A NATted host Detection and Identification Algorithm based on Port Patterns of SYN Packets

Abstract

NAT(Network Address Translation), which was suggested as a solution for the shortage of IPv4(Internet Protocol version 4) addresses, translates private network addresses into global network addresses and also hides addresses of hosts behind an NAT. Due to these characteristics of an NAT, it has not been easy to detect and identify hosts behind an NAT. In this study, we researched on characteristics of an NAT and a NATted host in order to resolve difficulties in identifying NATted hosts and improved NAT Detection Algorithms after experimenting with the existing NAT Detection Algorithms. And, finally, we propose a new NATted host Detection and Identification Algorithm using Port Patterns of SYN Packets. Extending the traditional algorithms using linear patterns generated from IP ID in IP header of data packets, our proposed algorithm can identify NATted hosts and group them more efficiently by analyzing additional information in IP header such as Source IP or Source Port and improving accuracy and reducing calculation with investigating Port patterns of SYN packets. © 2014 International Information Institute.