Cross-Middlebox Traffic Flow Stitching for Network Diagnostics

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current network traffic monitoring systems fail to gather comprehensive data on network traffic flows passing through multiple middleboxes, treating the network environment between servers and clients as a 'black box, which leads to gaps in data and deficiencies in diagnosing issues, such as incorrectly configured middleboxes or policy enforcement.

Innovation Solution

A method and system for stitching together traffic flow segments across multiple middleboxes by collecting flow records with transaction identifiers, identifying sources and destinations, and stitching these segments to form cross-middlebox stitched traffic flows, providing more detailed network traffic data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If sensors gather network traffic data only at client and server levels, then the monitoring system is simple and easy to operate, but the network traffic data is incomplete and cannot diagnose problems at middleboxes

Engineering Contradiction:
Improvenetwork traffic data completenessVSAvoidmonitoring system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the network traffic monitoring into multiple parts: client-level sensors, server-level sensors, and middlebox-level sensors. Each segment collects traffic flow data independently, and the system stitches these segments together to form complete traffic flow paths. This segmentation allows precise measurement at each node while maintaining manageable complexity through modular deployment.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary stitching system that collects traffic flow data from multiple sensors and reconstructs complete traffic flows by matching segments across middleboxes. This intermediary component enables comprehensive monitoring without requiring complex integration at each sensor node, resolving the contradiction between measurement precision and system complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Loss of information

If the network environment between servers and clients is treated as a black box, then the monitoring system is simple, but gaps in network traffic data prevent accurate diagnosis of middlebox issues

Engineering Contradiction:
Improvenetwork traffic data gapsVSAvoidmiddlebox problem detection difficulty
Core Design Contradiction:
Loss of informationVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements preliminary action by deploying sensors at middleboxes to collect traffic flow data before it reaches the destination. This allows the system to capture traffic segments at each middlebox, which are then stitched together to reconstruct complete traffic paths. The preliminary data collection prevents information loss and enables accurate diagnosis of middlebox configuration issues.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If sensors are deployed at multiple middleboxes to gather complete traffic flow data, then network traffic data completeness improves, but system complexity and deployment difficulty increase

Engineering Contradiction:
Improvenetwork monitoring accuracyVSAvoidsensor deployment complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent creates a universal sensor design that can be deployed at any network node (client, server, or middlebox) with the same basic functionality. The sensor collects standardized traffic flow data regardless of location, and the stitching system universally processes all segments. This multi-functionality approach improves monitoring reliability while reducing deployment complexity through standardized components.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3744073B1Discovery of middleboxes using traffic flow stitching
Publication Date: 2022.11.09 CISCO TECHNOLOGY INC
  • EP3744073B1 patent drawingFigure 1
  • EP3744073B1 patent drawingFigure 2
  • EP3744073B1 patent drawingFigure 3

AI summary

Systems, methods, and computer-readable media for flow stitching network traffic flow segments across middleboxes. A method can include collecting flow records of traffic flow segments at a first middlebox and a second middlebox in a network environment including one or more transaction identifiers assigned to the traffic flow segments. Sources and destinations of the traffic flow segments can be identified with respect to the first middlebox and the second middlebox. Corresponding subsets of the traffic flow segments can be stitched together to from a first stitched traffic flow at the first middlebox and a second stitched traffic flow at the second middlebox. The first and second stitched traffic flows can be stitched together to form a cross-middlebox stitched traffic flow across the first middlebox and the second middlebox. The cross-middlebox stitched traffic flow can be incorporated as part of network traffic data for the network environment.