# US 12,113,684 B2 · Identifying bogon address spaces

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,684 B2
- Document ID: US12113684B2
- Status: Granted
- Kind: B2
- Application number: 17/578,375
- Filed: 2022-01-18
- Published: 2022-05-05
- Granted: 2024-10-08
- Earliest claimed: 2015-06-05
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Shashidhar Gandham; Rohit Chandra Prasad; Abhishek Ranjan Singh; Navindra Yadav; Khawar Deen; Varun Sagar Malhotra
- Web page: https://patentgrep.com/patent/US12113684B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 3/0482: Interaction with lists of selectable items, e.g. menus
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/162: {Delete operations (erasing in storage systems G06F3/0652)}
- G06F 16/17: Details of further file system functions
- G06F 16/173: {Customisation support for file systems, e.g. localisation, multi-language support, personalisation}
- G06F 16/174: Redundancy elimination performed by the file system (error detection or correction of the data by redundancy in operations G06F11/14)
- G06F 16/1744: {using compression, e.g. sparse files}
- G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)}
- G06F 16/2322: {using timestamps}
- G06F 16/235: {Update request formulation}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/24578: {using ranking}
- G06F 16/248: Presentation of query results
- G06F 16/285: {Clustering or classification}
- G06F 16/288: {Entity relationship models}
- G06F 16/29: Geographical information databases
- G06F 16/9535: Search customisation based on user profiles and personalisation
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 20/00: Machine learning
- G06N 99/00: Subject matter not provided for in other groups of this subclass
- G06T 11/26: Drawing of charts or graphs
- H04J 3/0661: {using timestamps}
- H04J 3/14: Monitoring arrangements {(for SDH/SONET rings H04J3/085)}
- H04L 1/242: {by comparing a transmitted test signal with a locally generated replica}
- H04L 7/10: Arrangements for initial synchronisation
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 41/046: comprising network management agents or mobile agents therefor
- H04L 41/0668: by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
- H04L 41/0803: Configuration setting
- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 41/0893: Assignment of logical groups to network elements
- H04L 41/0894: Policy-based network configuration management
- H04L 41/12: Discovery or management of network topologies
- H04L 41/16: using machine learning or artificial intelligence
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L 43/02: Capturing of monitoring data
- H04L 43/026: using flow identification
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/062: related to network traffic
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L 43/0805: by checking availability
- H04L 43/0811: by checking connectivity
- H04L 43/0829: Packet loss
- H04L 43/0841: {Round trip packet loss}
- H04L 43/0858: {One way delays}
- H04L 43/0864: Round trip delays
- H04L 43/0876: Network utilisation, e.g. volume of load or congestion level
- H04L 43/0882: Utilisation of link capacity
- H04L 43/0888: Throughput
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 43/106: using time related information in packets, e.g. by adding timestamps
- H04L 43/12: Network monitoring probes
- H04L 43/16: Threshold monitoring
- H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
- H04L 45/306: {Route determination based on the nature of the carried application}
- H04L 45/38: {Flow based routing}
- H04L 45/46: {Cluster building}
- H04L 45/507: {Label distribution}
- H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's}
- H04L 45/74: Address processing for routing
- H04L 47/11: Identifying congestion
- H04L 47/20: Traffic policing
- H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ]
- H04L 47/2483: involving identification of individual flows
- H04L 47/28: in relation to timing considerations
- H04L 47/31: by tagging of packets, e.g. using discard eligibility [DE] bits
- H04L 47/32: by discarding or delaying data units, e.g. packets or frames
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/16: {Implementing security features at a particular protocol layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/01: Protocols
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services
- H04L 67/75: Indicating network or usage conditions on the user display
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/22: Parsing or analysis of headers
- H04W 72/54: based on quality criteria
- H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F 2221/033: Test or assess software
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2105: Dual mode as a secondary aspect
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2115: Third party
- G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.

## Claims

### Claim 1

A method, comprising:
identifying a network address associated with a network flow;
obtaining an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determining whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determining the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.

### Claim 2 (depends on 1)

The method of claim 1, wherein the messages are transmitted as border gateway protocol messages.

### Claim 3 (depends on 1)

The method of claim 1, further comprising dropping the network flow based on the determination that the network address is the bogon address.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
dropping a second network flow associated with the network address, based on the determination that the network address is the bogon address.

### Claim 5 (depends on 4)

The method of claim 4, wherein the second network flow occurs, at least in part, after the network flow and includes the network address in a header of data transmitted in the second network flow.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving a data report identifying the network flow via a capturing agent deployed on a host in the network.

### Claim 7 (depends on 6)

The method of claim 6, wherein the capturing agent is run on a processor, a kernel module, a software driver, or a combination thereof.

### Claim 8 (depends on 6)

The method of claim 6, wherein the capturing agent resides in a hypervisor on the host or a virtual machine on the hypervisor and the network flow is sent or received by the hypervisor or the virtual machine.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
determining the network address is not the bogon address when the network address is associated with the one or more reserved network address spaces.

### Claim 10

A system comprising:
one or more processors; and
a computer-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the one or more processors to:
identify a network address associated with a network flow;
obtain an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determine whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determine the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.

### Claim 11 (depends on 10)

The system of claim 10, wherein the messages are transmitted as border gateway protocol messages.

### Claim 12 (depends on 10)

The system of claim 10, wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to drop the network flow based on the determination that the network address is the bogon address.

### Claim 13 (depends on 10)

The system of claim 10, wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to drop a second network flow associated with the network address, based on the determination that the network address is the bogon address.

### Claim 14 (depends on 13)

The system of claim 13, wherein the second network flow occurs, at least in part, after the network flow and includes the network address in a header of data transmitted in the second network flow.

### Claim 15 (depends on 10)

The system of claim 10, wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to receive a data report identifying the network flow via a capturing agent deployed on a host in the network.

### Claim 16 (depends on 15)

The system of claim 15, wherein the capturing agent is run on a processor, a kernel module, a software driver, or a combination thereof.

### Claim 17 (depends on 15)

The system of claim 15, wherein the capturing agent resides in a hypervisor on the host or a virtual machine on the hypervisor and the network flow is sent or received by the hypervisor or the virtual machine.

### Claim 18 (depends on 10)

The system of claim 10, wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to determine the network address is not the bogon address when the network address is associated with the one or more reserved network address spaces.

### Claim 19

A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the one or more processors to:
identify a network address associated with a network flow;
obtain an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determine whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determine the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.

### Claim 20 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein the messages are transmitted as border gateway protocol messages.