A NAT Network Host Probing Method Through NTP Traffic Analysis

Network probing serves as a potent technique in network security protection, enabling the effective identification of dangerous devices and potential threats. This paper focuses on network probing against Network Address Translation (NAT) hidden networks, especially for campus or public networks. However, it is noted that the traditional active probing techniques usually need to inject probes into the network, posing a challenge in public network scenarios. Moreover, current passive techniques cannot achieve high accuracy, low computational resources, and real-time requirements simultaneously. To this end, we design a host probing system named Hostprober for NAT networks based on Network Time Protocol (NTP) traffic analysis. Leveraging the widely used and featured NTP traffic, the Hostprober can identify the NTP traffic fingerprints by normalizing polling intervals and dynamically adjusting the time window. Based on the captured fingerprints, the Hostprober can reorganize the NTP traffic into traffic sets corresponding to different hosts, and match the NTP traffic to the models to achieve the purpose of host detection and network probing. Furthermore, we evaluate our proposed internal network probing method in both a controlled virtual environment and a real network environment, comparing it with other baselines. The evaluation results show that our approach demonstrates good accuracy and outperforms other comparison methods.