TCP Tunnel Latency Detection via ICMP and UDP Probes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traceroute tools are ineffective in determining network performance through encrypted tunnels and cloud-based systems, as they cannot accurately detect network hops, packet loss, and latency, and are opaque to tunnel configurations, leading to incomplete and inaccurate results.
Innovation Solution
The use of traceroute techniques combined with API detection to identify tunnels, proxies, and firewalls, employing ICMP and UDP probes to detect network hops and latency, and adaptive probing to determine packet loss and latency through TCP tunnels, while caching results to prevent traffic surges on destination servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional traceroute tools are used to monitor network paths, then network visibility is provided, but the tools become opaque to encrypted tunnels and cannot accurately detect network hops, packet loss, and latency
Solution Approach 1:
The patent introduces intermediary probe packets (ICMP and UDP) that travel through the encrypted tunnel alongside actual traffic. These probes act as mediators that can be detected at various hops, allowing the system to map the tunnel's internal structure without decrypting the encrypted payload. The probes carry timing and identification information that enables precise measurement of latency and packet loss through the otherwise opaque tunnel.
Solution Approach 2:
The system changes the parameters of probe packets dynamically - varying TTL values to reach different hops, adjusting packet sizes, and modifying protocol types (ICMP vs UDP). By changing these parameters, the system can elicit responses from different network elements within the tunnel and accurately measure performance metrics at each stage of the encrypted path.
2Reliability
If TCP tunnels are used for encrypted communication, then security is improved, but traceroute tools cannot determine if the destination has been reached or measure processing delay
Solution Approach 1:
The system implements feedback mechanisms where probe packets sent through the TCP tunnel expect specific responses from the destination. By analyzing the presence, timing, and characteristics of these responses, the system can determine whether the destination has been reached and measure the round-trip processing delay. This feedback loop provides visibility into the otherwise opaque TCP tunnel termination.
Solution Approach 2:
The patent replaces the traditional ICMP-based traceroute mechanism with TCP-specific probe mechanisms that can traverse TCP tunnels. Instead of relying on ICMP messages that are blocked or modified by TCP encapsulation, the system uses TCP-compatible probes that maintain the TCP protocol characteristics, allowing them to pass through the encrypted tunnel and reach the destination for accurate reachability detection.
3Measurement precision
If multiple probes are sent to trace network paths through tunnels, then detection accuracy is improved, but traffic surges may occur on destination servers
Solution Approach 1:
The system applies partial action by sending probes selectively rather than continuously at maximum rate. It adjusts the probing intensity based on network conditions and tunnel characteristics, sending enough probes to achieve statistically significant measurements while avoiding excessive traffic that would overload the destination server. This balanced approach maintains detection accuracy while preventing server stress.
Solution Approach 2:
The patent implements periodic probing with variable intervals between probe transmissions. Instead of sending probes at a constant high rate, the system uses periodic action with adaptive timing - increasing intervals when the tunnel is stable and decreasing intervals when re-detection is needed. This periodic approach smooths traffic patterns and prevents sudden surges on destination servers while maintaining accurate network path detection.
Data Source
AI summary
Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include receiving a request from a client to perform a reverse trace; requesting a trace to an endpoint that is one of an egress router and a tunnel client, wherein there is a tunnel between i) the destination and ii) the one of the egress router and the tunnel client; receiving a response to the trace; and sending details associated with the response to the client so that the client aggregates these details with details from one or more additional legs to provide an overall view of a service path between the client and the destination.