Detection of network hops and latency through an opaque tunnel and detection misconfiguration of tunnels
Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include requesting a trace to a destination with a signature inserted into a trace packet; receiving a response to the trace packet; when the response does not include tunnel info, providing details in the response to a service where the details include parameters associated with a service path between the client and the destination; and, when the response includes tunnel info, segmenting the service path into a plurality of legs, causing a trace for each of the plurality of legs, and aggregating details for each of the plurality of legs based on the causing.
1. A method implemented by a client comprising:
requesting a trace to a destination with a signature inserted into a trace packet;
receiving a response to the trace packet;
determining whether the response includes tunnel info;
in response to determining that the response includes the tunnel info, segmenting a service path between the client and the destination into a plurality of legs, causing a trace for each of the plurality of legs, aggregating details for each of the plurality of legs based on responses to the trace for each of the plurality of legs, and including a second signature in a second trace packet to an egress router to detect a network path, wherein the aggregating details includes aggregating network hops, packet drops, and latency for each of the plurality of legs;
receiving a response from the second trace packet;
when the response does not include a flag, utilizing details from the response for a leg between the client and the egress router; and
when the response includes the flag, determining the second trace packet went on a wrong network path where the second trace packet was sent over a tunnel to a tunnel server.
2. The method of claim 1 , wherein a tunnel server intercepts the trace packet responsive to detection of the signature, and wherein the tunnel server responds to the trace packet with the response with the tunnel info upon determination of the presence of a tunnel.
3. The method of claim 1 , wherein the plurality of legs include three legs.
4. The method of claim 3 , wherein a first leg is between the client and a tunnel client, a second leg is between the tunnel client and a tunnel server, and a third leg is between the tunnel server and the destination, and wherein the client, knowing there is a tunnel based on the response, requests the tunnel server to trace the tunnel.
5. The method of claim 3 , wherein a first leg is between the client and an egress router, a second leg is between the egress router and a tunnel server, and a third leg is between the tunnel server and the destination.
6. The method of claim 1 , wherein at least one of the plurality of legs includes a reverse trace from a tunnel server.
7. The method of claim 1 , wherein the tunnel info includes a type of tunnel including any of Generic Routing Encapsulation (GRE) and Internet Protocol (IP) Security (IPsec).
8. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors associated with a client to perform steps of:
requesting a trace to a destination with a signature inserted into a trace packet;
receiving a response to the trace packet;
determining whether the response includes tunnel info;
in response to determining that the response does not include the tunnel info, providing details obtained from the response to a service where the details include parameters associated with a service path between the client and the destination;
in response to determining that the response includes the tunnel info, segmenting the service path into a plurality of legs, causing a trace for each of the plurality of legs, aggregating details for each of the plurality of legs based on responses to the trace for each of the plurality of legs, and including a second signature in a second trace packet to an egress router to detect a network path, wherein the aggregating details includes aggregating network hops, packet drops, and latency for each of the plurality of legs;
receiving a response from the second trace packet;
when the response does not include a flag, utilizing details from the response for a leg between the client and the egress router; and
when the response includes the flag, determining the second trace packet went on a wrong network path where the second trace packet was sent over a tunnel to a tunnel server.
9. The non-transitory computer-readable medium of claim 8 , wherein a tunnel server intercepts the trace packet responsive to detection of the signature, and wherein the tunnel server responds to the trace packet with the response with the tunnel info upon determination of the presence of a tunnel.
10. The non-transitory computer-readable medium of claim 8 , wherein the plurality of legs include three legs.
11. The non-transitory computer-readable medium of claim 8 , wherein at least one of the plurality of legs includes a reverse trace from a tunnel server.
12. The non-transitory computer-readable medium of claim 8 , wherein the tunnel info includes a type of tunnel including any of Generic Routing Encapsulation (GRE) and Internet Protocol (IP) Security (IPsec).
13. A client comprising:
one or more processors and memory comprising instructions that, when executed, cause the one or more processors to
request a trace to a destination with a signature inserted into a trace packet;
receive a response to the trace packet;
determining whether the response includes tunnel info;
in response to determining that the response does not include the tunnel info, provide details obtained from the response to a service where the details include parameters associated with a service path between the client and the destination; and
in response to determining that the response includes the tunnel info, segment the service path into a plurality of legs, cause a trace for each of the plurality of legs, aggregate details for each of the plurality of legs based on responses to the trace for each of the plurality of legs, and include a second signature in a second trace packet to an egress router to detect a network path, wherein the aggregating details includes aggregating network hops, packet drops, and latency for each of the plurality of legs;
receive a response from the second trace packet;
when the response does not include a flag, utilize details from the response for a leg between the client and the egress router; and
when the response includes the flag, determine the second trace packet went on a wrong network path where the second trace packet was sent over a tunnel to a tunnel server.
14. The client of claim 13 , wherein a tunnel server intercepts the trace packet responsive to detection of the signature, and wherein the tunnel server responds to the trace packet with the response with the tunnel info upon determination of the presence of a tunnel.