Identifying bogon address spaces
Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.
1. A method comprising:
identifying a network address associated with a network flow;
obtaining an indication of one or more network address spaces, the indication being based on route advertisements transmitted by a plurality of routers associated with the network, the route advertisements including identifications of the one or more network address spaces;
determining whether the network address is associated with the one or more network address spaces in a network, the determining based on the route advertisements including the identifications of the one or more network address spaces;
when the network address is not associated with the one or more network address spaces, determining the network address is a bogon address and filtering and/or marking the network flow; and
when the network address is associated with the one or more network address spaces, determining the network address is not the bogon address.
2. The method of claim 1 , further comprising:
based on the determination that the network address is the bogon address, filtering the network flow.
3. The method of claim 1 , further comprising:
based on the determination that the network address is the bogon address, filtering a second network flow associated with the network address.
4. The method of claim 1 , wherein the network flow is marked when the network address is the bogon address.
5. The method of claim 1 , wherein the network flow is filtered when the network address is the bogon address.
6. The method of claim 1 , further comprising:
receiving a data report identifying the network flow via a capturing agent deployed on a host in the network.
7. The method of claim 6 , wherein the plurality of routers includes border gateway protocol (BGP) routers.
8. The method of claim 6 , wherein the capturing agent includes a process, a kernel module, and/or a software driver.
9. The method of claim 8 ,
wherein,
the capturing agent resides a hypervisor on the host or a virtual machine on the hypervisor, and
the network flow is sent or received by the hypervisor or the virtual machine.
10. The method of claim 6 , wherein the indication includes a mapping of network address spaces in the network, and wherein the network address spaces comprise at least one of:
one or more internet protocol addresses;
one or more internet protocol address ranges; and
one or more prefixes.
11. A system comprising:
one or more processors; and
one or more computer-readable storage devices having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying a network address associated with a network flow;
obtaining an indication of one or more network address spaces, the indication being based on route advertisements transmitted by a plurality of routers associated with the network, the route advertisements including identifications of the one or more network address spaces;
determining whether the network address is associated with one or more network address spaces in the network, the determining based on the route advertisements including the identifications of the one or more network address spaces;
when the network address is not associated with the one or more network address spaces, determining the network address is a bogon address and filtering and/or marking the network flow; and
when the network address is associated with the one or more network address spaces, determining the network address is not the bogon address.
12. The system of claim 11 , wherein the network flow is marked when the network address is the bogon address.
13. The system of claim 11 , wherein the network flow is filtered when the network address is the bogon address.
14. The system of claim 11 , wherein the operations include filtering at least one of a subsequent network flow associated with the network address and/or a subsequent data report identifying the subsequent network flow based on the determination that the network address is the bogon address.
15. The system of claim 11 , wherein the operations include:
receiving a data report identifying the network flow via a capturing agent deployed on a host in the network,
wherein,
the plurality of routers includes border gateway protocol (BGP) routers,
the capturing agent resides in one of a hypervisor on the host or a virtual machine on the hypervisor, and
the network flow is part of traffic sent or received by the hypervisor and/or the virtual machine.
16. A computer-readable storage device storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
identifying a network address associated with a network flow;
obtaining an indication of one or more network address spaces, the indication being based on route advertisements transmitted by a plurality of routers associated with the network, the route advertisements including identifications of the one or more network address spaces;
determining whether the network address is associated with one or more network address spaces in a network, the determining based on route advertisements including the identifications of the one or more network address spaces;
when the network address is not associated with the one or more network address spaces, determining the network address is a bogon address and filtering and/or marking the network flow; and
when the network address is associated with the one or more network address, determining the network address is not the bogon address.
17. The computer-readable storage device of claim 16 ,
wherein,
the operations include:
receiving a data report identifying the network flow via a capturing agent deployed on a host in the network,
the plurality of routers includes border gateway protocol (BGP) routers,
the capturing agent resides in one of a hypervisor on the host or a virtual machine on the hypervisor, and
the network flow is part of traffic sent or received by the hypervisor and/or the virtual machine.
18. The computer-readable storage device of claim 16 , wherein the network flow is marked when the network address is the bogon address.
19. The computer-readable storage device of claim 16 , wherein the network flow is filtered when the network address is the bogon address.
20. The computer-readable storage device of claim 16 ,
wherein,
the operations include obtaining an indication of the one or more network address spaces by generating a map of address spaces in the network, and
the one or more network address spaces include one or more internet protocol addresses and/or one or more ranges of internet protocol addresses.