# US 11,451,585 B2 · Anti-spoof check of IPv4-in-IPv6 fragments without reassembly > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,585 B2 - Document ID: US11451585B2 - Status: Granted - Kind: B2 - Application number: 16/682,882 - Filed: 2019-11-13 - Published: 2021-05-13 - Granted: 2022-09-20 - Earliest claimed: 2019-11-13 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Ashish Suresh Ghule; Jagadish Narasimha Grandhi - Web page: https://patentgrep.com/patent/US11451585B2 ## CPC - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/02: Topology update or discovery - H04L 45/72: {Routing based on the source address} - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 49/90: Buffering arrangements - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 69/22: Parsing or analysis of headers - H04L 2101/686: using dual-stack hosts, e.g. in Internet protocol version 4 [IPv4]/Internet protocol version 6 [IPv6] networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network device may receive, from a first network, one or more fragments of a first network packet of a first network packet type, where the first network packet encapsulates a second network packet of a second network packet type. The network device may buffer the one or more fragments in. The network device may, upon receiving a fragment of the first network packet that includes an indication of a source network address and a source port for the second network packet, perform an anti-spoof check of the fragment flow without assembling the first network packet. The network device may, based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet: assemble the first network packet, decapsulate the second network packet from the assembled first network packet, and forward, to a second network, the second network packet. ## Claims ### Claim 1 A method comprising: receiving, by a network device from a first network, one or more fragments of a first network packet of a first network packet type, wherein the one or more fragments of the first network packet are part of a fragment flow, and wherein the first network packet encapsulates a second network packet of a second network packet type; in response to determining that the network device has not yet received a fragment of the first network packet that includes indications of a source network address and a source port for the second network packet, buffering, by the network device, the one or more fragments; in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, performing, by the network device, an anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet without assembling the first network packet; subsequent to performing the anti-spoof check on the fragment flow, receiving, by the network device, a second one or more fragments of the first network packet; based on the fragment flow passing the anti-spoof check, buffering, by the network device, the second one or more fragments of the first network packet in the fragment buffer without performing the anti-spoof check on any of the second one or more fragments of the first network packet; and based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet: assembling, by the network device, the first network packet, decapsulating, by the network device, the second network packet from the assembled first network packet, and forwarding by the network device to a second network, the second network packet. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, by the network device from the first network, one or more fragments of a third network packet of the first network packet type, wherein the one or more fragments of the third network packet are part of a second fragment flow, and wherein the third network packet encapsulates a fourth network packet of the second network packet type; in response to determining that the network device has not yet received a fragment of the third network packet that includes indications of a source network address and a source port for the fourth network packet, buffering, by the network device, the one or more fragments of the second fragment flow; in response to receiving the fragment of the third network packet that includes the indications of the source network address and the source port for the fourth network packet, performing, by the network device, an anti-spoof check of the second fragment flow based at least in part on the source network address and the source port for the fourth network packet without assembling the third network packet; and based on the second fragment flow failing the anti-spoof check, dropping all fragments of the second fragment flow without assembling the third network packet. ### Claim 3 (depends on 1) The method of claim 1, further comprising: in response to receiving an initial fragment of the first network packet, creating, by the network device, an entry associated with the fragment flow in a flow table; in response to determining that the one or more fragments of the first network packet do not include the fragment of the fragment flow that includes the indication of the source port of the network packet of the second network packet type, transitioning, by the network device the fragment flow to a buffer state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the buffer state, wherein the buffer state indicates that the network device has not yet received the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet; and in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, transitioning, by the network device, the fragment flow from the buffer state to a spoof status available state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the spoof status available state, wherein the spoof status available state indicates that the network device is able to perform the anti-spoof check on the fragment of the first network packet that includes the indications of a source network address and source port for the second network packet to determine whether the fragment flow passes the anti-spoof check. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining, by the network device, that the fragment of the first network packet includes the indications of the source network address and the source port for the second network packet based at least in part on a value of a fragment offset field in a fragment header of the fragment. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, by the network device, an acceptable range of values for the source network address and the source port based at least in part on a network address of the first network packet, wherein performing the anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet includes determining, by the network device, whether the source network address and the source port for the second network packet are within the acceptable range of values. ### Claim 6 (depends on 1) The method of claim 1, wherein: the first network packet of the first network packet type is an Internet Protocol version 6 (IPv6) network packet; the second network packet of the second network packet type is an Internet Protocol version 4 (IPv4) network packet; the first network is an IPv6 network; and the second network is an IPv4 network. ### Claim 7 A network device comprising: one or more network interfaces configured to receive, from a first network, one or more fragments of a first network packet of a first network packet type, wherein the one or more fragments of the first network packet are part of a fragment flow, and wherein the first network packet encapsulates a second network packet of a second network packet type; and one or more processors configured to: in response to determining that the one or more network interfaces has not yet received a fragment of the first network packet that includes indications of a source network address and a source port for the second network packet, buffer the one or more fragments; in response to the one or more network interfaces receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, perform an anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet without assembling the first network packet; wherein the one or more network interfaces are further configured to, subsequent to the one or more processors performing the anti-spoof check on the fragment flow, receive a second one or more fragments of the first network packet; wherein the one or more processors are further configured to: based on the fragment flow passing the anti-spoof check, buffer the second one or more fragments of the first network packet in the fragment buffer without performing the anti-spoof check on any of the second one or more fragments of the first network packet; and based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet: assemble the first network packet, and decapsulate the second network packet from the assembled first network packet; wherein the one or more network interfaces are further configured to forward the second network packet to a second network. ### Claim 8 (depends on 7) The network device of claim 7, wherein: the one or more network interfaces are further configured to receive, from