Granted Patent B2

US 12,634,318 · App. 18/830,386 · Granted May 19, 2026

Inventors: Steinthor Bjarnason (Fjerdingby, NO); Roman Lara (San Antonio, TX); Scott Lekel-Johnson (Ann Arbor, MI); Max Resing (Westford, MA)

Assignee: NetScout Systems, Inc.

H04L63/1425H04L63/1466H04L63/1483

Abstract

Claims (83)

1 . A system comprising:

a network monitoring device connected to a communications network, the network monitoring device configured to monitor network traffic transmitted to and from a server across the communications network, the network monitoring device comprising one or more processors coupled with memory, the memory storing executable instructions that, when executed by the one or more processors, cause the one or more processors to:

obtain a data packet of a data packet exchange between the server and a network device, the data packet comprising an internet protocol (IP) address of the network device and a time to live (TTL) value;

extract the TTL value and the IP address of the network device from the data packet;

compare the TTL value with a TTL value range automatically generated during a time-constrained observation mode by monitoring a plurality of data packet exchanges representing successful communication sessions between the server and a plurality of network devices, extracting TTL values from the plurality of data packet exchanges, and generating the TTL value range based on the extracted TTL values, wherein the time-constrained observation mode operates for a predetermined time period or until a network characteristic satisfies a condition;

determine that the TTL value is outside of the TTL value range;

apply, based on the determination that the TTL value is outside of the TTL value range, a tag to the IP address of the network device in a database stored in the memory, the tag identifying the IP address of the network device as suspicious;

execute, responsive to the application of the tag to the IP address, an authentication routine to evaluate the IP address; and

block network traffic from the IP address based on the IP address failing the authentication routine.

2 . The system of claim 1 , wherein the instructions cause the one or more processors to:

obtain a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device and a second TTL value;

extract the second TTL value and the second IP address of the second network device from the second data packet;

retrieve, from the database responsive to the extraction of the second IP address, a mapping that indicates a list of Classless Inter-Domain Routing (CIDR) blocks associated with the communications network;

detect, based on the mapping, that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network; and

apply, responsive to the detection that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network, a second tag to the second IP address in the database identifying the second IP address as suspicious.

3 . The system of claim 1 , wherein the instructions cause the one or more processors to:

obtain a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device and a second TTL value;

detect, based on a mapping between a Classless Inter-Domain Routing (CIDR) block associated with the communications network, that the second IP address is included in the CIDR block;

responsive to the detection, compare the second TTL value with the TTL value range; and

authenticate, based on a determination that the TTL value range includes the second TTL value, the second network device.

4 . The system of claim 1 , wherein the instructions cause the one or more processors to:

obtain, from an external data source, a Classless Inter-Domain Routing (CIDR) block associated with the communications network;

identify, responsive to obtaining the CIDR block, a mapping that indicates a list of IP addresses associated with the communications network;

obtain a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device;

determine that the second IP address is absent from the list of IP addresses; and

apply, responsive to the detection that the second IP address is absent from the list of IP addresses associated with the communications network, a second tag to the second IP address in the database identifying the second IP address as suspicious.

5 . The system of claim 1 , wherein the instructions cause the one or more processors to:

monitor a plurality of data packet exchanges to extract a plurality of IP addresses and a plurality of TTL values from the plurality of data packet exchanges, the plurality of data packet exchanges between the server and a plurality of network devices, and the plurality IP addresses included in a list of Classless Inter-Domain Routing (CIDR) blocks associated with the communications network.

6 . The system of claim 5 , wherein the TTL value range indicates a difference between one or more first TTL values of the plurality of TTL values and one or more second TTL values of the plurality of TTL values.

7 . The system of claim 1 , wherein the instructions cause the one or more processors to:

extract, from a second data packet of a second data packet exchange between the server and a second network device, a second IP address of the second network device and a second TTL value

determine, subsequent to the extraction of the second IP address of the second network device, that the second network device is an authenticated network device; and

prevent, responsive to the determination that the second network device is the authenticated network device and responsive to extracting the second IP address from a third data packet of the second data packet exchange, a retrieval of a Classless Inter-Domain Routing (CIDR) block) that indicates a list of IP addresses associated with the communications network.

8 . The system of claim 1 , wherein the TTL value range is selected from a plurality of TTL value ranges, wherein each TTL value range of the plurality of TTL value ranges correspond to a different network device type, and wherein the instructions cause the one or more processors to:

compare the TTL value with the TTL value range based on the network device having a network device type that corresponds to the TTL value range.

9 . A method, comprising:

obtaining, by one or more processing circuits, a data packet of a data packet exchange between a server and a network device via a communications network, the data packet comprising an internet protocol (IP) address of the network device and a time to live (TTL) value;

extracting, by the one or more processing circuits, the TTL value and the IP address of the network device from the data packet;

comparing, by the one or more processing circuits, the TTL value with a TTL value range automatically generated during a time-constrained observation mode by monitoring a plurality of data packet exchanges representing successful communication sessions between the server and a plurality of network devices, extracting TTL values from the plurality of data packet exchanges, and generating the TTL value range based on the extracted TTL values, wherein the time-constrained observation mode operates for a predetermined time period or until a network characteristic satisfies a condition;

determining, by the one or more processing circuits, that the TTL value is outside of the TTL value range;

applying, by the one or more processing circuits, based on the determination that the TTL value is outside of the TTL value range, a tag to the IP address of the network device in a database stored in memory of the one or more processing circuits, the tag identifying the IP address of the network device as suspicious;

executing, by the one or more processing circuits, responsive to the application of the tag to the IP address, an authentication routine to evaluate the IP address; and

blocking, by the one or more processing circuits, network traffic from the IP address based on the IP address failing the authentication routine.

