Network Path Probing Using STUN Server and NAT Counting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network probing methods are not scalable and depend on dedicated servers, making them vulnerable to rogue devices that can thwart the probing process by learning server information, and they fail to effectively detect rogue access points without revealing probe packets.
Innovation Solution
A communications device uses a STUN server to determine the number of NATs in a network path by sending probes with a timeout counter, causing NATs to maintain active mappings while dropping test probe packets, allowing only the first NAT to maintain the mapping, thus identifying additional NATs as potential rogue access points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated servers are used for network probing, then probing effectiveness is improved, but scalability deteriorates and dependency on network access rules increases
Solution Approach 1:
The patent extracts the probing functionality from dedicated servers and embeds it directly into client devices. Each client device now possesses autonomous probing capabilities through probe generators and probe sinks, eliminating the mandatory dependency on external dedicated servers while maintaining probing effectiveness.
Solution Approach 2:
Client devices perform self-probing by generating and receiving probes locally without requiring external server infrastructure. The device uses its own network connections to probe itself, making the system self-sufficient and scalable without dedicated server dependencies.
2Ease of operation
If probes are addressed to the same server address, then probing process is simplified, but vulnerability to rogue devices increases
Solution Approach 1:
The patent makes probe destinations local rather than centralized. Each probe is directed to a locally identified probe sink within the device itself, giving each probing operation a unique local target. This prevents rogue devices from intercepting probes by knowing a centralized server address, as each device's probes are tailored to its own network path.
3Reliability
If multiple NATs are present in network path, then network security is improved, but ability to detect rogue access points deteriorates
Solution Approach 1:
The patent introduces probe timeout counters as intermediaries to measure NAT presence. The counter acts as a mediator between the probe transmission and the detection logic, allowing the system to quantify the number of NATs in the path by measuring probe timeout behavior, thereby enabling rogue access point detection while maintaining security.
4Measurement precision
If probe packets are transmitted frequently, then network path information is obtained more accurately, but power consumption increases
Solution Approach 1:
The patent implements periodic probing with configurable intervals rather than continuous probing. The system can adjust the frequency of probe transmissions based on detection needs, performing probes at regular intervals to maintain accurate network path information while significantly reducing power consumption compared to continuous transmission.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Various embodiments provide methods, devices, and non-transitory processor-readable storage media enabling network path probing with a communications device by sending probes via a network connection to a STUN server and receiving probe replies. The communications device may increment a counter and transmit a test probe configured to be dropped at the first access point (NAT) causing all subsequent NATs to release their IP/port mappings. The communications device may send another probe to the STUN server and receive a probe reply. The communications device may compare the first and second probe replies to determine whether the final IP addresses within the network path match. By continuously incrementing the counter and querying access points, the communications device may determine the number of access points lay along any given network path. The presence of addition or unexpected numbers of NAT Servers may indicate the presence of a rogue access point.