Abstract:
Tokens identifying all of the physical routing devices, i.e., network nodes, through which a packet travels are recorded in a limited amount of space reserved in the header of the packet for such tokens. When insufficient space remains in the header of the packet for all tokens required to identify all physical routing devices through which the packet travels, sequences of multiple tokens are replaced with an abbreviation token representing the sequence. The sequence of tokens represented by an abbreviation token can also be abbreviation tokens, supporting recursive abbreviation of the token sequence in the header of the packet as needed to record the entire route of the packet through the network regardless of the limited space in the header for tracking the route of the packet.

Description:
[0001]    This application is a continuation of U.S. patent application Ser. No. 13/279,164, filed Oct. 21, 2011, which claims priority to U.S. Provisional Application 61/443,598, filed Feb. 16, 2011. These applications are fully incorporated herein by reference. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    1. 
       Field of the Invention 
       [0003]    The present invention relates generally to computer networking and, more particularly, to methods of and systems for transporting packets through a network while supporting packet traceback. 
         [0004]    2. Description of the Related Art 
         [0005]    It is advantageous to trace a particular route by which a packet is transported through a network. However, packets that are transported through networks have fixed lengths while the number of hops each packet can take through a network vary widely. Allocating insufficient space to record the route of a packet within the packet defeats proper tracing of the route. Often, there are no limits on the number of hops a packet can take through a network and so there is no amount of space that can be reserved in a packet to guarantee accuracy for route tracing. Even in situations in which the number of hops a packet may take are limited, allocating space to record the maximum packet route in each packet will waste precious bandwidth for all packets taking less than the maximum packet route. 
       SUMMARY OF THE INVENTION 
       [0006]    In accordance with the present invention, tokens identifying all of the physical routing devices, i.e., network nodes, through which a packet travels are recorded in a limited amount of space reserved in the header of the packet for such tokens. When insufficient space remains in the header of the packet for all tokens required to identify all physical routing devices through which the packet travels, sequences of multiple tokens are replaced with a single token representing the sequence. 
         [0007]    The single token is sometimes referred to herein as an abbreviation token. The sequence of tokens represented by an abbreviation token can also be composed of abbreviation tokens, supporting recursive abbreviation of the token sequence in the header of the packet as needed to record the entire route of the packet through the network regardless of the limited space in the header for tracking the route of the packet. 
         [0008]    To identify the physical nodes through which the packet travels, the tokens are derived from hardware features of each node, much the way a digital fingerprint is derived. Accordingly, identification of the physical nodes through which the packet travels cannot be defeated by spoofing easily reconfigurable attributes such as network addresses. 
         [0009]    Various nodes of the network can learn the tokens of adjacent nodes of the network through interior gateway routing protocols such as RIP packets or Hello packets found in OSPF or similar protocols. Nodes can also encrypt the packet for secure hops using the token of the next node as an encryption key. 
         [0010]    The abbreviation tokens can be produced in a manner that is consistent throughout all nodes of the network such that expansion of abbreviation tokens to reconstruct the route of the packet can be achieved by any device that knows the abbreviation token generation method. 
         [0011]    The abbreviation tokens can also be generated by each node using its own particular method. In such cases, the node that generates an abbreviation token ensures that its own token immediately follows the abbreviation token to thereby identify itself as the node that can properly expand the abbreviation token. To reconstruct the route of a packet through the network, the node generating each abbreviation token is identified and asked to expand the abbreviation token. 
         [0012]    Specifically, a first aspect of the present invention accordingly provides a method for routing a packet through a network from a source to a destination, the method comprising: storing data in a header of the packet to represent a complete route of the packet through the network, the data identifying at least one physical routing device of the network through which the packet travels. 
         [0013]    In another form, the method further comprises replacing data identifying at least two physical routing devices with a single token in the header of the packet such that the single token identifies the at least two physical routing devices. 
         [0014]    In another form, the method further comprises storing data in the header of the packet that identifies a particular physical routing device that performs the replacing. 
         [0015]    In another form, the storing is performed by node logic executing within each physical routing device that receives the packet along the route. 
         [0016]    In a second aspect, the present invention accordingly provides a method for identifying a particular route taken by a packet through a network, the method comprising: 
         [0017]    retrieving one or more tokens from a header of the packet, the tokens collectively identifying one or more physical routing devices through which the packet traveled; 
         [0018]    determining that at least a selected one of the tokens represent two or more other tokens; and replacing the selected with the two or more other tokens. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]    Other systems, methods, features and advantages of the invention will be or will become apparent to one with skill in the art upon examination of the following figures and detailed description. It is intended that all such additional systems, methods, features and advantages be included within this description, be within the scope of the invention, and be protected by the accompanying claims. Component parts shown in the drawings are not necessarily to scale, and may be exaggerated to better illustrate the important features of the invention. In the drawings, like reference numerals may designate like parts throughout the different views, wherein: 
           [0020]      FIG. 1  is a diagram showing computers, including a node manager, connected through a computer network that includes a number of nodes that transport packets in accordance with the present invention. 
