Identifying bogon address spaces
Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.
1. A method, comprising:
identifying a network address associated with a network flow;
obtaining an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determining whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determining the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.
2. The method of claim 1 , wherein the messages are transmitted as border gateway protocol messages.
3. The method of claim 1 , further comprising dropping the network flow based on the determination that the network address is the bogon address.
4. The method of claim 1 , further comprising:
dropping a second network flow associated with the network address, based on the determination that the network address is the bogon address.
5. The method of claim 4 , wherein the second network flow occurs, at least in part, after the network flow and includes the network address in a header of data transmitted in the second network flow.
6. The method of claim 1 , further comprising:
receiving a data report identifying the network flow via a capturing agent deployed on a host in the network.
7. The method of claim 6 , wherein the capturing agent is run on a processor, a kernel module, a software driver, or a combination thereof.
8. The method of claim 6 , wherein the capturing agent resides in a hypervisor on the host or a virtual machine on the hypervisor and the network flow is sent or received by the hypervisor or the virtual machine.
9. The method of claim 1 , further comprising:
determining the network address is not the bogon address when the network address is associated with the one or more reserved network address spaces.
10. A system comprising:
one or more processors; and
a computer-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the one or more processors to:
identify a network address associated with a network flow;
obtain an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determine whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determine the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.
11. The system of claim 10 , wherein the messages are transmitted as border gateway protocol messages.
12. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to drop the network flow based on the determination that the network address is the bogon address.
13. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to drop a second network flow associated with the network address, based on the determination that the network address is the bogon address.
14. The system of claim 13 , wherein the second network flow occurs, at least in part, after the network flow and includes the network address in a header of data transmitted in the second network flow.
15. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to receive a data report identifying the network flow via a capturing agent deployed on a host in the network.
16. The system of claim 15 , wherein the capturing agent is run on a processor, a kernel module, a software driver, or a combination thereof.
17. The system of claim 15 , wherein the capturing agent resides in a hypervisor on the host or a virtual machine on the hypervisor and the network flow is sent or received by the hypervisor or the virtual machine.
18. The system of claim 10 , wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to determine the network address is not the bogon address when the network address is associated with the one or more reserved network address spaces.
19. A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the one or more processors to:
identify a network address associated with a network flow;
obtain an indication of one or more reserved network address spaces, the indication being based on messages transmitted by a plurality of routers associated with the network flow, the messages including identifications of the one or more reserved network address spaces;
determine whether the network address is associated with the one or more reserved network address spaces in a network, the determining based on the messages including the identifications of the one or more reserved network address spaces; and
determine the network address is a bogon address when the network address is not associated with the one or more reserved network address spaces.
20. The non-transitory computer-readable storage medium of claim 19 , wherein the messages are transmitted as border gateway protocol messages.