Detection of routing loops based on time-to-live expiries
AssigneeAT&T Intellectual Property I, L.P.
InventorsThusitha Jayawardena, William J. Shugard
Life of this patent
Estimating the term…
Abstract
A method and system for detecting routing loops and time-to-live (TTL) expiry attacks in a telecommunications network are disclosed. The detection of routing loops and TTL expiry attacks can be achieved based on the comparison of TTL expiries occurring on two or more routers in the network. A quantity of TTL expiries associated with a router can be summed. Additionally, a quantity of TTL expiries associated with other routers that are operatively coupled to the router can be summed. A difference between the sums can be calculated and a determination of whether a routing loop exists can be made in response to the difference.
Claims20
A method of detecting routing loops in a network comprising:
- identifying a first quantity of time-to-live (TTL) expiries on a first router;
- identifying a plurality of routers operatively coupled to the first router, a second router being one of the plurality of routers;
- computing a sum of TTL expiries occurring on the plurality of routers, the sum of TTL expiries being a second quantity of TTL expiries, the second quantity of TTL expiries including TTL expiries occurring on the second router;
- comparing the first quantity to the second quantity to determine whether there is a difference between the first quantity and the second quantity;
- and
- determining whether a routing loop or a TTL expiry attack exists based on the comparison.
A non-transitory computer-readable storage medium comprising instructions that, when executed by at least one computing device, cause the computing device to:
- identify a first quantity of time-to-live (TTL) expiries on a first router;
- identify a second quantity of TTL expiries on a second router;
- compare the first quantity to the second quantity;
- determine whether a routing loop or a TTL expiry attack exists based on the comparison;
- and
- distinguish between a persistent and transient routing loop based on the TTL expiry quantities associated with a plurality of time intervals.
A system for detecting routing loops in a network having a plurality of routers, the system comprising:
- a computing device configured to identify a first quantity of time-to-live (TTL) expiries on a first router, identify a second quantity of TTL expiries on a second router, compare the first quantity to the second quantity, and determine whether a routing loop or a TTL expiry attack exists based on the comparison, the computing device distinguishes between a persistent and transient routing loop based on the TTL expiry quantities associated with a plurality of time intervals.
A non-transitory computer-readable storage medium comprising instructions, that when executed by at least one computing device, causes the computing device to:
- identify a first quantity of time-to-live (TTL) expiries on a first router;
- identify a second quantity of TTL expiries on a second router;
- identify a plurality of routers operatively coupled to the first router, the second router being one of the plurality of routers;
- compute a sum of TTL expiries occurring on the plurality of routers, the sum of TTL expiries being a second quantity of TTL expiries, the second quantity of TTL expiries including TTL expiries occurring on the second router;
- compare the first quantity to the second quantity to determine whether there is a difference between the first quantity and the second quantity;
- and
- determine whether a routing loop or a TTL expiry attack exists based on the comparison.
Dependencies are inferred from the claim text.