           [0021]      FIG. 2  is a block diagram showing a node of  FIG. 1  in greater detail. 
           [0022]      FIG. 3  is a logic flow diagram of the transport of a packet by the node of  FIG. 1  in accordance with the present invention. 
           [0023]      FIG. 4  is a logic flow diagram showing a step of the logic flow diagram of  FIG. 3  in greater detail. 
           [0024]      FIG. 5  is a logic flow diagram showing a step of the logic flow diagram of  FIG. 4  in greater detail. 
           [0025]      FIG. 6  is a block diagram of a token definition of the token database of  FIG. 2  in greater detail. 
           [0026]      FIG. 7  is a block diagram of a packet that includes a number of token slots in its header in accordance with the present invention. 
           [0027]      FIGS. 8A-8E  are block diagrams illustrating the recording of the route of a packet, including the use of abbreviation tokens. 
           [0028]      FIG. 9  is a logic flow diagram illustrating the reconstruction of the route taken by a packet through the network of  FIG. 1 . 
           [0029]      FIGS. 10A-10E  are block diagrams illustrating the reconstruction of the route recorded in  FIGS. 8A-8E  according to the logic flow diagram of  FIG. 9 . 
       
    
    
     DETAILED DESCRIPTION 
       [0030]    In accordance with the present invention, nodes  108 A-I of network  106  transport packets in a manner that records the full route of each packet through network  106  while requiring a relatively small portion of fixed size within each packet for the recording. The route identifies individual, specific ones of nodes  108 A-I and not merely IP addresses or other easily configurable or modifiable characteristics of nodes  108 A-I. 
         [0031]    As described more completely below, each of nodes  108 A-I has an identifying token that is unique among tokens of nodes within network  106 . The identifier is derived from data specific to each of nodes  108 A-I such that the identifier identifies a specific node device. When a packet is routed to any of nodes  108 A-I, the receiving node records its token within the packet to thereby record the receiving node as part of the route of the packet. When recorded tokens have filled the limited space of the packet allocated for recording the route, a receiving node replaces multiple tokens in the recorded route with a single token that represents the sequence of replaced tokens, to thereby free space to record additional tokens of the packet&#39;s route. 
         [0032]    Before describing the recording of a packet&#39;s route through network  106  in accordance with the present invention, some elements of node  108 A ( FIG. 1 ) are briefly described. Nodes  108 A-I are analogous to one another and the following description of node  108 A is equally applicable to each of nodes  108 B-I except as noted herein. 
         [0033]    Node  108 A is shown in greater detail in  FIG. 2  and includes one or more microprocessors  202  (collectively referred to as CPU  202 ) that retrieve data and/or instructions from memory  204  and execute retrieved instructions in a conventional manner. Memory  204  can include generally any computer-readable medium including, for example, persistent memory such as magnetic and/or optical disks, ROM, and PROM and volatile memory such as RAM. 
         [0034]    CPU  202  and memory  204  are connected to one another through a conventional interconnect  206 , which is a bus in this illustrative embodiment and which connects CPU  202  and memory  204  to network access circuitry  208 . Network access circuitry  208  sends and receives data through a network  106  ( FIG. 1 ) and includes ethernet circuitry or fiber optic circuitry in some embodiments. 
         [0035]    Node  108 A is shown without user input and output, i.e., user-interface devices. While many nodes of a network do not have user-interface devices, some nodes are computers intended to be used by a person and therefore do include user-interface devices. 
         [0036]    A number of components of node  108 A are stored in memory  204 . In particular, routing logic  210  is all or part of one or more computer processes executing within CPU  202  from memory  204  in this illustrative embodiment but can also be implemented using digital logic circuitry. As used herein, “logic” refers to (i) logic implemented as computer instructions and/or data within one or more computer processes and/or (ii) logic implemented in electronic circuitry. Routing table  212  and token table  214  are data stored persistently in memory  204 . In this illustrative embodiment, routing table  212  and token table  214  are each organized as a database. 
         [0037]    Logic flow diagram  300  ( FIG. 3 ) illustrates the processing of packets by routing logic  210  of node  108 A to thereby transport the packets through network  106 . In step  302 , routing logic  210  receives the packet through network access circuitry  208  ( FIG. 2 ). In step  304  ( FIG. 3 ), routing logic  210  determines the next node to which the packet should be sent toward the packet&#39;s ultimate destination through network  106  by reference to routing table  212  ( FIG. 2 ). Steps  302  ( FIGS. 3) and 304  are conventional and are known and are not described further herein. 
