TCP Proxy Failover via Zero-Window Probe State Initialization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intermediate network devices acting as TCP proxies face challenges in failover scenarios, where they either allow uninspected data to pass through or drop traffic, leading to performance issues and synchronization difficulties, and require significant processing power and bandwidth for state synchronization.
Innovation Solution
An intermediate network device sends packets advertising a TCP window size of zero bytes to client and server devices, receives zero-window probe packets to initialize TCP states, and acts as a TCP proxy for subsequent packets, allowing for seamless failover without retransmitting large amounts of data or re-discovering TCP windows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional intermediate network devices allow traffic to pass through unproxied during failover, then traffic flow is maintained, but security inspection is lost and large amounts of data pass through uninspected
Solution Approach 1:
The patent applies preliminary action by pre-initializing TCP state variables and buffering mechanisms before failover occurs. The intermediate network device prepares to accept TCP packets mid-flow by pre-configuring sequence number tracking and window size management, enabling immediate security inspection upon failover without allowing uninspected data to pass through.
2Reliability
If conventional intermediate network devices drop traffic during failover, then security is maintained, but performance decreases and SYN floods occur
Solution Approach 1:
The patent uses an intermediary approach by implementing a backup intermediate network device that mediates traffic during failover. This backup device receives TCP packets, initializes their state, and processes them through security inspection, preventing both the security gaps of unproxied traffic and the performance degradation of dropped traffic.
Solution Approach 2:
The patent applies parameter changes by dynamically adjusting TCP state variables such as sequence numbers, acknowledgment numbers, and window sizes during failover. The backup intermediate network device modifies these parameters to match the original connection state, enabling seamless continuation of inspected traffic without performance loss.
3Reliability
If backup network devices receive synchronization data from primary network devices, then state synchronization is achieved, but processing power and bandwidth are significantly consumed
Solution Approach 1:
The patent extracts only the essential TCP state information needed for failover rather than synchronizing complete connection states. The backup intermediate network device receives selectively extracted parameters such as current sequence numbers and window sizes, significantly reducing the processing power and bandwidth required compared to full state synchronization.
Data Source
AI summary
In one example, an intermediate network device sends packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device. The device, after sending the packets, receives a first zero-window probe packet from the client device including data representing a first current sequence number for a client-to-server packet flow of an established network session, and a second zero-window probe packet from the server device including data representing a second current sequence number for a server-to-client packet flow of the network session. The device also initializes a TCP state based on the first and second current sequence numbers, and acts as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the TCP state.