Correlating protocol data units transiting networks with differing addressing schemes
A computer-implemented method of identifying associated communications between a first network with a first addressing scheme and a second network with a second addressing scheme is presented. The technique can include: detecting a first protocol data unit addressed from a first device in the first network and addressed to a destination in the second network, prior to translation by a network address translator; inserting, prior to translation from the first addressing scheme to the second addressing scheme, a breadcrumb protocol data unit that is addressed to the second network, the breadcrumb protocol data unit including, in a location immune from address translation by the network address translator, the source address of the first protocol data unit; receiving a translated breadcrumb protocol data unit; and reporting an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.
1. A computer-implemented method of identifying an association between a network address in a first addressing scheme and a network address in a second addressing scheme, the method comprising:
detecting a first protocol data unit from a first device in the first addressing scheme and addressed to a destination through the second addressing scheme;
inserting an additional protocol data unit, the additional protocol data unit comprising, in a location subject to address translation by a network address translator, a source address of the first protocol data unit, the additional protocol data unit further comprising, in a location immune from address translation by the network address translator, the source address of the first protocol data unit;
receiving a translated protocol data unit, wherein the translated data protocol unit comprises the additional data protocol unit after translation by the network address translator, wherein the translated protocol data unit comprises a translated source address of the first protocol data unit, and wherein the translated protocol data unit does not ever reach the destination; and
reporting an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.
2. The method of claim 1 , further comprising performing a network forensic traceback based on the association.
3. The method of claim 2 , wherein the network forensic traceback comprises identifying an original source of protocol data units in a communication session of interest.
4. The method of claim 1 , further comprising using the association to map a community of interest based on a shared network resource.
5. The method of claim 1 , wherein the first device comprises a network communication endpoint, wherein the network address translator comprises a network address translator (NAT) device.
6. The method of claim 1 ,
wherein the additional protocol data unit further comprises, in a location subject to address translation by the network address translator, a source port of the first protocol data unit, and wherein the additional protocol data unit further comprises, in a location immune from address translation by the network address translator, the source port of the first protocol data unit,
wherein the translated protocol data unit further comprises a translated source port of the first protocol data unit,
the method further comprising reporting an association of the source port of the first protocol data unit with the translated source port of the first protocol data unit.
7. The method of claim 1 , wherein one of the first addressing scheme or the second addressing scheme comprises addressing for a private internet protocol address space, and wherein another of the first addressing scheme or the second addressing scheme comprises addressing for a global internet protocol address space.
8. The method of claim 1 , wherein the first protocol data unit and the additional protocol data unit comprise network layer packets.
9. The method of claim 1 , wherein the first protocol data unit and the additional protocol data unit comprise data link layer frames.
10. The method of claim 1 , wherein one of the source address or the translated source address comprises a multi-protocol label switching (MPLS) label.
11. The method of claim 1 , wherein the additional protocol data unit comprises data representing a predetermined time to live.
12. The method of claim 1 , further comprising identifying the translated protocol data unit based on a specific value in a predetermined field of the translated protocol data unit.
13. The method of claim 1 , further comprising generating the additional protocol data unit.
14. The method of claim 1 , wherein the detecting and the inserting is performed by the first device.
15. A computer system for identifying an association between a network address in a first addressing scheme and a network address in a second addressing scheme, the system comprising:
a first sensor, comprising an electronic processor, the first sensor communicatively coupled to a first device to detect a first protocol data unit, wherein the first protocol data unit is addressed from the first device in the first addressing scheme and addressed to a destination through the second addressing scheme,
wherein the first sensor is configured to insert an additional protocol data unit, the additional protocol data unit comprising, in a location subject to address translation by a network address translator, a source address of the first protocol data unit, the additional protocol data unit further comprising, in a location immune from address translation by the network address translator, the source address of the first protocol data unit; and
a second sensor, comprising an electronic processor, communicatively coupled to the network address translator to receive a translated protocol data unit, wherein the translated data protocol unit comprises the additional data protocol unit after translation by the network address translator, wherein the translated protocol data unit comprises a translated source address of the first protocol data unit, wherein the translated protocol data unit does not ever reach the destination,
wherein the computer system is configured to report an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.
16. The computer system of claim 15 , wherein the computer system is further configured to perform a network forensic traceback based on the association.
17. The computer system of claim 16 , wherein the network forensic traceback comprises identifying an original source of protocol data units in a communication session of interest.
18. The computer system of claim 15 , wherein the computer system is further configured to use the association to map a community of interest based on a shared network resource.
19. The computer system of claim 15 , wherein the first device comprises a network communication endpoint, and wherein the network address translator comprises a network address translator (NAT) device.
20. The computer system of claim 15 ,
wherein the additional protocol data unit further comprises, in a location subject to address translation by the network address translator, a source port of the first protocol data unit, and wherein the additional protocol data unit further comprises, in a location immune from address translation by the network address translator, the source port of the first protocol data unit,
wherein the translated protocol data unit further comprises a translated source port of the first protocol data unit,
wherein the computer system is further configured to report an association of the source port of the first protocol data unit with the translated source port of the first protocol data unit.
21. The computer system of claim 15 , wherein one of the first addressing scheme or the second addressing scheme comprises addressing for a private internet protocol address space, and wherein another of the first addressing scheme or the second addressing scheme comprises addressing for a global internet protocol address space.
22. The computer system of claim 15 , wherein the first protocol data unit and the additional protocol data unit comprise network layer packets.
23. The computer system of claim 15 , wherein the first protocol data unit and the additional protocol data unit comprise data link layer frames.
24. The computer system of claim 15 , wherein one of the source address or the translated source address comprises a multi-protocol label switching (MPLS) label.
25. The computer system of claim 15 , wherein the additional protocol data unit comprises data representing a predetermined time to live.
26. The computer system of claim 15 , wherein the second sensor is configured to identify the translated protocol data unit based on a specific value in a predetermined field of the translated protocol data unit.
27. The computer system of claim 15 , wherein the first sensor is configured to generate the additional protocol data unit.
28. The computer system of claim 15 , wherein the first sensor is in the first device.