Methods and systems of performing TCP flow analysis across NAT

A system for performing flow analysis across at least one NAT (network address translation) device, the system comprising:

• at least one first monitoring agent;
• at least one second monitoring agent;
• one or more storage devices, including at least one database;
• one or more processors;
• one or more network interfaces for communication with the at least one first monitoring agent and the at least one second monitoring agent;
• and
• a non-transitory memory comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
• receive one or more packets from the first monitoring agent positioned at a first capture point for an active TCP connection before network address translation of the one or more packets has occurred;
• receive one or more packets from the second monitoring agent positioned at a second capture point for the active TCP connection after network address translation of the one or more packets has occurred;
• generate a set of summary information for the one or more packets received from the first and second monitoring agents for a corresponding cyclical time interval;
• create a flow record for each set of summary information;
• identify one or more flow records that correspond to the active TCP connection using IP address and port number information;
• annotate each identified one or more flow record with a same flow identifier tag generated using a SYN sequence number and SYN-ACK sequence number from a three-way handshake establishing the active TCP connection, and from which the SYN sequence number and SYN-ACK sequence number can be extracted;
• store the annotated one or more flow records in a database;
• and
• perform flow analysis for one or more flows using the one or more same flow identifier tags from one or more annotated flow records that correspond to the one or more flows.