IP Library Granted Patent US 12665856
Granted Patent B2
US 12665856 · App. 18/321,890 · Granted Jun 23, 2026

Systems and methods to detect and bypass network throttling in user datagram protocol (UDP) connections

Inventors: Abhinav Bansal (Vancouver, CA); Rohit Goyal (Mohali, IN)
Assignee: Zscaler, Inc.
H04L47/25H04L43/0829
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12665856
App. No.
18/321,890
Granted
Jun 23, 2026
Kind
B2
Abstract

Systems and methods for detecting and bypassing network throttling in User Datagram Protocol (UDP) connections. Various embodiments include monitoring network traffic to and from a user device, wherein the network traffic is facilitated over a communication mode; collecting telemetry from the network traffic; identifying network throttling based on the telemetry; and responsive to identifying network throttling, utilizing an alternate communication mode, thereby bypassing the network throttling. The network throttling can be identified by calculating a loss value based on the telemetry and determining network throttling based on the loss value.

Claims (48)

1 . A method comprising steps of:

monitoring network traffic to and from a user device, wherein the network traffic is facilitated over a communication mode, the communication mode defining a tunnel mode, wherein the tunnel mode is configured to adapt responsive to the network traffic by detecting throttling and switch to an alternative communication mode;

collecting telemetry from the network traffic, wherein the telemetry includes a count of packets sent by a node and a count of packets received by the user device;

calculating, at the user device, a loss value based on a comparison between the counts during successive monitoring intervals;

identifying network throttling based on the telemetry, when the loss value exceeds a predefined threshold for a plurality of consecutive monitoring intervals; and

responsive to identifying network throttling, automatically transitioning from a first tunnel mode to an alternate tunnel mode selected from among a plurality of tunnel protocols based on the telemetry, thereby bypassing the network throttling,

wherein the collecting telemetry includes transmitting periodic keep-alive packets from the user device and receiving corresponding acknowledgment packets from a server, each acknowledgment including server-side packet counters used in the calculating step.

2 . The method of claim 1 , wherein the telemetry includes a number of keep alive packets sent by a node and a number of keep alive packets received by the user device and wherein the telemetry is configured to detect if the network is throttled, each keep-alive packet including server-side packet counters used in the calculating step.

3 . The method of claim 1 , wherein the steps further comprise:

calculating the loss value based on the telemetry by determining a difference between a number of packets sent by the node and a number of packets received by the user device during each monitoring interval; and

identifying network throttling based on the loss value, wherein the loss value defines a packet differential.

4 . The method of claim 3 , wherein network throttling is identified responsive to the loss value being greater than a threshold limit.

5 . The method of claim 3 , wherein telemetry is collected at various time intervals, and the steps further comprise:

calculating the loss value for each of the time intervals based on time intervals associated telemetry; and

identifying network throttling based on the loss value exceeding the threshold for at least three consecutive monitoring intervals to reduce false positives.

6 . The method of claim 1 , wherein the first tunnel mode is a Datagram Transport Layer Security (DTLS) tunnel, and the alternate tunnel mode is a Transport Layer Security (TLS) tunnel, and wherein the transition between the tunnels is automatically triggered by the telemetry-based throttling detection without user intervention.

7 . A method implemented by an application executed on a user device, the method comprising steps of:

monitoring network traffic to and from a user device, wherein the network traffic is facilitated over a communication mode, the communication mode defining a tunnel mode, wherein the tunnel mode is configured to adapt responsive to the network traffic by detecting throttling and switch to an alternative communication mode;

collecting telemetry from the network traffic, wherein the telemetry includes a count of packets sent by a node and a count of packets received by the user device;

calculating, at the user device, a loss value based on a comparison between the counts during successive monitoring intervals;

identifying network throttling based on the telemetry, when the loss value exceeds a predefined threshold for a plurality of consecutive monitoring intervals; and

responsive to identifying network throttling, automatically transitioning from a first tunnel mode to an alternate tunnel mode selected from among a plurality of tunnel protocols based on the telemetry, thereby bypassing the network throttling,

wherein the collecting telemetry includes transmitting periodic keep-alive packets from the user device and receiving corresponding acknowledgment packets from a server each acknowledgment including server-side packet counters used in the calculating step.

8 . The method of claim 7 , wherein the telemetry includes a number of keep alive packets sent by a node and a number of keep alive packets received by the user device and wherein the telemetry is configured to detect if the network is throttled, each keep-alive packet including server-side packet counters used in the calculating step.

9 . The method of claim 7 , wherein the steps further comprise:

calculating loss value based on the telemetry by determining a difference between a number of packets sent by the node and a number of packets received by the user device during each monitoring interval; and

identifying network throttling based on the loss value.

10 . The method of claim 9 , wherein network throttling is identified responsive to the loss value being greater than a threshold limit.

11 . The method of claim 9 , wherein telemetry is collected at various time intervals, and the steps further comprise:

calculating the loss value for each of the time intervals based on time intervals associated telemetry; and

identifying network throttling based on the loss value exceeding the threshold for at least three consecutive monitoring intervals to reduce false positives.

12 . The method of claim 7 , wherein the first tunnel mode is a Datagram Transport Layer Security (DTLS) tunnel, and the alternate tunnel mode is a Transport Layer Security (TLS) tunnel, and wherein the transition between the tunnels is automatically triggered by the telemetry-based throttling detection without user intervention.

13 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

monitoring network traffic to and from a user device, wherein the network traffic is facilitated over a communication mode, the communication mode defining a tunnel mode, wherein the tunnel mode is configured to adapt responsive to the network traffic by detecting throttling and switch to an alternative communication mode;

collecting telemetry from the network traffic, wherein the telemetry includes a count of packets sent by a node and a count of packets received by the user device;

calculating, at the user device, a loss value based on a comparison between the counts during successive monitoring intervals;

identifying network throttling based on the telemetry, when the loss value exceeds a predefined threshold for a plurality of consecutive monitoring intervals; and

responsive to identifying network throttling, automatically transitioning from a first tunnel mode to an alternate tunnel mode selected from among a plurality of tunnel protocols, thereby bypassing the network throttling,

wherein the collecting telemetry includes transmitting periodic keep-alive packets from the user device and receiving corresponding acknowledgment packets from a server, each acknowledgment including server-side packet counters used in the calculating step.

14 . The non-transitory computer-readable medium of claim 13 , wherein the telemetry includes a number of keep alive packets sent by a node and a number of keep alive packets received by the user device and wherein the telemetry is configured to detect if the network is throttled, each keep-alive packet including server-side packet counters used in the calculating step.

15 . The non-transitory computer-readable medium of claim 13 , wherein the instructions further cause the one or more processors to perform steps of:

calculating the loss value based on the telemetry by determining a difference between a number of packets sent by the node and a number of packets received by the user device during each monitoring interval; and

identifying network throttling based on the loss value.

16 . The non-transitory computer-readable medium of claim 15 , wherein network throttling is identified responsive to the loss value being greater than a threshold limit.

17 . The non-transitory computer-readable medium of claim 15 , wherein telemetry is collected at various time intervals, and wherein the instructions further cause the one or more processors to perform steps of:

calculating the loss value for each of the time intervals based on time intervals associated telemetry; and

identifying network throttling based on the loss value exceeding the threshold for at least three consecutive monitoring intervals to reduce false positives.

18 . The non-transitory computer-readable medium of claim 13 , wherein the first tunnel mode is a Datagram Transport Layer Security (DTLS) tunnel, and the alternate tunnel mode is a Transport Layer Security (TLS) tunnel, and wherein the transition between the tunnels is automatically triggered by the telemetry-based throttling detection without user intervention.