# US 9,438,699 B1 · TCP proxying of network sessions mid-flow

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,699 B1
- Document ID: US9438699B1
- Status: Granted
- Kind: B1
- Application number: 14/817,002
- Filed: 2015-08-03
- Granted: 2016-09-06
- Earliest claimed: 2012-09-30
- Assignees: Juniper Networks, Inc.
- Applicants: Juniper Networks, Inc.
- Inventors: Nikhil G. Shetty; Chitrak K. Ojha; Rohini Kasturi; Vijay S. Rajaram; Gopi Krishna; Venkatesh Badakere Ramachandra
- Web page: https://patentgrep.com/patent/US9438699B1

## CPC

- H04L 69/163: In-band adaptation of TCP data exchange; In-band control procedures
- H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54)
- H04L 67/562: Brokering proxy services
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In one example, an intermediate network device sends packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device. The device, after sending the packets, receives a first zero-window probe packet from the client device including data representing a first current sequence number for a client-to-server packet flow of an established network session, and a second zero-window probe packet from the server device including data representing a second current sequence number for a server-to-client packet flow of the network session. The device also initializes a TCP state based on the first and second current sequence numbers, and acts as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the TCP state.

## Claims

### Claim 1

A method comprising:
sending, by an intermediate network device, packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device of an established network session after a synchronization (SYN) packet, a SYN-ACK (acknowledgement) packet, and an ACK packet of the established network session have been exchanged between the client device and the server device;
after sending the packets, receiving, by the intermediate network device, a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the established network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the established network session;
initializing a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number; and
acting, by the intermediate network device, as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.

### Claim 2 (depends on 1)

The method of claim 1, wherein acting as the TCP proxy comprises:
in response to receiving a packet of the client-to-server packet flow:
acknowledging receipt of the packet of the client-to-server packet flow to the client device;
updating the first TCP state based on a sequence number of the packet of the client-to-server packet flow; and
forwarding the packet of the client-to-server packet flow to the server device; and
in response to receiving a packet of the server-to-client packet flow:
acknowledging receipt of the packet of the server-to-client packet flow to the server device;
updating the second TCP state based on a sequence number of the packet of the server-to-client packet flow; and
forwarding the packet of the server-to-client packet flow to the client device.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
sending a first acknowledgement packet to the client device in response to the first zero-window probe packet, wherein the first acknowledgement packet advertises a first non-zero TCP window size; and
sending a second acknowledgement packet to the server device in response to the second zero-window probe packet, wherein the second acknowledgement packet advertises a second non-zero TCP window size.

### Claim 4 (depends on 1)

The method of claim 1, further comprising, prior to sending the packets, determining that a separate intermediate network device, acting as a primary TCP proxy for which the intermediate network device is configured as a backup TCP proxy, is no longer active.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
prior to sending the packets, receiving packets of the client-to-server packet flow and the server-to-client packet flow without acting as a TCP proxy for the network session; and
determining, after receiving the packets, that the network session should be TCP proxied,
wherein sending the packets comprises sending the packets based on the determination.

### Claim 6 (depends on 5)

The method of claim 5, further comprising performing shallow packet inspection on the received packets, wherein determining comprises determining that the network session should be TCP proxied based on the shallow packet inspection.

### Claim 7 (depends on 5)

The method of claim 5, wherein determining comprises at least one of determining that an amount of data passing through the intermediate network device for the network session exceeds a data threshold, that the client device has been involved in malicious network activity with respect to a separate network session, that the network session has been active for a period of time that exceeds a time threshold, and that a data rate for the network session has exceeded a data rate threshold.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
reordering packets of the client-to-server packet flow and the server-to-client packet flow based on the first TCP state and the second TCP state; and
sending the reordered packets to a processor.

### Claim 9

An intermediate network device positioned between a client device and a server device, the intermediate network device comprising:
a plurality of network interfaces configured to send packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device of an established network session after a synchronization (SYN) packet, a SYN-ACK (acknowledgement) packet, and an ACK packet of the established network session have been exchanged between the client device and the server device, and receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the established network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the established network session; and
a processor configured to initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number, and to act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.

### Claim 10 (depends on 9)

The intermediate network device of claim 9, wherein to act as the TCP proxy, the processor is configured to:
in response to receiving a packet of the client-to-server packet flow, acknowledge receipt of the packet of the client-to-server packet flow to the client device, update the first TCP state based on a sequence number of the packet of the client-to-server packet flow, and forward the packet of the client-to-server packet flow to the server device, and
in response to receiving a packet of the server-to-client packet flow, acknowledge receipt of the packet of the server-to-client packet flow to the server device, update the second TCP state based on a sequence number of the packet of the server-to-client packet flow, and forward the packet of the server-to-client packet flow to the client device.

### Claim 11 (depends on 9)

The intermediate network device of claim 9, wherein the processor is further configured to send a first acknowledgement packet to the client device in response to the first zero-window probe packet, wherein the first acknowledgement packet advertises a first non-zero TCP window size, and to send a second acknowledgement packet to the server device in response to the second zero-window probe packet, wherein the second acknowledgement packet advertises a second non-zero TCP window size.

### Claim 12 (depends on 9)

The intermediate network device of claim 9, wherein the processor is further configured to determine whether a separate intermediate network device, acting as a primary TCP proxy for which the intermediate network device is configured as a backup TCP proxy, is no longer active, and to act as the TCP proxy when the primary TCP proxy is determined to no longer be active.

