Identifying network flows under network address translation

#The present disclosure relates generally to the field of identifying network flows (e.g., IP flows) under network address translation.

#In various examples, identifying network flows (e.g., IP flows) under network address translation may be implemented in the form of methods and/or algorithms.

#Identifying the IP flows, that is, associating the individual IP packets with particular end-to-end flow (e.g., defined by 5-tuples), is one of the fundamental components in many tasks performed within IP networks (such tasks typically include analytics, network monitoring and management, intrusion detection, and other in-network packet processing). A common aspect of these tasks is that per-flow information needs to be gathered and analyzed through the inspection and processing of individual packets going through the processing elements deployed inside the network. In many of these applications, however, the in-network processing elements are deployed in multiple points in the network, where the results of the processing at different points need to be aggregated or matched between each other for further processing (necessitating the need to identify and match the flow that individual packets belong to when they are observed in different points in the network).

#Various objects, features and advantages of the present invention will become apparent to one skilled in the art, in view of the following detailed description taken in combination with the attached drawings, in which:

#FIG. 1 depicts a block diagram of a processing technique according to an embodiment of the present invention.

#FIG. 2 depicts a block diagram of a processing technique according to an embodiment of the present invention.

#For the purposes of description the term “real-time” is intended to refer to cause and effect occurring approximately contemporaneously in time (e.g., without significant time lag between cause and effect but not necessarily instantaneously).

#For the purposes of description, the term “observation point” is intended to refer to a physical location in a network where a packet can be obtained.

#As described herein, mechanisms are provided for identifying and matching IP flows of IP packets observed at multiple locations in a network (where the addresses and/or port numbers of the packets are altered by NAT device(s) located between a plurality of observation points (sometimes referred to herein as “OPs”)). In one example, the mechanisms operate by inferring the mapping (or “alteration”) of the addresses (or 5-tuple in general) of the packets by the NAT device(s) from one address space to another, through the use of information contained in other fields of the packets (e.g., other fields of the headers and/or the payloads) that are not altered by the NAT device(s). Packet processing elements (sometimes referred to herein as “PPEs”) at different observation points extract the information from invariant fields from the packets they observe, and exchange the information with each other to match different addresses of the same IP flow seen by each PPE. The PPEs may also identify the mapping performed by NAT device(s) between them.