing the suspected router's physical address in the destination MAC field. These parameter changes enable the packet to specifically trigger a response from rogue routers while maintaining manageable construction complexity.
Data Source
Figure 1~2
Figure 3~6
Figure 7
AI summary
A computer implemented method, data processing system, and computer program product for discovering an unauthorized router in a network. The process in the illustrative embodiments first obtains a physical address of a suspected router or destination device. A data packet is created which comprises at least a destination media access control field, a destination internet protocol field, and a time-to-live field, wherein the destination media access control field comprises the physical address of the destination device, wherein the destination internet protocol field comprises a bogus internet protocol address, and wherein the time-to-live field comprises a value indicating the data packet has exceeded a time limit. The data packet is sent to the destination device using the physical address in the destination media access control field. If a time exceeded message is received from the destination device, the destination device is determined to be enabled for routing.