### Claim 13 (depends on 9)

The intermediate network device of claim 9, wherein the processor is further configured to, prior to sending the packets, receive packets of the client-to-server packet flow and the server-to-client packet flow without acting as a TCP proxy for the network session, and determine, after receiving the packets, that the network session should be TCP proxied, and wherein the processor sends the packets based on the determination.

### Claim 14 (depends on 13)

The intermediate network device of claim 13, wherein the processor is configured to determine whether the network session should be TCP proxied using shallow packet inspection of the received packets.

### Claim 15 (depends on 13)

The intermediate network device of claim 13, wherein the processor is configured to determine whether the network session should be TCP proxied based on at least one of whether an amount of data passing through the intermediate network device for the network session exceeds a data threshold, the client device has been involved in malicious network activity with respect to a separate network session, the network session has been active for a period of time that exceeds a time threshold, and a data rate for the network session has exceeded a data rate threshold.

### Claim 16 (depends on 9)

The intermediate network device of claim 9, wherein the processor is further configured to reorder packets of the client-to-server packet flow and the server-to-client packet flow based on the first TCP state and the second TCP state, and send the reordered packets to a second, different processor.

### Claim 17 (depends on 9)

The intermediate network device of claim 9, wherein the intermediate network device comprises at least one of a mobile gateway device, a serving gateway (SGW) device, a packet data network (PDN) gateway (PGW) device, a router, a gateway, an intrusion detection and prevention (IDP) device, and a firewall.

### Claim 18

A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor of an intermediate network device to:
send packets that advertise a transmission control protocol (TCP) window size of zero bytes to a client device and a server device of an established network session after a synchronization (SYN) packet, a SYN-ACK (acknowledgement) packet, and an ACK packet of the established network session have been exchanged between the client device and the server device;
after sending the packets, receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the established network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the established network session;
initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number; and
act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.

### Claim 19 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, wherein the instructions that cause the processor to act as the TCP proxy comprise instructions that cause the processor to:
in response to receiving a packet of the client-to-server packet flow:
acknowledge receipt of the packet of the client-to-server packet flow to the client device;
update the first TCP state based on a sequence number of the packet of the client-to-server packet flow; and
forward the packet of the client-to-server packet flow to the server device; and
in response to receiving a packet of the server-to-client packet flow:
acknowledge receipt of the packet of the server-to-client packet flow to the server device;
update the second TCP state based on a sequence number of the packet of the server-to-client packet flow; and
forward the packet of the server-to-client packet flow to the client device.

### Claim 20 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, further comprising instructions that cause the processor to:
send a first acknowledgement packet to the client device in response to the first zero-window probe packet, wherein the first acknowledgement packet advertises a first non-zero TCP window size; and
send a second acknowledgement packet to the server device in response to the second zero-window probe packet, wherein the second acknowledgement packet advertises a second non-zero TCP window size.

### Claim 21 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, further comprising instructions that cause the processor to, prior to sending the packets, determine that a separate intermediate network device, acting as a primary TCP proxy for which the intermediate network device is configured as a backup TCP proxy, is no longer active.

### Claim 22 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, further comprising instructions that cause the processor to:
prior to sending the packets, receive packets of the client-to-server packet flow and the server-to-client packet flow without acting as a TCP proxy for the network session; and
determine, after receiving the packets, that the network session should be TCP proxied,
wherein the instructions that cause the processor to send the packets comprise instructions that cause the processor to send the packets based on the determination.

### Claim 23 (depends on 22)

The non-transitory computer-readable storage medium of claim 22, further comprising instructions that cause the processor to perform shallow packet inspection on the received packets, wherein the instructions that cause the processor to determine comprise instructions that cause the processor to determine that the network session should be TCP proxied based on the shallow packet inspection.

### Claim 24 (depends on 22)

The non-transitory computer-readable storage medium of claim 22, wherein the instructions that cause the processor to determine comprise instructions that cause the processor to at least one of determine that an amount of data passing through the intermediate network device for the network session exceeds a data threshold, that the client device has been involved in malicious network activity with respect to a separate network session, that the network session has been active for a period of time that exceeds a time threshold, and that a data rate for the network session has exceeded a data rate threshold.

### Claim 25 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, further comprising instructions that cause the processor to:
reorder packets of the client-to-server packet flow and the server-to-client packet flow based on the first TCP state and the second TCP state; and
send the reordered packets to a processor.

### Claim 26

A system comprising:
a primary network device configured to receive a synchronization (SYN) packet from a client device of a network session, a SYN-ACK (acknowledgement) packet from a server device of the network session, and an ACK packet from the client device; and
a backup network device configured to receive data of the network session when the primary network device is no longer active after receiving the SYN packet, the SYN-ACK packet, and the ACK packet of the network session, wherein the backup network device is configured to send packets that advertise a transmission control protocol (TCP) window size of zero bytes to the client device and the server device, after sending the packets, receive a first zero-window probe packet from the client device, wherein the first zero-window probe packet includes data representing a first current sequence number for a client-to-server packet flow of the network session, and a second zero-window probe packet from the server device, wherein the second zero-window probe packet includes data representing a second current sequence number for a server-to-client packet flow of the network session, initialize a first TCP state for the client-to-server packet flow based on the first current sequence number and a second TCP state for the server-to-client packet flow based on the second current sequence number, and act as a TCP proxy for packets following the first zero-window probe packet of the client-to-server packet flow based on the first TCP state and packets following the second zero-window probe packet of the server-to-client packet flow based on the second TCP state.