The margrave tool for firewall analysis
LISA'10 Proceedings of the 24th international conference on Large installation system administration
Towards systematic design of enterprise networks
IEEE/ACM Transactions on Networking (TON)
Firewall policy change-impact analysis
ACM Transactions on Internet Technology (TOIT)
Towards an efficient verification approach on network configuration
Proceedings of the 8th International Conference on Network and Service Management
Minimizing network complexity through integrated top-down design
Proceedings of the ninth ACM conference on Emerging networking experiments and technologies
| Hi-index | 0.00 |
Quantifying and querying network reachability is important for security monitoring and auditing as well as many aspects of network management such as troubleshooting, maintenance, and design. Although attempts to model network reachability have been made, feasible solutions to computing network reachability have remained unknown. In this paper, we propose a suite of algorithms for quantifying reachability based on network configurations (mainly ACLs) as well as solutions for querying network reachability. We present a comprehensive network reachability model that considers connectionless and connection-oriented transport protocols, stateless and stateful routers/firewalls, static and dynamic NAT, PAT, etc. We implemented the algorithms in our network reachability analysis tool called Quarnet and conducted experiments on a university network. Experimental results show that the offline computation of reachability matrices takes a few hours and the online processing of a reachability query takes 0.075 seconds on average.