         [0038]    In step  306 , routing logic  210  tags the packet with the token of node  108 A in a manner described more completely below in conjunction with logic flow diagram  306  ( FIG. 4 ). In alternative embodiments, routing logic  210  can tag the packet with the token of the next node determined in step  304  in addition to or instead of tagging the packet with the token of node  108 A. In such alternative embodiments, node  108 A at least knows the token of each adjacent node among nodes  108 A-I and stores all known tokens in routing table  212  ( FIG. 2 ). In embodiments in which nodes  108 A-I know each other&#39;s tokens, nodes  108 A-I inform one another of their tokens in a manner described below during network configuration. 
         [0039]    In step  308  ( FIG. 3 ), routing logic  210  sends the packet as tagged to the next node toward the ultimate destination of the packet through network  106 . The sending of a packet to a next node is conventional and known and not described further herein. However, in some embodiments in which each of nodes  108 A-I knows the tokens of at least its adjacent nodes, the sending node can encrypt payload  706  of the packet for the next node, thereby preventing interception of the packet by an unauthorized node or other nefarious logic that might be injected into either node  108 A or the node to which node  108 A sends the packet. 
         [0040]    Logic flow diagram  306  ( FIG. 4 ) shows step  306  in greater detail. In step  402 , routing logic  210  finds the first empty token slot of the packet. An example of a packet transported by node  108 A is shown as packet  702  ( FIG. 7 ). 
         [0041]    Packet  702  includes a header  704  and a payload  706 . Payload  706  is that portion of packet  702  that is data intended to be transported through network  106  and is conventional. Header  704  is mostly conventional except that header  704  includes a number of token slots  708 A-C, each of which can store a single token. In this illustrative embodiment, each token is  16  octets in length and header  704  can store three ( 3 ) tokens, one in each of token slots  708 A-C. Of course, tokens can be of different lengths and header  704  can include different numbers of token slots in alternative embodiments. 
         [0042]    In this illustrative embodiment, an empty token slot stores all zeros. Accordingly,  16  octets of all zeros is not a valid token. Thus, routing logic  210  finds the first empty token slot by identifying the first of token slots  708 A-C that stores all zeros. 
         [0043]    In test step  404  ( FIG. 4 ), routing logic  210  determines whether an empty token slot was found in step  402 . 
         [0044]    If so, processing transfers to step  414  in which routing logic  210  stores the token of node  108 A into the first empty token slot of the packet. As noted above, routing logic  210  can store the token of the next node in the first empty slot of the packet, first ensuring that the token of node  108 A is stored in the immediately preceding token slot. 
         [0045]    Conversely, if routing logic  210  did not find an empty token slot in step  402 , processing by routing logic  210  transfers from test step  404  to step  406 . 
         [0046]    In step  406 , routing logic  210  retrieves the tokens from the packet, e.g., retrieves the tokens stored in token slots  708 A-C. 
         [0047]    In step  408 , routing logic  210  determines an abbreviation for a sequence of at least two tokens in a manner described more completely below with respect to logic flow diagram  408  ( FIG. 5 ). The abbreviation is itself a token that is unique among all tokens known to node  108 A and all tokens for any nodes of network  106 . 
         [0048]    In step  410 , routing logic  210  replaces the two or more tokens represented by the abbreviation with the abbreviation itself. Since the abbreviation is a single token replacing at least two other tokens, at least one token slot will be freed and therefore empty. Routing logic  210  marks the token slots freed by replacement with the abbreviation as empty by storing all zeros therein. 
         [0049]    In step  412 , routing logic  210  identifies the first empty token slot after the abbreviation substitution of step  410 . 
         [0050]    Processing transfers from step  412  to step  414  in which routing logic  210  stores the token of node  108 A into the first empty token slot of the packet as described above. After step  414 , processing according to logic flow diagram  306  ends, and therefore step  306  ( FIG. 3 ), completes. 
         [0051]    Step  408  ( FIG. 4 ) is shown in greater detail as logic flow diagram  408  ( FIG. 5 ). 
         [0052]    In step  502 , routing logic  210  retrieves, from token table  214  ( FIG. 2 ), an abbreviation token that represents the full sequence of tokens retrieved from token slots  708 A-C of the subject packet. In other embodiments, routing logic  210  can also retrieve an abbreviation token that represents a contiguous sub-sequence of the full sequence of retrieved tokens. 
         [0053]    Token table  214  includes one or more token definitions such as token definition  602  ( FIG. 6 ). Token definition  602  includes a token  604  and a definition  606 . Definition  606  is a sequence of two or more tokens. Token  604  is a token that is an abbreviation of the sequence of tokens represented in definition  606 . 
         [0054]    To identify an abbreviation for a sequence of two or more tokens, routing logic  210  searches token table  214  for a token definition whose definition  606  is that sequence. The corresponding token  604  is the abbreviation. 
