Abstract:
The present disclosure is directed towards tracking application layer flow via a multi-connection intermediary. Transaction level or application layer information may be tracked via the intermediary, including one or more of: (i) the request method; (ii) response codes; (iii) URLs; (iv) HTTP cookies; (v) RTT of both ends of the transaction in a quad flow arrangement; (vi) server time to provide first byte of a communication; (vii) server time to provide the last byte of a communication; (viii) flow flags; or any other type and form of transaction level data may be captured, exported, and analyzed. The application layer flow or transaction level information may be provided in an IPFIX-compliant data record. This may be done to provide template-based data record definition, as well as providing data on an application or transaction level of granularity.
Abstract:
The present disclosure presents systems and methods for maintaining an original source IP address of a request by an intermediary network device despite the source IP address being modified by a cache server during an unfulfilled cache request. An intermediary receives a request from a client to access a destination server via a first transport layer connection. The client request identifies the client's IP address as a source IP address. The intermediary transmits to a cache server, via a second transport layer connection, the client request as a second request modified to include the client IP address of the first request in a header. The intermediary device receives, via a third connection, the second request as a third request from the cache server. The intermediary device obtains the client IP address from the header of the third request and transmits to the server identified in the first request the third request as a fourth request identifying the client IP address as the source IP address.
Abstract:
The present application is directed towards systems and methods for aggressively probing a client side connection to determine and counteract a malicious window size attack or similar behavior from a malfunctioning client. The solution described herein detects when a connection may be under malicious attach via improper or unusual window size settings. Responsive to the detection, the solution described herein will setup probes that determine whether or not the client is malicious and does so within an aggressive time period to avoid the tying up of processing cycles, transport layer sockets and buffers, and other resources of the sender.
Abstract:
The present disclosure presents systems and methods for maintaining an original source IP address of a request by an intermediary network device despite the source IP address being modified by a cache server during an unfulfilled cache request. An intermediary receives a request from a client to access a destination server via a first transport layer connection. The client request identifies the client's IP address as a source IP address. The intermediary transmits to a cache server, via a second transport layer connection, the client request as a second request modified to include the client IP address of the first request in a header. The intermediary device receives, via a third connection, the second request as a third request from the cache server. The intermediary device obtains the client IP address from the header of the third request and transmits to the server identified in the first request the third request as a fourth request identifying the client IP address as the source IP address.