# US 11,909,767 B2 · Device visibility and scanning including network segments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,767 B2 - Document ID: US11909767B2 - Status: Granted - Kind: B2 - Application number: 16/924,508 - Filed: 2020-07-09 - Published: 2020-10-29 - Granted: 2024-02-20 - Earliest claimed: 2018-03-26 - Assignees: Forescout Technologies, Inc. - Applicants: Forescout Technologies, Inc. - Inventors: Siying Yang - Web page: https://patentgrep.com/patent/US11909767B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 47/20: Traffic policing - H04L 61/256: NAT traversal - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 61/2514: between local and global IP addresses - H04L 61/2535: {Multiple local networks, e.g. resolving potential IP address conflicts} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Device scanning aspects are described. In certain aspects, the method includes configuring a port forwarding policy on a first device based on a network session information, performing a scan of a second device based on a port forwarding policy. ## Claims ### Claim 1 A method comprising: configuring, by a processing device, a port forwarding policy on a first device based on network session information associated with the first device, wherein the network session information comprises a first address identifying the first device and a second address identifying a second device, wherein the second device is configured to communicate through the first device; generating, by the processing device, an identifier associated with the second device based on a combination of the first address and the second address of the network session information; scanning, by the processing device, the second device based on the identifier of the second device and the port forwarding policy, including sending, by the processing device, a scan request to the first device, wherein the first device forwards the scan request to the second device according to the port forwarding policy; and storing, by the processing device, the results of the scanning. ### Claim 2 (depends on 1) The method of claim 1, further comprising: performing an action based on the scanning. ### Claim 3 (depends on 1) The method of claim 1, generating the identifier associated with the second device comprises: selecting the first device based on the first device performing network address translation (NAT), wherein the first device is communicatively coupled to the second device, and wherein the second device is configured to communicate with a network through the first device; accessing the network session information associated with the first device, wherein the network session information comprises a private address associated with the second device; and determining the identifier associated with the second device based on the private address of the network session information, wherein the private address corresponds to the second address. ### Claim 4 (depends on 1) The method of claim 1, wherein the second device is a NAT device, further comprising: accessing the network session information associated with the first device, wherein the network session information comprises a third address associated with a third device; determining, with the processing device, an identifier associated with the third device based on the first address and the third address of the network session information; configuring an additional port forwarding policy on the first device based on the identifier associated with the first device; scanning, by the processing device, the third device based on the additional port forwarding policy, including sending, by the processing device, an additional scan request to the first device, wherein the first device forwards the additional scan request to the third device according to the additional port forwarding policy; and storing the results of the scanning of the third device. ### Claim 5 (depends on 1) The method of claim 1, wherein the first device is at least one of a router, a firewall, a switch, or a carrier grade (CG) NAT device. ### Claim 6 (depends on 1) The method of claim 1, wherein the port forwarding policy of the first device is configured using at least one of an application programming interface (API), command line interface (CLI), or a simple network management protocol (SNMP) interface. ### Claim 7 (depends on 1) The method of claim 1 further comprising: determining an operating system (OS) of the second device based on the network session information. ### Claim 8 (depends on 1) The method of claim 1, wherein the identifier of the second device comprises a unique identifier comprising an IP address associated with the second device and an IP address associated with the first device. ### Claim 9 (depends on 8) The method of claim 8, wherein the unique identifier of the second device further comprises a media access control (MAC) address associated with the first device. ### Claim 10 A system comprising: a memory; and a processing device, operatively coupled to the memory, to: configure a port forwarding policy on a first device based on a network session information associated with the first device, wherein the network session information comprises a first address identifying the first device and a second address identifying a second device, wherein the second device is configured to communicate through the first device; generate an identifier associated with the second device based on a combination of the first address and the second address of the network session information; scan the second device based on the identifier of the second device and the port forwarding policy, including to send a scan request to the first device, wherein the first device forwards the scan request to the second device according to the port forwarding policy; and store the results of the scan in the memory. ### Claim 11 (depends on 10) The system of claim 10, wherein the processing device further to perform an action based on the scan. ### Claim 12 (depends on 11) The system of claim 11, wherein the first device is at least one of a router, a firewall, a switch, or a carrier grade (CG) NAT device. ### Claim 13 (depends on 11) The system of claim 11, wherein the port forwarding policy of the first device is configured using an application programming interface (API). ### Claim 14 (depends on 10) The system of claim 10, wherein to generate the identifier associated with the second device comprises to: select the first device, communicatively coupled to a network, based on the first device performing network address translation (NAT), wherein the second device is configured to communicate with a network through the first device; access the network session information associated with the first device, wherein the network session information comprises a private address associated with the second device; and determine the identifier associated with the second device based on the private address of the network session information, wherein the private address corresponds to the second address. ### Claim 15 (depends on 10) The system of claim 10, wherein the processing device further to determine an operating system (OS) of the second device based on the network session information. ### Claim 16 (depends on 10) The system of claim 10, wherein the identifier of the second device comprises a unique identifier comprising an IP address associated with the second device and an IP address associated with the first device. ### Claim 17 (depends on 16) The system of claim 16, wherein the unique identifier of the second device further comprises a media access control (MAC) address associated with the first device. ### Claim 18 A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to: configure, by the processing device, a port forwarding policy on a first device based on a network session information associated with the first device, wherein the network session information comprises a first address identifying the first device and a second address identifying a second device, wherein the second device is configured to communicate through the first device; generate an identifier associated with the second device based on a combination of the first address and the second address of the network session information; scan the second device based on the identifier of the second device and the port forwarding policy, including to send a scan request to the first device, wherein the first device forwards the scan request to the second device according to the port forwarding policy; and store the results of the scan. ### Claim 19 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the instructions further cause the processing device to perform an action based on the scan. ### Claim 20 (depends on 18) The non-transitory computer readable medium of claim 18, wherein to generate the identifier associated with the second device comprises to: select the first device based on the first device performing network address translation (NAT), wherein the second device is configured to communicate with a network through the first device; access the network session information associated with the first device, wherein the network session information comprises a private address associated with the second device; and determine the identifier associated with the second device based on the private address of the network session information, wherein the private address corresponds to the second address.