Methods and systems for SCTP probing
The application describes a method for mapping nodes of a network using Stream Control Transmission Protocol (SCTP) probing. Packets are sent to open ports of the nodes. Response packets are received from the nodes. Signatures are generated using headers of the response packets. The nodes are classified using the signatures. The node are mapped to elements of the network using the signatures. Rogue devices may be detected based on the mapped nodes.
1. A method comprising:
determining, by a mapper device, an open port of a node of a communication network using a port scanning probe;
sending, to the open port, a first packet;
receiving, from the node, a second packet including a header in response to the first sent packet;
generating, based on the header, a signature of the node;
classifying the signature based on a type of the communication network or an operating system of the node.
2. The method of claim 1 , wherein
the classifying the signature step is based on a function of the node.
3. The method of claim 2 , wherein the function of the node comprises at least one of a signaling gateway, a media gateway controller, and a packet data network (pdn) gateway.
4. The method of claim 1 , wherein the first packet comprises a SCTP_INIT request and the second packet comprises a INIT_ACK response.
5. The method of claim 1 , wherein the header comprises a transmission sequence number.
6. The method of claim 1 , further comprising:
determining if the signature is stored in a database; and
storing the signature in the database based upon signature not being in the database.
7. The method of claim 6 , further comprising:
identifying the node using the database.
8. A device comprising:
a processor; and
a memory comprising instructions that, when executed by the processor, cause the processor to:
send a Stream Control Transmission Protocol (SCTP) probe to an open port of a node of a communication network;
receive, from the node, a packet including a header in response to the SCTP probe;
generate, based on the header, a signature of the node; and
classify the signature based on at least two of a function of the node, type of the communication network, and an operating system of the node.
9. The device of claim 8 , wherein the header comprises an advertised receiver window credit.
10. The device of claim 8 , wherein the header comprises a number of outbound streams and a number of inbound streams.
11. The device of claim 8 , wherein the instructions, when executed, further cause the processor to:
map devices in the communication network using generated signatures; and
determining that an element is not in the communication network based on the mapping.
12. The device of claim 8 , wherein the instructions, when executed, further cause the processor to store a classification of the node in a database of elements of the communication network.
13. A method comprising:
receiving, from a device in a communication network, a first packet having a header;
determining, based on the header, a signature of the device based on a type of the communication network or an operating system of the device;
querying a database of compiled signatures of nodes of the communication network for the signature of the device, where the compiled signatures are based on headers of packets received in response to probing the nodes;
determining the signature of the device is not in the database;
determining a characteristic of the signature of the device is different from a shared characteristic of the compiled signatures of the nodes in the database; and
generating an alert that the device in the communication network is rogue.
14. The method of claim 13 , further comprising authenticating another device in the communication network using the database.
15. The method of claim 13 , wherein the characteristic of the signature of the device comprises a characteristic of the header.
16. The method of claim 13 , further comprising:
adding the device to a list of rogue devices; and
monitoring the communication network for the rogue devices.
17. The method of claim 13 , further comprising:
alerting an administrator of the communication network of the rogue device.
18. The method of claim 13 , wherein the characteristic comprises a classification of the signature based on a type of element of the communication network.
19. The method of claim 18 , wherein the type of the element of the communication network comprises at least one of a base station, a home subscriber server, a mobile management entity, and a transfer point.
20. The method of claim 18 , wherein the type of the element of the communication network comprises a part of an evolved packet core (EPC).