Port tracking on dynamically negotiated ports
AssigneeMazu Networks, Inc.
InventorsMassimiliano Poletto, Andrew Gorelik
Life of this patent
Estimating the term…
Abstract
Techniques for tracking dynamically negotiated port connections in a network include collecting statistical information on packets that are sent between nodes on a network, inspecting packets of control connections to detect payload fragments that denote ephemeral port negotiation and producing a mapping from a ephemeral connection flow_id to a control connection flow_id. The techniques also include checking the flow_id to see whether a flow record maps to a control connection.
Claims32
A system, comprising:
- a plurality of collector devices that are disposed to collect information based on packets sent between nodes in a network, the collector devices including a process to:
- inspect packets of control connections to detect payload fragments that denote an ephemeral port negotiation;
- and
- produce a mapping from an ephemeral connection flow_id to a control connection flow id;
- an aggregator that receives the mapping data from the plurality of collector devices, and checks the flow_id to see whether a received flow record maps to a control connection.
A collector device disposed to collect statistical information on packets sent between nodes on a network, the collector device, comprising:
- a processor;
- a memory executing instructions to cause the collector device to:
- inspect packets of control connections to detect payload fragments that denote ephemeral port negotiation;
- produce a mapping from a ephemeral connection flow_id to a control connection flow id;
- and
- send the mapping to a device.
A device, comprising:
- a processor;
- a memory executing instructions to cause the device to:
- receive mappings of a ephemeral connection flow_id to control connection flow_id from a plurality of collector devices;
- and
- check the flow_id to see whether a received flow record maps to a control connection.
A computer program product for tracking dynamically negotiated port numbers comprises instructions for causing a computer to:
- collect statistical information on packets that are sent between nodes on a network;
- inspect packets of control connections to detect payload fragments that denote ephemeral port negotiation;
- produce a mapping from a ephemeral connection flow_id to a control connection flow_id;
- and
- check the flow_id to see whether a flow record maps to a control connection.
A computer program product residing on a computer readable medium for determining mappings for ephemeral port connections comprising instructions to cause a computing device to:
- inspect packets of control connections to detect payload fragments that denote ephemeral port negotiation;
- produce a mapping from a ephemeral connection flow_id to a control connection flow id;
- and
- send the mapping to a device to associate the mapping with ephemeral connections.
A computer program product residing on a computer readable medium for determining ephemeral port connections comprising instructions to cause a computing device to:
- receive, from a plurality of collector devices, mappings corresponding to a ephemeral connection flow_id to a control connection flow_id;
- and
- check the flow_id to see whether a received flow record maps to a control connection.
A method for tracking dynamically negotiated port connections, the method comprising:
- collecting statistical information on packets that are sent between nodes on a network;
- inspecting packets of control connections to detect payload fragments that denote ephemeral port negotiation;
- producing a mapping from a ephemeral connection flow_id to a control connection flow_id;
- and
- checking the flow_id to see whether a flow record maps to a control connection.
Dependencies are inferred from the claim text.