10 . The method of claim 9 , comprising:

obtaining, by the one or more processing circuits, a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device and a second TTL value;

extracting, by the one or more processing circuits, the second TTL value and the second IP address of the second network device from the second data packet;

retrieving, by the one or more processing circuits, from the database responsive to the extraction of the second IP address, a mapping that indicates a list of Classless Inter-Domain Routing (CIDR) blocks associated with the communications network;

detecting, by the one or more processing circuits, based on the mapping, that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network; and

applying, by the one or more processing circuits, responsive to the detection that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network, a second tag to the second IP address in the database identifying the second IP address as suspicious.

11 . The method of claim 9 , comprising:

obtaining, by the one or more processing circuits, a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device and a second TTL value;

detecting, by the one or more processing circuits, based on a mapping between a Classless Inter-Domain Routing (CIDR) block associated with the communications network, that the second IP address is included in the CIDR block;

comparing, by the one or more processing circuits, the second TTL value with the TTL value range; and

authenticate, subsequent to a determination that the TTL value range includes the second TTL value, the second network device.

12 . The method of claim 9 , comprising:

obtaining, by the one or more processing circuits, from an external data source, a Classless Inter-Domain Routing (CIDR) block associated with the communications network;

identifying, by the one or more processing circuits, responsive to obtaining the CIDR block, a mapping that indicates a list of IP addresses associated with the communications network;

obtaining, by the one or more processing circuits, a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device;

determining, by the one or more processing circuits, that the second IP address is absent from the list of IP addresses; and

applying, by the one or more processing circuits, responsive to the detection that the second IP address is absent from the list of IP addresses associated with the communications network, a second tag to the second IP address in the database identifying the second IP address as suspicious.

13 . The method of claim 9 , comprising:

monitoring, by the one or more processing circuits, a plurality of data packet exchanges to extract a plurality of IP addresses and a plurality of TTL values from the plurality of data packet exchanges, the plurality of data packet exchanges between the server and a plurality of network devices, and the plurality IP addresses included in a list of Classless Inter-Domain Routing (CIDR) blocks associated with the communications network.

14 . The method of claim 13 , wherein the TTL value range indicates a difference between one or more first TTL values of the plurality of TTL values and one or more second TTL values of the plurality of TTL values.

15 . The method of claim 9 , comprising:

extracting, by the one or more processing circuits, from a second data packet of a second data packet exchange between the server and a second network device, a second IP address of the second network device and a second TTL value

determining, by the one or more processing circuits, subsequent to the extraction of the second IP address of the second network device, that the second network device is an authenticated network device; and

preventing, by the one or more processing circuits, responsive to the determination that the second network device is the authenticated network device, a retrieval of a Classless Inter-Domain Routing (CIDR) block that indicates a list of IP addresses associated with the communications network.

16 . The method of claim 9 , wherein the TTL value range is selected from a plurality of TTL value ranges, wherein each TTL value range of the plurality of TTL value ranges correspond to a different network device type, and comprising:

comparing, by the one or more processing circuits, the TTL value with the TTL value range based on the network device having a network device type that corresponds to the TTL value range.

17 . A non-transitory computer readable storage medium comprising instructions stored thereon that, when executed by one or more processors, cause the one or more processors to:

obtain a data packet of a data packet exchange between the server and a network device via a communications network, the data packet comprising an internet protocol (IP) address of the network device and a time to live (TTL) value;

extract the TTL value and the IP address of the network device from the data packet;

compare the TTL value with a TTL value range automatically generated during a time-constrained observation mode by monitoring a plurality of data packet exchanges representing successful communication sessions between the server and a plurality of network devices, extracting TTL values from the plurality of data packet exchanges, and generating the TTL value range based on the extracted TTL values, wherein the time-constrained observation mode operates for a predetermined time period or until a network characteristic satisfies a condition;

determine that the TTL value is outside of the TTL value range;

apply, based on the determination that the TTL value is outside of the TTL value range, a tag to the IP address of the network device in a database, the tag identifying the IP address of the network device as suspicious;

execute, responsive to the application of the tag to the IP address, an authentication routine to evaluate the IP address; and

block network traffic from the IP address based on the IP address failing the authentication routine.

18 . The non-transitory computer readable storage medium of claim 17 , wherein the instructions cause the one or more processors to

obtain a second data packet of a second data packet exchange between the server and a second network device, the second data packet comprising a second IP address of the second network device and a second TTL value;

extract the second TTL value and the second IP address of the second network device from the second data packet;

retrieve, from the database responsive to the extraction of the second IP address, a mapping that indicates a list of Classless Inter-Domain Routing (CIDR) blocks associated with the communications network;

detect, based on the mapping, that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network; and

apply, responsive to the detection that the second IP address does not map to any CIDR block of the list of CIDR blocks associated with the communications network, a second tag to the second IP address in the database identifying the second IP address as suspicious.

Assignments (2)

Continuity (1)

References Cited (10)