Packet network path tracking through ipv6 extension header

An apparatus comprising:

• a processor;
• and
• non-transitory computer readable storage media storing code, the code being executable by the processor to perform operations comprising:
• intercepting a packet of a packet stream that is transmitted from a first host toward a second host over a computer network;
• generating a public key and a corresponding private key for the packet stream;
• inserting in the packet a hop-by-hop header comprising the public key, wherein each node in the computer network that receives the packet with the hop-by-hop header is configured to encrypt a node identifier (“ID”) of the node using the public key inserted in the packet and configured to store the encrypted node ID in a data structure on the node;
• in response to the packet stream being at least partially transmitted by the first host, retrieving the data structure from each node of the computer network;
• using the private key to attempt to decrypt entries in the data structure of each node of the computer network;
• and
• deriving a packet path of the packet of the packet stream, the packet path comprising nodes of the computer network having one or more entries in the data structure thereof that are successfully decrypted using the private key.

A system comprising:

• a plurality of nodes of a computer network;
• and
• a network controller comprising a processor and non-transitory computer readable storage media storing code, the code being executable by the processor to perform operations comprising:
• intercepting a packet of a packet stream that is transmitted from a first host toward a second host over the computer network;
• generating a public key and a corresponding private key for the packet stream;
• inserting in the packet a hop-by-hop header comprising the public key, wherein each of the plurality of nodes in the computer network that receives the packet with the hop-by-hop header is configured to encrypt a node identifier (“ID”) of the node using the public key inserted in the packet and configured to store the encrypted node ID in a data structure on the node;
• in response to the packet stream being at least partially transmitted by the first host, retrieving the data structure from each node of the plurality of nodes of the computer network;
• using the private key to attempt to decrypt entries in the data structure of each node of the plurality of nodes of the computer network;
• and
• deriving a packet path of the packet of the packet stream, the packet path comprising nodes of the plurality of nodes of the computer network having one or more entries in the data structure thereof that are successfully decrypted using the private key.