System and method for discovering SCTP associations in a network
View Patent ↗Systems and methods for discovering SCTP associations between devices communicating in a network are described. A method comprises monitoring packets communicated among a plurality of source and destination devices, determining a combination of source EP address, source port number, destination IP address, and destination port number that defines an association between a source device and a destination device, and resolving a combination of source and destination verification tags that further defines the association based upon the combination of EP addresses and port numbers. The method further comprises ascertaining whether a subsequently monitored packet belongs to the association based at least in part upon an element of the combination of verification tags after at least one element of the combination of EP addresses and port numbers has changed during the ongoing communication.
1. A method comprising:
monitoring, by a network monitoring system, packets communicated among a plurality of source and destination devices in a network using a protocol that supports multihoming, wherein an association between a source device and a destination device for communication with each other during a communication session is defined by a first combination of parameters having a first set of values, and wherein said network monitoring system is disposed in said network independent of said source and destination devices;
resolving by the network monitoring system, based upon the determined first combination of parameters having said first set of values, a combination of source and destination verification tags that further defines the association, wherein the resolved combination of source and destination verification tags enables said network monitoring system to ascertain whether monitored packets belong to the association even when one or more of the values of the first combination of parameters has changed during the communication session; and
wherein said resolving is performed by the network monitoring system without use by the network monitoring system of packets exchanged between the source and destination devices for setting up a multi-homing association.
2. The method of claim 1 wherein the first combination of parameters comprises source IP address, source port number, destination IP address, and destination port number.
3. The method of claim 1 further comprising:
ascertaining, by the network monitoring system, whether a subsequently monitored packet belongs to the association based at least in part upon said resolved combination of source and destination verification tags, where the ascertaining step occurs after the value of at least one of said first combination of parameters has changed during a communication.
4. The method of claim 3 further comprising:
passing the subsequently monitored packet to an application when ascertained that the packet belongs to the association.
5. A network monitoring system having computer program logic stored to computer-readable medium that, when executed by the system, causes the system to perform a method comprising:
monitoring packets communicated among a plurality of source and destination devices in a network using a protocol that supports multihoming, wherein an association between a source device and a destination device for communication with each other during a communication session is defined by a first combination of parameters having a first set of values, and wherein said monitoring occurs at a point disposed in said network that is external to said source and destination devices and communicatively between said source and destination devices;
resolving, based upon the determined first combination of parameters having said first set of values, a combination of source and destination verification tags that further defines the association, wherein said resolving is performed without use of packets exchanged between the source and destination devices for setting up a multi-homing association; and
ascertaining, based at least in part on at least one of the resolved source and destination verification tags, whether monitored packets belong to the association after one or more of the values of the first combination of parameters has changed during the communication session.
6. The network monitoring system of claim 5 wherein the first combination of parameters comprises source IP address, source port number, destination IP address, and destination port number.
7. A method comprising:
monitoring, by a network monitoring system, packets communicated among a plurality of source and destination devices in a network using a protocol that supports multihoming, wherein an association between a source device and a destination device for communication with each other during a communication session is defined by a first combination of parameters having a first set of values, and wherein said network monitoring system is disposed in said network independent of said source and destination devices;
resolving by the network monitoring system, based upon the determined first combination of parameters having said first set of values, a combination of source and destination verification tags that further defines the association, wherein the resolved combination of source and destination verification tags enables said network monitoring system to ascertain whether monitored packets belong to the association even when one or more of the values of the first combination of parameters has changed during the communication session; and
wherein said monitoring commences after said source and destination devices have setup a multi-homing association.