Resolution of address translations

摘要

TCP packets or UDP datagrams, travelling between a user (100) and a server (105) via a Network or Port Address Translation(NAT/PAT) device (110) are tapped at two points (120, 125), respectively before entering and after leaving the device (110), and associated into sessions. An IPQuint (IPQ), comprising source and destination addresses and ports and the IP protocol, of each packet from the same session is investigated by passive correlation device (115) to look for matching destination addresses, ports and IP protocol. Preferably a hash of the IPQ fields is taken and compared. The source addresses of matching packets from each tap point can then be correlated. If no unique match is found, then other packet fields may be compared.