Port hopping and seek you peer to peer traffic control method and system
AssigneeBarracuda Networks, Inc.
InventorFLEMING SHI
Life of this patent
Estimating the term…
Abstract
A network apparatus, system, and method for operating a server to identify and subsequently control suspected peer-to-peer (P2P) sources transmitting traffic from a first network to a second network. Identifying a peer-to-peer source by a characteristic of destination port profile. Identifying a peer-to-peer source by a characteristic of destination host IP address profile. Determining when hopping ports usage comprise a data stream. Determining when destination IP address usage represent “Seek You” (CQ) like call behavior analogous to a radio invitation for any operators listening to respond.
Claims12
A network apparatus to filter traffic from a first network to a second network comprising at least one network interface communicatively coupled to a processor, the processor communicatively coupled to an computer readable instruction store, a computer readable data store, and to a circuit to match packets with a peer-to-peer fingerprint;
- the computer readable data store comprising for each source host in the first network a resetable counter of destination hosts, a list of destination hosts, and for each destination host a resetable counter of destination ports and a list of destination ports, and a flag for each source host which can be set when either counter reaches its terminus before being reset.
A software program product tangibly encoded on a computer-readable store comprising computer executable instructions to configure a processor to examine packets received from a first network, to determine a source host of potential peer-to-peer traffic, to further analyze all packets received from said source host of potential peer-to-peer traffic, and to discard packets from said source host which match a peer-to-peer fingerprint;
- wherein to determine a source host of potential peer-to-peer traffic comprises one of to measure the rate per unit time of diverse destination hosts addressed by the source host, and to measure the number of destination ports within each destination host addressed by the source host.
A computer implemented method for control of peer-to-peer network traffic at a gateway comprising:
- receiving and storing at least one peer-to-peer fingerprint pattern;
- selecting a source of peer-to-peer application traffic comprising
- scanning packets transmitted from a source,
- accumulating source and destination IP addresses and destination port number for each of said scanned packets,
- counting for each individual destination IP address of scanned packets transmitted by the source the number of destination ports used, and
- when the number of destination ports used at any one destination IP address within packets transmitted to by said source exceeds a maximum number of destination ports per destination IP threshold;
- matching each packet transmitted from said selected source with the stored at least one peer to peer fingerprint pattern;
- and
- disposing of any packet which matches according to a peer-to-peer service policy.
A computer-implemented method to identify a source host as a possible source host of peer-to-peer application traffic comprising:
- reading a first threshold of maximum number of destination ports per destination IP address,
- reading a second threshold rate of number of unique destination IP addresses within packets transmitted by a single source per unit time,
- scanning all packets transmitted from the source;
- accumulating source and destination IP addresses and destination port number for each packet sent by each source;
- computing the number of unique destination IP addresses per unit time the source sends to;
- and
- when at least one of the following condition is true:
- the number of destination ports per unique_destination IP address exceeds said first threshold,
- and
- the number of unique destination IP addresses per unit time the source send to exceeds said second threshold,
- disposing each packet transmitted by said source which matches with a peer-to-peer fingerprint pattern.
A computer-implemented process for selecting a source of potential peer-to-peer application traffic for further analysis comprising
- scanning a plurality of packets transmitted by a source within a first network to at least one destination within a second network;
- accumulating source and destination IP addresses and destination port number for each of said scanned packets;
- counting the number of destination ports recorded for each destination IP address recorded;
- and
- when the number of destination ports per destination IP address in packets transmitted by said source exceeds a stored maximum ports per destination IP address threshold number,
- storing the source of the scanned packets in a computer-readable list of potential peer-to-peer application sources.
A computer-implemented process to select a source of potential peer-to-peer application traffic for further analysis comprising
- scanning a plurality of packets transmitted by a source within a first network;
- accumulating source and destination IP addresses for each of said scanned packets;
- computing the number of destination IP addresses which the source transmits packets to per unit time;
- and
- when the number of destination IP addresses in packets transmitted per unit time by said source exceeds a stored maximum number of destination IP addresses per unit time threshold number,
- storing the source of the scanned packets in a computer-readable list of potential peer-to-peer application sources.
Dependencies are inferred from the claim text.