NAT association detection method based on multi-path message detection analysis

Abstract

The invention discloses an NAT association detection method based on multi-path message detection analysis, and the main method is to find out an NAT associated flow by analyzing protocol fields and Payload payload data of each layer of a large number of messages, a timestamp, an accumulated byte number and other statistical information; and the forwarding paths of the associated streams, namely the network equipment through which the message passes, can be determined by analyzing the source MAC addresses and the destination MAC addresses of the associated streams. According to the method, multiple pairs of NAT associated streams can be rapidly extracted from a large number of messages, operation and maintenance personnel can be helped to know network operation conditions, and the operation and maintenance personnel can be helped to locate problems when faults occur.

Description

Technical field [0001] The invention relates to the field of computers, in particular to a NAT correlation detection method based on multipath message detection and analysis. Background technique [0002] NAT (Network Address Translator) is a technology that translates an internal private network IP address into a public network IP address. With the increasing lack of IPv4 addresses, the main purpose of NAT is to enable addresses to be reused. NAT solves the problem of address shortage, hides and protects the computers inside the network, but also makes the network more complicated. When network services fail, it becomes more difficult to locate the problem. [0003] Since the NAT technology converts the IP address and transport layer port, a stream sent from a terminal device (such as a server, a personal computer) will become another new stream after being converted by the NAT device, and the old and new streams will remove the payload data payload. In addition to the same, the ...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above-mentioned deficiencies in the prior art, a NAT association detection method based on multipath packet detection and analysis provided by the present invention solves the problem that the NAT association flow cannot be quickly found