Method and apparatus for fingerprinting systems and operating systems in a network

• US 20090182864A1
• Filed: 01/15/2008
• Published: 07/16/2009
• Est. Priority Date: 01/15/2008
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Batten, Gerald, Sun, Yong, Khan, Faud
• Granted Patent: US 9,451,036 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method for identifying the number of computer hosts and types of operating systems behind a network address translation is provided. The method includes processing an internet protocol packet associated with the host computer system. The process may involve capturing the internet protocol packet and extracting key fields from the internet protocol packet to produce a fingerprint. The method continues with analyzing the fields in order to determine if a network address translator is connected between the host computer and a public network (e.g. the internet). If there is a network address translator connected, fields may be analyzed in order to determine the number of computers using the network address translator. The fields may also be analyzing in order to determine with a level of probability that the fingerprint identifies the correct operating system running the host computers. Generally, the internet protocol packet that is analyzing will be captured from an aggregation point in the carrier network.

Claims

1. A method for identifying the number of computers and types of operating systems behind a network address translation comprising:

processing an internet protocol packet associated with at least one host computer system including capturing said internet protocol packet and extracting fields from said internet protocol packet to produce a fingerprint;

analyzing said fields to determine if an associated network address translator is connected between said at least one host computer and a network;

if said network address translator is connected, analyzing said fields to determine the number of computers using said associated network address translator; and

analyzing said fields to determine with a level of probability that said fingerprint identifies the operating systems running said at least one computer.

2. The method according to claim 1, further comprising processing update requests from said operating system in order to further define said level of probability.

3. The method according to claim 1, further comprising accessing application data in order to further define said level of probability.

4. The method according to claim 1, further comprising recording user information into a user index table and generating a user index profile for said user index table if a user has not be previously fingerprinted.

5. The method according to claim 1, wherein analyzing said field includes comparing captured values from said internet protocol packet to values stored for known operating systems.

6. The method according to claim 5, wherein comparing captured values includes accessing an operating system fingerprint table.

7. The method according to claim 5, wherein comparing captured values include utilizing a logic tree.

8. The method according to claim 5, wherein comparing values includes utilizing hashed values.

9. A method of analyzing traffic comprising:

capturing a packet from a data path between a host and a network;

extracting application data, update request information and operating system key fields from said packet;

if a network address translation is providing access to said network, determining the number of hosts associated with said network address translation;

accessing operating system key fields in order to perform a transmission control protocol fingerprint;

if said transmission control protocol fingerprint is not positive, using application data in order to perform an application fingerprint; and

if said application fingerprint is not positive, redefining said application fingerprint using update request data.

10. The method according to claim 9, wherein said operating system key fields include a time differential.

11. The method according to claim 9, wherein said operating system key fields include an internet protocol identifier.

12. The method according to claim 9, further comprising accessing a user index table for verification that the user identification'"'"'s operating system has not previously been verified.

13. The method according to claim 9, wherein said fingerprint is positive if it has a substantially 100% probability of identifying an operating system.

14. A system for identifying the number of computers and types of operating systems behind a network address translation comprising:

a network user fingerprinter configured to capture internet protocol packets used in obtaining a fingerprint;

an extraction module adapted to obtain update request data, application information and key fields from said internet protocol packets; and

a processer configured to analyze the Time To Live (TTL) number from said key fields of said internet protocol packets and determine the presence of a network address translation device.

15. The system according to claim 14, wherein said network user fingerprinter is further adapted to focus on traffic at a network traffic aggregation point.

16. The system according to claim 15, where said aggregation point is located between said network address translation device and an associated public network.

17. The system according to claim 16, wherein said processor is further configured to determine the number of hosts utilizing said network address translation device.

18. The system according to claim 14, further comprising a snoop table adapted to store captured information relating to operating systems that are used in obtaining said fingerprint.

19. The system according to claim 14, further comprising an operating system fingerprint table including stored values for known operating systems which is adapted to be dynamic and used for comparisons, while obtaining said fingerprint.

20. The system according to claim 14, further comprising a user index table configured to store said internet protocol packet'"'"'s closest matching operating system and probability of accuracy derived from said fingerprint.