Method and apparatus for converting a routing table into a collection of disjoint zones
The present invention discloses a method for analyzing an IP Gateway's Routing Table for identifying sets of IP addresses (“Disjoint Zones”) communicating through the same Gateway, said method comprising the steps of: identify subnets of IP addresses which are directly connected to the Gateway (“directly-connected subnets”) via a network interface card (“NIC”); associate every route in the Routing Table with a NIC; identify and sort the Routing Table's Critical Points, at which the routing decision may change between successive IP addresses, and identifying Disjoint Zones of IP addresses by locating all the Critical Points at which the routing decision in fact changes between successive IP addresses. According to a further option of the present invention, an External Disjoint Zone is identified in accordance with the NIC which is associated with the default route. According to alternative option of the present invention, the External Disjoint Zone is identified in accordance with trust levels as defined by the user. According to additional option of the present invention the users are enabled to identify the Disjoint Zone types in accordance with their preferences using a graphical interface. The method may be reduced to practice in the form of a software program that can be executed on a standard personal computer with a standard operating system. A preferred embodiment is an Intel x86-based PC running the RedHat Linux operating system.
1. A method of analyzing a routing table of an IP Gateway for identifying sets of IP addresses communicating through a Gateway, wherein said routing table includes a plurality of routes, wherein each route includes an IP address range including at least one destination IP address, wherein each route is associated with at least one predefined network interface card (NIC) enabling communication over at least one local area network (LAN) between an IP gateway of the routing table and a destination gateway directing to a destination address, said method comprising:
identifying critical points in the routing table with a processor, wherein each critical point is an IP address within a Route that represents a routing transition from one destination gateway to another; and
defining disjoint zones, wherein each disjoint zone is a set of destination IP addresses, wherein each destination IP address from the routing table is associated with a single disjoint zone, wherein all the destination IP addresses associated with said zone are further associated with the same NIC, and wherein defining of each said disjoint zone is carried out by using said critical points.
2. The method of claim 1 , further comprising sorting the identified Critical Points in ascending order of IP addresses.
3. The method of claim 1 , further comprising identifying and eliminating duplicate Critical Points.
4. The method of claim 1 , wherein a sweep algorithm is used to identify the Critical Points, wherein said sweep algorithm enables looping over an array of sorted Critical Points in an increasing order of IP addresses, wherein for each Critical Point “X”, the algorithm computes a routing decision, which is indicated by the NIC behind which the Critical Point “X” is located, wherein if the routing decision at Critical Point “X” differs from a routing decision at a previous Critical Point, a range of destination IP addresses is added to the range behind the previous Critical Point, which defines the range associated with a gateway, which is different than the gateway with which the previous range is associated.
5. The method of claim 4 , wherein the sweep algorithm employs a module that emulates the routing decision of the Gateway.
6. The method of claim 1 , further comprising associating a Zone Type to each disjoint zone, wherein said Zone Type is one of: an external zone; an internal zone; or a demilitarized zone (DMZ), wherein said external zone type represents addresses ranges that direct to external networks, said internal zone type represents address ranges that direct to internal networks and said DMZ type represents IP addresses that are used for publicly-available servers.
7. The method of claim 6 , further comprising identifying a level of security, which defines the zone types in accordance with trust levels as defined by a Gateway administrator.
8. The method of claim 6 , further comprising enabling the user to define the Zone Types in accordance with his preferences using a graphical interface.
9. A system for analyzing a routing table of an IP Gateway for identifying sets of IP addresses communicating through a Gateway, said system comprising:
a routing table that consists of a plurality of routes, wherein each route includes an IP address range including at least one destination IP address, wherein each route is associated with at least one predefined network interface card (NIC) enabling communication over at least one local area network (LAN) between an IP gateway of the routing table and a destination gateway directing to a destination address;
a memory for storing computer readable code and data which is executed by a processor;
at least one processor for processing data, operatively associated with said memory; and
a computer readable module enabling to receive and process data from the routing table for identifying disjoint zones, which are sets of destination IP addresses directed through the same destination gateway,
wherein the identification of said disjoint zones is carried out by identifying critical points in the routing table, wherein each critical point is an IP address within a route that represents a routing transition from one destination gateway to another;
wherein each destination IP address from the routing table is associated with a single disjoint zone, wherein all the destination IP addresses associated with said zone are further associated with the same NIC, and
wherein defining of each said disjoint zone is carried out by using said critical points.