Topology discovery of a private network

• US 8,787,207 B2
• Filed: 01/12/2011
• Issued: 07/22/2014
• Est. Priority Date: 02/15/2006
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Feng, FuJen, Chow, Ming
• Primary Examiner(s): Banks Harold, Marsha D
• Assistant Examiner(s): Houshmand, Hooman
• Application Number:
  US13/005,484
• Publication Number:
  US 20110141944A1
• Time in Patent Office: 1,287 Days
• Field of Search: None
• US Class Current: 370/255
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14

Abstract

The present invention relates to a method and system for determining devices connected to a private network through a gateway. A Network Management System (NMS) through the use of inquiries and Port Address Translation (PAT) commands is able to determine the topology of the network of devices within a private network and thus communicate with them. This is achieved through the use of Port Address Translation (PAT) initiated by the NMS to set a port for each device connected to the gateway.

Claims

1. A method, comprising:

receiving, by a network interface, a discovery request from a Network Management System (NMS), wherein the discovery request includes a request to identify a first device of a private network, and wherein the NMS is not part of the private network;

identifying, by a processor, the first device;

transmitting, by the network interface, a first private IP address for the first device to the NMS;

waiting, by the network interface, to receive an access request from the NMS to add a first Port Address Translation (PAT) entry for the first device;

receiving, by the network interface, the access request from the NMS to add the first Port Address Translation (PAT) entry for the first device, wherein the access request includes the first private IP address and designates a first port for communication with the first device;

receiving, by the network interface, a second discovery request from the NMS to identify a second device of the private network known by the first device;

identifying, by the processor, the second device;

waiting, by the network interface, to receive a second access request to add a second PAT entry for the second device;

receiving, by the network interface, the second access request to add the second PAT entry for the second device, wherein the access request includes a second private IP address and designates a second port for communication with the second device;

adding, by the processor, the first PAT entry and the second PAT entry to a translation table, wherein the first PAT entry and the second PAT entry include respective the first private IP address and the second private IP address and respective the first designated port and the second designated port;

communicating, by the network interface, the translation table to the NMS; and

removing, by the processor, the PAT entries.

2. The method of claim 1, wherein the first and second access requests are accompanied by a password, and further comprising verifying, by the processor, the passwords prior to adding the first and second PAT entries to a translation table.

3. The method of claim 1, further comprising searching an access control list or a command authorization list, or combinations thereof upon receipt of the discovery request from the NMS.

4. The method of claim 3, further comprising permitting access only to NMS identified in the access control list or authorized administrators of the gateway device or combinations thereof.

5. The method of claim 4, further comprising permitting commands from the NMS only if the commands are listed in the command authorization list.

6. The method of claim 1, further comprising comparing a first community string value with a second community string value, wherein the second community string value is received in the discovery request.

7. The method of claim 6, further comprising ignoring the discover request when the first community string value and the second community string value do not match.

8. An apparatus, comprising:

a network interface; and

one or more processors, wherein the one or more processors are configured to;

receive, via the network interface, a discovery request from a Network Management System (NMS), wherein the discovery request includes a request to identify a first device of a private network, and wherein the NMS is not part of the private network;

identify the first device;

transmit, via the network interface, a first private IP address for the first device to the NMS;

wait to receive an access request from the NMS to add a first Port Address Translation (PAT) entry for the first device;

receive, via the network interface, the access request from the NMS to add the first Port Address Translation (PAT) entry for the first device, wherein the access request includes the first private IP address and designates a first port for communication with the first device;

receive, via the network interface, a second discovery request from the NMS to identify a second device of the private network known by the first device;

identify the second device;

wait to receive a second access request to add a second PAT entry for the second device;

receive, via the network interface, the second access request to add the second PAT entry for the second device, wherein the access request includes a second private IP address and designates a second port for communication with the second device;

add the first PAT entry and the second PAT entry to a translation table, wherein the first PAT entry and the second PAT entry include respective the first private IP address and the second private IP address and respective the first designated port and the second designated port;

communicate, via the network interface, the translation table to the NMS; and

remove the PAT entries.

9. The apparatus of claim 8, wherein the first and second access requests are accompanied by a password, and wherein the one or more processors are further configured to verify the passwords prior to adding the first and second PAT entries to a translation table.

10. The apparatus of claim 8, wherein the one or more processors are further configured to search an access control list or a command authorization list, or combinations thereof upon receipt of the discovery request from the NMS.

11. The apparatus of claim 10, wherein the one or more processors are further configured to permit access only to NMS identified in the access control list or authorized administrators of the gateway device or combinations thereof.

12. The apparatus of claim 11, wherein the one or more processors are further configured to permit commands from the NMS only if the commands are listed in the command authorization list.

13. The apparatus of claim 8, wherein the one or more processors are further configured to compare a first community string value with a second community string value, wherein the second community string value is received in the discovery request.

14. The apparatus of claim 13, wherein the one or more processors are further configured to ignore the discover request when the first community string value and the second community string value do not match.