the first network, one or more fragments of a third network packet of the first network packet type, wherein the one or more fragments of the third network packet are part of a second fragment flow, and wherein the third network packet encapsulates a fourth network packet of the second network packet type; the one or more processors are further configured to: in response to determining that the network device has not yet received a fragment of the third network packet that includes indications of a source network address and a source port for the fourth network packet, buffer the one or more fragments of the second fragment flow; in response to receiving the fragment of the third network packet that includes the indications of the source network address and the source port for the fourth network packet, perform an anti-spoof check of the second fragment flow based at least in part on the source network address and the source port for the fourth network packet without assembling the third network packet; and based on the second fragment flow failing the anti-spoof check, drop all fragments of the second fragment flow without assembling the third network packet. ### Claim 9 (depends on 7) The network device of claim 7, wherein the one or more processors are further configured to: in response to the one or more network interfaces receiving an initial fragment of the first network packet, create an entry associated with the fragment flow in a flow table; in response to determining that the one or more fragments of the first network packet do not include the fragment of the fragment flow that includes the indication of the source port of the network packet of the second network packet type, transition the fragment flow to a buffer state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the buffer state, wherein the buffer state indicates that the network device has not yet received the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet; and in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, transition the fragment flow from the buffer state to a spoof status available state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the spoof status available state, wherein the spoof status available state indicates that the network device is able to perform the anti-spoof check on the fragment of the first network packet that includes the indications of a source network address and source port for the second network packet to determine whether the fragment flow passes the anti-spoof check. ### Claim 10 (depends on 7) The network device of claim 7, wherein the one or more processors are further configured to determine that the fragment of the first network packet includes the indications of the source network address and the source port for the second network packet based at least in part on a value of a fragment offset field in a fragment header of the fragment. ### Claim 11 (depends on 7) The network device of claim 7, wherein the one or more processors are further configured to determine an acceptable range of values for the source network address and the source port based at least in part on a network address of the first network packet, wherein to perform the anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet the one or more processors are further configured to determine whether the source network address and the source port for the second network packet are within the acceptable range of values. ### Claim 12 (depends on 7) The network device of claim 7, wherein: the first network packet of the first network packet type is an Internet Protocol version 6 (IPv6) network packet; the second network packet of the second network packet type is an Internet Protocol version 4 (IPv4) network packet; the first network is an IPv6 network; and the second network is an IPv4 network. ### Claim 13 A computer-readable medium comprising instructions for causing a programmable processor to: receive, from a first network, one or more fragments of a first network packet of a first network packet type, wherein the one or more fragments of the first network packet are part of a fragment flow, and wherein the first network packet encapsulates a second network packet of a second network packet type; in response to determining that a fragment of the first network packet that includes indications of a source network address and a source port for the second network packet has not yet been received, buffer the one or more fragments; in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, perform an anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet without assembling the first network packet; subsequent to performing the anti-spoof check on the fragment flow, receive a second one or more fragments of the first network packet; based on the fragment flow passing the anti-spoof check, buffer the second one or more fragments of the first network packet in the fragment buffer without performing the anti-spoof check on any of the second one or more fragments of the first network packet; and based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet: assemble the first network packet, decapsulate the second network packet from the assembled first network packet, and forward, to a second network, the second network packet. ### Claim 14 (depends on 13) The computer-readable medium of claim 13, wherein the instructions cause the programmable processor to: receive, from the first network, one or more fragments of a third network packet of the first network packet type, wherein the one or more fragments of the third network packet are part of a second fragment flow, and wherein the third network packet encapsulates a fourth network packet of the second network packet type; in response to determining that the network device has not yet received a fragment of the third network packet that includes indications of a source network address and a source port for the fourth network packet, buffer the one or more fragments of the second fragment flow; in response to receiving the fragment of the third network packet that includes the indications of the source network address and the source port for the fourth network packet, perform an anti-spoof check of the second fragment flow based at least in part on the source network address and the source port for the fourth network packet without assembling the third network packet; and based on the second fragment flow failing the anti-spoof check, drop all fragments of the second fragment flow without assembling the third network packet. ### Claim 15 (depends on 13) The computer-readable medium of claim 13, wherein the instructions cause the programmable processor to: in response to receiving an initial fragment of the first network packet, create an entry associated with the fragment flow in a flow table; in response to determining that the one or more fragments of the first network packet do not include the fragment of the fragment flow that includes the indication of the source port of the network packet of the second network packet type, transition the fragment flow to a buffer state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the buffer state, wherein the buffer state indicates that the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet has not yet been received; and in response to receiving the fragment of the first network packet that includes the indications of the source network address and the source port for the second network packet, transition the fragment flow from the buffer state to a spoof status available state by updating the entry for the fragment flow in the flow table to indicate that the fragment flow is in the spoof status available state, wherein the spoof status available state indicates that the network device is able to perform the anti-spoof check on the fragment of the first network packet that includes the indications of a source network address and source port for the second network packet to determine whether the fragment flow passes the anti-spoof check. ### Claim 16 (depends on 13) The computer-readable medium of claim 13, wherein the instructions cause the programmable processor to: determine that the fragment of the first network packet includes the indications of the source network address and the source port for the second network packet based at least in part on a value of a fragment offset field in a fragment header of the fragment. ### Claim 17 (depends on 13) The computer-readable medium of claim 13, wherein the instructions cause the programmable processor to: determine an acceptable range of values for the source network address and the source port based at least in part on a network address of the first network packet, wherein the instructions that cause the programmable processor to perform the anti-spoof check of the fragment flow based at least in part on the source network address and the source port for the second network packet further causes the programmable processor to determine whether the source network address and the source port for the second network packet are within the acceptable range of values.