METHOD AND SYSTEM FOR DETECTION OF NAT DEVICES IN A NETWORK

• US 20090175197A1
• Filed: 05/24/2007
• Published: 07/09/2009
• Est. Priority Date: 07/24/2006
• Status: Active Grant

• Current Assignee: ForeScout Technologies Incorporated
• Original Assignee: ForeScout Technologies Incorporated
• Inventors: Nechushtan, Oren, Friedrich, Gil, Comay, Oded
• Granted Patent: US 8,254,286 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Disclosed is a device, system and method for detecting a Network Address Translation (“NAT”) gateway on a network. According to some embodiments of the present invention a detector including a network communication module may transmit one or more interrogation packets to a suspected NAT gateway.

Claims

1. A Network Address Translation (“

NAT”

) Gateway detector comprising;

a network communication module adapted to transmit one or more interrogation packets to a suspected NAT gateway, wherein the one or more interrogation packets are adapted to emulate a packet of a session in which the suspected NAT gateway is engaged.

2. The detector according to claim 1, wherein said communication module is further adapted to monitor one or more data packets associated with a communication session in which the suspected NAT gateway engages.

4. The detector according to claim 1, wherein the one or more interrogation packets are constructed such that there is no effect on the end-points of the session with which the packets are associated.

5. The detector according to claim 1, wherein the one or more interrogation packets have a Time-To-Live (“

TTL”

) field correlated with a topological distance between said detector and the suspected NAT gateway.

6. The detector according to claim 5, further comprising a NAT designation unit adapted to designate a suspected NAT gateway as an actual NAT gateway upon said detector receiving an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet from a suspected NAT gateway in response to an interrogation packet.

7. The detector according to claim 1, wherein the Time To Live (TTL) field of the one or more interrogation packets are modified as each successive packet is sent until the TTL field value reaches a predefined limit or an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet is received from the suspected NAT gateway.

8. The detector according to claim 7, further comprising a communication module adapted to receive a response from a suspected NAT gateway.

9. The detector according to claim 2, further comprising a NAT designation unit adapted to designate a suspected NAT gateway as an actual NAT gateway.

10. The detector according to claim 9, wherein said NAT designation unit is adapted to designate a suspected NAT gateway as an actual NAT gateway said upon detecting an ICMP Time Exceeded packet from a suspected NAT gateway in response to an interrogation packet.

11. The detector according to claim 1, wherein the one or more interrogation packets are IP client response solicitation packets.

12. The detector according to claim 11, further comprising a NAT designation unit adapted to designate a suspected NAT gateway as an actual NAT gateway.

13. The detector according to claim 12, wherein said NAT designation unit is adapted to designate a suspected NAT gateway as an actual NAT gateway upon said detector not receiving a response to an IP client response solicitation packets sent to a suspected NAT gateway.

3. (canceled)

14. A method for Network Address Translation (“

NAT”

) Gateway detection comprising;

transmitting one or more interrogation packets to a suspected NAT gateway; and

adapting one or more of said interrogation packets to emulate a packet of a session in which the suspected NAT gateway is engaged.

15. The method according to claim 14, further comprising monitoring one or more data packets associated with a communication session in which the suspected NAT gateway engages.

17. The method according to claim 14, wherein the one or more interrogation packet are constructed such that there is no effect on the end-points of the session with which the packets are associated.

18. The method according to claim 14, wherein the one or more interrogation packets have a Time-To-Live (“

TTL”

) field correlated with a topological distance between said detector and the suspected NAT gateway.

19. The method according to claim 18, further comprising designating a suspected NAT gateway as an actual NAT gateway upon receiving an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet from a suspected NAT gateway in response to an interrogation packet.

20. The method according to claim 14, wherein the Time To Live (TTL) field of the one or more interrogation packets are incremented as each successive packet is sent until the TTL field value reaches a predefined limit or an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet is received from the suspected NAT gateway.

21. The method according to claim 20, further comprising receiving a response from a suspected NAT gateway.

22. The method according to claim 21, further comprising designating a suspected NAT gateway as an actual NAT gateway upon receiving an ICMP Time Exceeded packet from a suspected NAT gateway in response to an interrogation packet.

23. The method according to claim 14, wherein the one or more interrogation packets are IP client response solicitation packets.

24. The method according to claim 23, further comprising designating a suspected NAT gateway as an actual NAT gateway upon not receiving a response to an IP client response solicitation packet sent to a suspected NAT gateway.

16. (canceled)