Establishing a split-terminated communication connection through a stateful firewall, with network transparency

• US 7,984,160 B2
• Filed: 03/05/2009
• Issued: 07/19/2011
• Est. Priority Date: 03/05/2009
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Lam, Blanco Zee Leung
• Primary Examiner(s): WON, MICHAEL YOUNG
• Application Number:
  US12/398,898
• Publication Number:
  US 20100228867A1
• Time in Patent Office: 866 Days
• Field of Search: 709/203, 709/225, 709/227
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method and apparatus are provided for establishing a split-terminated client-server communication connection through a stateful firewall, with network transparency. In an environment in which a pair of network intermediaries is employed to optimize client-server communications, a first intermediary intercepts a client request for a new connection. The first intermediary probes the network for a counterpart near the server, and opens an optimized communication session with a second intermediary that responds affirmatively. Some or all client-server communications that transit the intermediaries'"'"' session are accelerated or otherwise optimized. The first intermediary'"'"'s probe uses the client'"'"'s source address, but a different port number, while the optimized intermediary session is opened using the client'"'"'s source address and source port. Therefore, a network monitoring tool can monitor the end-to-end connection, and the stateful firewall will not reject the optimized session.

Claims

1. A method of establishing a network transparent communication connection between a client and a server through a stateful firewall and a pair of network intermediaries configured to optimize communications between the client and the server, the method comprising:

receiving from the client a first request to initiate a connection with the server, wherein the first request comprises a source address and a first source port of the client;

storing the first request in a temporary storage device;

transmitting a probe toward the server, said probe comprising a second request to initiate a connection with the server; and

after receipt of a response to said probe, transmitting a third request to initiate a connection;

wherein the second request comprises;

the source address and a second source port different from the first source port; and

a first tag; and

wherein the third request comprises;

the source address and the first source port; and

a second tag different from the first tag.

2. The method of claim 1, wherein said receiving, said storing, said transmitting a probe and said transmitting a third request are performed by a first network intermediary in the pair of network intermediaries.

3. The method of claim 2, further comprising, at a second network intermediary in the pair of network intermediaries:

intercepting the probe;

recognizing the first tag as signifying a test to determine whether the second intermediary is active; and

responding to the probe to indicate that the second intermediary is active.

4. The method of claim 3, wherein the response to the probe comprises the first tag.

5. The method of claim 3, further comprising at the second network intermediary:

intercepting the third request;

recognizing the second tag as signifying a request for an optimized communication session; and

responding to the third request to establish the optimized communication session between the first network intermediary and the second network intermediary.

6. The method of claim 5, wherein:

the first request, the second request and the third request comprise TCP (Transport Control Protocol) SYN packets; and

the response to the probe and the response to the third request comprise SYN/ACK packets.

7. The method of claim 5, wherein the network transparent connection between the client and the server comprises:

a first communication session between the client and the first network intermediary;

the optimized communication session between the first network intermediary and the second network intermediary; and

a second communication session between the second network intermediary and the server.

8. The method of claim 1, wherein:

the first request to initiate a connection with the server comprises a first initial sequence number; and

the second request to initiate a connection with the server comprises a second initial sequence number out of range from the first initial sequence number.

9. The method of claim 8, wherein the third request to initiate a connection with the server comprises a third initial sequence number out of range from the first initial sequence number.

10. A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of establishing a network transparent communication connection between a client and a server through a stateful firewall and a pair of network intermediaries configured to optimize communications between the client and the server, the method comprising:

receiving from the client a first request to initiate a connection with the server, wherein the first request comprises a source address and a first source port of the client;

storing the first request in a temporary storage device;

transmitting a probe toward the server, said probe comprising a second request to initiate a connection with the server; and

after receipt of a response to said probe, transmitting a third request to initiate a connection;

wherein the second request comprises;

the source address and a second source port different from the first source port; and

a first tag; and

wherein the third request comprises;

the source address and the first source port; and

a second tag different from the first tag.

11. In a network comprising:

a client;

a server;

a first network intermediary and a second network intermediary operating between the client and the server; and

a firewall operating between the first network intermediary and the second network intermediary;

a method of establishing a network-transparent connection between the client and the server, the method comprising;

receiving from a client, at the first network intermediary, a first request for a communication connection with the server, wherein;

a source address of the first request comprises a source address of the client; and

a source port of the first request comprises a source port of the client;

temporarily storing the first request;

transmitting from the first network intermediary toward the server a test request for a communication connection to determine whether the second network intermediary is active, wherein;

a source address of the test request comprises the source address of the client; and

a source port of the test request comprises a source port different from the source port of the client; and

if the second network intermediary is determined to be active, transmitting from the first network intermediary a request for an optimized connection, wherein;

a source address of the request for an optimized connection comprises the source address of the client; and

a source port of the request for an optimized connection comprises the source port of the client.

12. The method of claim 11, wherein:

the test request is marked with a first tag that is recognizable to the second intermediary as indicating a test request, but is not recognizable to the server as indicating a test request; and

the request for an optimized connection is marked with a second tag that is recognizable to the second intermediary as indicating a request for an optimized connection, but is not recognizable to the server as indicating a request for an optimized connection.

13. The method of claim 12, wherein the second network intermediary is determined to be active if the first network intermediary receives, in response to the test request, a return communication that includes the first tag.

14. The method of claim 11, further comprising:

in response to the first request, establishing a first communication session between the client and the first network intermediary;

establishing the optimized communication session between the first network intermediary and the second network intermediary; and

establishing a second communication session between the second network intermediary and the server;

wherein the network-transparent connection between the client and the server comprises the first communication session, the second communication session and the optimized communication session.

15. The method of claim 11, further comprising:

configuring the test request for a communication connection with an initial TCP (Transport Control Protocol) sequence number out of range from an initial TCP sequence number of the first request for a communication connection.

16. The method of claim 15, further comprising:

configuring the request for an optimized connection with an initial TCP sequence number out of range from the initial TCP sequence number of the first request for a communication connection.

17. The method of claim 11, wherein the source port of the test request is calculated by adding a fixed number to the client source port.

18. The method of claim 11, wherein the test request comprises a TCP (Transport Control Protocol) SYN packet, the method further comprising:

terminating the test request connection according to the TCP protocol.