Automatic determination of connectivity problem locations or other network-characterizing information in a network utilizing an encapsulation protocol
Techniques for determining a problem location or otherwise characterizing a network comprising a plurality of processing elements, including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol. The packet encapsulation operation is performed on a test packet to generate an encapsulated packet, the test packet having a time to live (TTL) value and an identifier. In conjunction with performance of the packet encapsulation operation, the TTL value and the identifier of the test packet are copied to a header of the encapsulated packet. The encapsulated packet is transmitted, and a determination is made as to whether a reply packet has been received responsive to transmission of the encapsulated packet. The reply packet, if any, is processed to obtain information utilizable in determining the problem location or otherwise characterizing the network. By way of example, these operations may be repeated, for subsequent test packets with increasing TTL values, until an amount of router hop information sufficient to determine the problem location is obtained.
1. A method for determining information characterizing a network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, the method comprising the steps of:
performing the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a header comprising a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied from the header of the test packet to a header of the encapsulated packet;
transmitting the encapsulated packet;
determining if a reply packet is received responsive to transmission of the encapsulated packet; and
processing the received reply packet, if any, to obtain the information characterizing the network.
2. The method of claim 1 wherein the information characterizing the network comprises information identifying a problem location in the network.
3. The method of claim 1 wherein the information characterizing the network comprises network performance information.
4. The method of claim 1 wherein the information characterizing the network comprises information characterizing a path of a VPN operating in tunnel mode between security gateways of the network.
5. The method of claim 1 wherein the test packet comprises a traceroute UDP packet.
6. The method of claim 1 wherein the packet encapsulation operation comprises a packet encapsulation operation in accordance with the ESP protocol.
7. The method of claim 1 wherein the identifier comprises at least a portion of an identification field of the test packet.
8. The method of claim 1 wherein the performing, transmitting, determining and processing steps are repeated, for subsequent test packets with increasing time to live values, until an amount of router hop information sufficient to determine a problem location is obtained.
9. The method of claim 1 wherein one of first and second security gateways associated with a VPN of the network comprises the processing element associated with performance of the packet encapsulation operation of the encapsulation protocol.
10. The method of claim 1 wherein the time to live value and the identifier are copied from an IP header of a traceroute packet to an IP header of an ESP packet in conjunction with performance of the encapsulation process.
11. A method for determining information characterizing a network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, the method comprising the steps of:
performing the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied to a header of the encapsulated packet;
transmitting the encapsulated packet;
determining if a reply packet is received responsive to transmission of the encapsulated packet; and
processing the received reply packet, if any, to obtain the information characterizing the network;
wherein the copying of the time to live value and the identifier is facilitated by setting corresponding socket options on a UDP socket used to send a traceroute packet comprising the test packet.
12. The method of claim 1 wherein the step of determining if a reply packet has been received responsive to transmission of the encapsulated packet further comprises validating the reply packet by determining if information associated with the test packet is present in a data portion of the reply packet.
13. The method of claim 12 wherein the information associated with the test packet comprises the identifier.
14. The method of claim 12 wherein the information associated with the test packet comprises a destination port of the test packet.
15. The method of claim 1 wherein the reply packet comprises one of an ICMP Time Exceeded reply packet and an ICMP Port Unreachable reply packet.
16. A method for determining information characterizing a network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, the method comprising the steps of:
performing the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied to a header of the encapsulated packet;
transmitting the encapsulated packet;
determining if a reply packet is received responsive to transmission of the encapsulated packet; and
processing the received reply packet, if any, to obtain the information characterizing the network;
wherein if the reply packet is determined to contain in a data portion thereof information identifying a destination port of the test packet, or a maximum time to live value has been reached without receipt of a reply packet containing in a data portion thereof information identifying a destination port of the test packet, a traceroute application that does not involve copying of the time to live value and the identifier is initiated.
17. The method of claim 16 wherein the traceroute application that does not involve copying of the time to live value and the identifier is initiated using a different socket than that used for one or more previous test packets, and a time to live value of one.
18. A method for determining information characterizing a network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, the method comprising the steps of:
performing the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied to a header of the encapsulated packet;
transmitting the encapsulated packet;
determining if a reply packet is received responsive to transmission of the encapsulated packet; and
processing the received reply packet, if any, to obtain the information characterizing the network;
wherein router hop information obtained from one or more iterations of the performing, transmitting, determining and processing steps is combined with additional router hop information obtained by applying said steps using one or more additional test packets but without copying of the time to live value and identifier in conjunction with performance of the packet encapsulation operation.
19. The method of claim 1 wherein the identifier of the test packet is selected from a range of identification values reserved for such test packets in order to prevent conflict with an identification field of non-test packets in the network.
20. The method of claim 1 wherein the test packet originates from a processing element of the network other than a processing element which performs the packet encapsulation operation.
21. The method of claim 1 wherein the performing, transmitting, determining and processing steps are implemented at least in part in software stored in a memory of the processing element and executed by a processor of the processing element.
22. An apparatus for use in determining information characterizing a network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, the apparatus comprising:
a processing element comprising a processor coupled to a memory;
the processing element being operative:
(i) to perform the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a header comprising a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied from the header of the test packet to a header of the encapsulated packet;
(ii) to transmit the encapsulated packet;
(iii) to determine if a reply packet is received responsive to transmission of the encapsulated packet; and
(iv) to process the received reply packet, if any, to obtain the information characterizing the network.
23. The apparatus of claim 22 wherein the processing element performs operations (i) through (iv) responsive to one or more commands from a controller of a network monitoring and analysis system.
24. The apparatus of claim 22 wherein the processing element is further operative to identify a path of a VPN operating in tunnel mode between security gateways of the network, and to determine network performance information associated with that path.
25. The apparatus of claim 22 wherein the processing element is further operative to determine routing changes associated with a path of a VPN operating in tunnel mode between security gateways of the network.
26. A processor-readable storage medium containing executable software code for use in determining information characterizing a network, the network comprising a plurality of processing elements including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol, wherein the software code when executed implements the steps of:
performing the packet encapsulation operation on a test packet to generate an encapsulated packet, the test packet having a header comprising a time to live value and an identifier, wherein in conjunction with performance of the packet encapsulation operation the time to live value and the identifier of the test packet are copied from the header of the test packet to a header of the encapsulated packet;
transmitting the encapsulated packet;
determining if a reply packet is received responsive to transmission of the encapsulated packet; and
processing the received reply packet, if any, to obtain the information characterizing the network.