Global flow tracking system

• US 8,009,559 B1
• Filed: 08/28/2008
• Issued: 08/30/2011
• Est. Priority Date: 08/28/2008
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Turk, Doughan
• Primary Examiner(s): Ngo; Ricky
• Assistant Examiner(s): SAMUEL, DEWANDA A
• Application Number:
  US12/200,137
• Time in Patent Office: 1,097 Days
• Field of Search: 370/230, 370/235, 370/238, 370/216, 370/252
• US Class Current: 370/230
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A device may obtain a flow signature, identify a destination collector to which packets bearing the flow signature are sent, obtain a list of potential source collectors that may have sent the packets bearing the flow signature to the destination collector, and identify a source collector, among the potential source collectors, that sent the packets to the destination collector. In addition, the device may output information related to a path from the source collector the destination collector.

Claims

1. A system comprising:

a device to;

receive an alarm;

obtain a flow signature from the alarm, where the flow signature is associated with a flow to a destination collector;

obtain a list of potential source collectors based on the flow signature;

use a global routing map and the list of potential source collectors to obtain a list of new potential source collectors;

send flow match requests to determine, among the new potential source collectors, verified collectors with flow records bearing the flow signature;

receive replies that identify the verified collectors; and

identify new source collectors based on identities of the verified collectors and the global routing map.

2. The device of claim 1, where the flow signature includes:

a spoofed source address.

3. The device of claim 1, where the global routing map further is to:

determine a path between a list of the verified collectors and the destination collector.

4. The device of claim 1, where the global routing map includes:

a border gateway protocol (BGP) routing map.

5. The device of claim 1, further comprising:

a web server to a request for tracking the flow to the destination collector.

6. The device of claim 1, where the flow includes:

a packet that participates in a denial of service attack,

a fake email message, or

a spam email message.

7. The device of claim 1, further comprising:

a user interface to show a diagram of the potential source collectors and an autonomous system that includes the potential source collectors.

16. The device of claim 1, where the destination collector includes:

a server;

a gateway;

a switch;

or

a router.

8. A method comprising:

receiving an alarm;

obtaining, from the alarm, a flow signature that is associated with a flow to a destination collector implemented at least partially in hardware;

obtaining a list of potential source collectors, implemented at least partially in hardware, based on the flow signature;

obtaining a list of new potential source collectors based on a global routing map and the list of potential source collectors;

sending flow match requests to determine, among the new potential source collectors, verified collectors with flow records bearing the flow signature;

receiving replies that identify the verified collectors; and

identifying new source collectors based on identities of the verified collectors and the global routing map.

9. The method of claim 8, where obtaining the flow signature includes obtaining one or more parameters that include at least one of:

a source address of the flow,

a destination address of the flow,

a source port number of the flow,

a destination port number of the flow, or

a protocol of the flow.

10. The method of claim 8, where obtaining the list of potential source collectors includes:

looking up, in the global routing map, identities of source collectors that may send packets to the destination collector.

11. The method of claim 8, where obtaining the list of potential source collectors includes:

determining a path that includes the verified collectors and that leads to the destination collector; and

identifying a first one of the verified collectors in the path.

12. The method of claim 11, where determining the path includes:

using the global routing map to determine paths between the verified collectors.

13. The method of claim 11, further comprising:

identifying a device from which the first one of the verified collectors receives packets that belong to the flow; and

preventing the first one of the verified collectors from receiving additional packets from the device.

14. The method of claim 8, where sending the flow match requests includes:

propagating a flow match request to devices to which flow records are exported from collectors.

15. The method of claim 8, further comprising:

receiving a request to identify a device from which packets with the flow signature originated.