Method and system for detection of NAT devices in a network

• US 8,254,286 B2
• Filed: 05/24/2007
• Issued: 08/28/2012
• Est. Priority Date: 07/24/2006
• Status: Active Grant

• Current Assignee: ForeScout Technologies Incorporated
• Original Assignee: ForeScout Technologies Incorporated
• Inventors: Nechushtan, Oren, Friedrich, Gil, Comay, Oded
• Primary Examiner(s): Wilson, Robert
• Assistant Examiner(s): Zhao, Wei
• Application Number:
  US12/162,807
• Publication Number:
  US 20090175197A1
• Time in Patent Office: 1,923 Days
• Field of Search: 370/389, 370/338, 370/254, 726/23
• US Class Current: 370/254
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Disclosed is a device, system and method for detecting a Network Address Translation (“NAT”) gateway on a network. According to some embodiments of the present invention a detector including a network communication module may transmit one or more interrogation packets to a suspected NAT gateway.

Claims

1. A Network Address Translation (“

NAT”

) Gateway detector comprising;

a network communication module to generate and transmit over a wired network one or more interrogation packets to an external side of a suspected NAT gateway, wherein the one or more interrogation packets are generated to emulate a packet of a current session in which the suspected NAT gateway is engaged and transmitted with a Time to Live (TTL) field selected to expire upon arrival of the packet at the suspected gateway, and wherein said communication module monitors responses sent by the suspected NAT gateway over the wired network.

2. The detector according to claim 1, wherein said communication module monitors one or more data packets associated with a communication session in which the suspected NAT gateway engages.

3. The detector according to claim 1, wherein the one or more interrogation packets are constructed such that there is no effect on the end-points of the session with which the packets are associated.

4. The detector according to claim 1, wherein the one or more interrogation packets have a Time-To-Live (“

TTL”

) field correlated with a topological distance between said detector and the suspected NAT gateway.

5. The detector according to claim 1, further comprising a NAT designation unit to designate the suspected NAT gateway as an actual NAT gateway upon said detector receiving an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet from the suspected NAT gateway in response to an interrogation packet.

6. The detector according to claim 1, wherein the Time To Live (TTL) field of the one or more interrogation packets are increased as each successive packet is sent until the TTL field value reaches a predefined limit or an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet is received from the suspected NAT gateway.

7. The detector according to claim 1, further comprising a communication module to receive responses from the suspected NAT gateway.

8. The detector according to claim 1, further comprising a NAT designation unit to designate the suspected NAT gateway as an actual NAT gateway.

9. The detector according to claim 8, wherein said NAT designation unit designates the suspected NAT gateway as an actual NAT gateway upon detecting an ICMP Time Exceeded packet from said suspected NAT gateway in response to an interrogation packet.

10. The detector according to claim 8, wherein said NAT designation unit designates a given suspected NAT gateway as an actual NAT gateway upon said detector not receiving a response to an IP client response solicitation packet sent to the given suspected NAT gateway.

11. A method for Network Address Translation (“

NAT”

) Gateway detection comprising;

generating and transmitting over a wired network one or more interrogation packets to an external side of a suspected NAT gateway;

wherein one or more of said interrogation packets are generated to emulate a packet of a current session in which the suspected NAT gateway is engaged and are transmitted with a Time to Live (TTL) field selected to expire upon arrival of the packet at the suspected gateway; and

monitoring responses sent by the suspected NAT gateway over the wired network.

12. The method according to claim 11, further comprising monitoring one or more data packets associated with a communication session in which the suspected NAT gateway engages.

13. The method according to claim 11, wherein the one or more interrogation packet are constructed such that there is no effect on the end-points of the session with which the packets are associated.

14. The method according to claim 11, wherein the one or more interrogation packets have a Time-To-Live (“

TTL”

) field correlated with a topological distance between said detector and the suspected NAT gateway.

15. The method according to claim 11, further comprising designating the suspected NAT gateway as an actual NAT gateway upon receiving an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet from the suspected NAT gateway in response to an interrogation packet sent to the suspected NAT gateway.

16. The method according to claim 11, wherein the Time To Live (TTL) field of the one or more interrogation packets are incremented as each successive packet is sent until the TTL field value reaches a predefined limit or an Internet Control Messaging Protocol (“

ICMP”

) Time Exceeded packet is received from the suspected NAT gateway.

17. The method according to claim 16, further comprising receiving a response from the suspected NAT gateway.

18. The method according to claim 17, further comprising designating the suspected NAT gateway as an actual NAT gateway upon receiving an ICMP Time Exceeded packet from the suspected NAT gateway in response to an interrogation packet sent to the suspected NAT gateway.

19. The method according to claim 11, further comprising designating the suspected NAT gateway as an actual NAT gateway upon not receiving a response to an IP client response solicitation packet sent to the suspected NAT gateway.