Ingress Router Identification in Service Provider VPN Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In service provider networks, identifying the path and destination of VPN packets is challenging due to non-unique unroutable IP addresses and changing MPLS labels, making it difficult for network operators to trace issues, perform capacity planning, and determine affected customers during maintenance.
Innovation Solution
A system and method that uses a map of route target identifiers to customer names, combined with BGP-VPN and IGP information, to identify the path and ingress/egress routers of VPN packets without retrieving traffic information from PE routers, even if the ingress router is unknown, by timestamping and recording BGP-VPN and IGP messages and using NET FLOW information to associate packets with customer names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the router uses destination IP address to determine next hop, then routing is simple, but network analysis cannot identify the entire path through the service provider network
Solution Approach 1:
The patent segments the routing information by maintaining separate forwarding tables: one for simple next-hop routing decisions and another for complete path analysis. The forwarding table stores not only next-hop information but also the full egress path through the service provider network, allowing routing to remain simple while path identification becomes possible through table lookup.
Solution Approach 2:
The patent introduces a forwarding table as an intermediary data structure that bridges the gap between simple routing and complete path identification. This table acts as a mediator that translates destination IP addresses into both next-hop information and complete egress paths, enabling both routing simplicity and path traceability.
2Adaptability or versatility
If MPLS labels are used for VPN packet routing, then VPN traffic can be routed through the service provider network, but the changing labels make it difficult to determine the exact path
Solution Approach 1:
The patent creates a copy of the routing information in the forwarding table that is independent of the changing MPLS labels. Instead of relying on the transient label stack to identify the path, the system maintains a stable copy of the egress path information that can be queried at any point in the network, decoupling path identification from the dynamic label switching process.
3Measurement precision
If traffic information is retrieved from all PE routers to identify ingress router, then accurate identification is possible, but network performance is significantly affected
Solution Approach 1:
The patent extracts the path identification functionality from the PE routers themselves and places it in a separate analysis system. The PE routers only need to populate the forwarding table with egress path information, while the actual path analysis and ingress router identification is performed by querying this pre-populated table, eliminating the need for continuous traffic information retrieval from all PE routers.
4Measurement precision
If the system stores complete path information for all flows, then accurate analysis is possible, but storage requirements increase significantly
Solution Approach 1:
The forwarding table is designed as a universal data structure that serves multiple functions: it enables simple next-hop routing, provides complete egress path information for analysis, and supports both VPN and non-VPN traffic. This multi-functionality eliminates the need for separate storage structures for different types of path information, reducing overall storage requirements while maintaining comprehensive path analysis capability.
Data Source
AI summary
A system and method collects information for VPN traffic from non edge routers that are coupled to edge routers and identifies the path the traffic took and the customer corresponding to the VPN. The system and method also identifies the ingress router coupled to the non edge router from which the traffic was collected. The system and method may assign identifiers to route targets.