         [0055]    In test step  504  ( FIG. 5 ), routing logic  210  determines whether an abbreviation was found within token table  214  in step  502 . If so, routing logic  210  determines, in step  506 , that the retrieved abbreviation is the appropriate abbreviation for the sequence of tokens and processing according to logic flow diagram  408 , and therefore step  408  ( FIG. 4 ) completes. 
         [0056]    In alternative embodiments, routing logic  210  can use a hashing function to map multiple tokens to a single abbreviation token. In such embodiments, the look-up and test of steps  502  and  504  can be replaced with a single hashing step. In some embodiments, the hashing function is designed to avoid producing hashed tokens that can be confused with a node token. Processing from such a hashing step would transfer to step  506 , which is described above. 
         [0057]    Returning to logic flow diagram  408  ( FIG. 5 ), if an abbreviation was not found within token table  214  in step  502 , processing by routing logic  210  transfers from test step  504  to step  508 . 
         [0058]    In step  508 , routing logic  210  creates a token that is unique from all abbreviation tokens stored in token table  214  ( FIG. 2 ) and from all tokens of nodes in network  106  ( FIG. 1 ). In this illustrative embodiment, the total range of values for legitimate tokens is divided into a range reserved for nodes of network  106  and a range that each of nodes  108 A-I can use in their respective token tables  214 . For example, for a token  16  octets in length, all tokens in which the most significant octet is zero can be reserved for tokens of nodes of network  106 . That would leave roughly seven times as many tokens for representing sequences of tokens within each node. Similar rules may be applied in other embodiments where the token has a length other than  16  octets. For example, in a system having token lengths of 4 octets, all tokens in which the most significant bit is zero can be reserved for tokens of nodes of network  106 , while all other 4-octet tokens may represent token sequences. 
         [0059]    Each of nodes  108 A-I is informed of the reserved token range during the registration process by which each node is assigned its own token. During system configuration, each of nodes  108 A-I registers with node manager  110 , identifying itself with a digital fingerprint in this illustrative embodiment. Digital fingerprints are known and are described, e.g., in U.S. Pat. No. 5,490,216 and that description is incorporated herein by reference. In general, a digital fingerprint uniquely identifies the physical device (e.g., a computer or router) based on a sampling of user-configurable and/or non-user-configurable machine parameters readable from the device, wherein each parameter may represent a particular hardware or a software configuration associated with the device. 
         [0060]    It should be appreciated that the token created by routing logic  210  in step  508  need not be unique with respect to tokens used by nodes  108 B-I in their respective token tables. As a result, routing logic  210  of node  108 A need not consult any other node or computer to create an adequately unique new token in step  508 , thus avoiding significant delay in transport of the subject packet to its ultimate destination through network  106 . However, in such embodiments, routing logic  210  of node  108 A should take care to not replace the last token of node  108 A with an abbreviation as the last token of node  108 A identifies node  108 A as the particular one of nodes  108 A-I that is capable of reversing the abbreviation. In alternative embodiments, creation of an abbreviation token for multiple other tokens can be performed in a way that is both deterministic and global within nodes  108 A-I such that an abbreviation used by any of nodes  108 A-I can be properly reversed by any of nodes  108 A-I. In these alternative embodiments, routing logic  210  of node  108 A can replace the last token of node  108 A with an abbreviation. 
         [0061]    In step  510 , routing logic  210  creates a new token definition that associates the token created in step  508  with the sequence of tokens to be replaced with the new token. 
         [0062]    In step  512 , routing logic  210  returns the token created in step  508  as the abbreviation token and ends processing according to logic flow diagram  408 , and therefore step  408  ( FIG. 4 ) completes. 
         [0063]    To illustrate the packet transportation described above, the recording of a route of a packet transported through network  106  ( FIG. 1 ) from computer  102  to computer  104  is described. As shown in  FIG. 1 , computer  102  connects to network  106  through node  108 A. Accordingly, node  108 A is the first to process a packet from computer  102 . 
         [0064]    As shown in  FIG. 8A , token slots  708 A-C of the packet are initially all empty. Performance of step  306  by node  108 A results in node  108 A storing its token in the first empty token slot, i.e., in token slot  708 A in this illustrative example. Node  108 A forwards the packet so tagged to node  108 C. 
         [0065]    As shown in  FIG. 8B , when received by node  108 C, token slot  708 A stores the token of node  108 A and token slots  708 B-C of the packet are initially empty. Performance of step  306  by node  108 C results in node  108 C storing its token in the first empty token slot, i.e., in token slot  708 B in this illustrative example. Node  108 C forwards the packet so tagged to node  108 F. 
         [0066]    As shown in  FIG. 8C , when received by node  108 F, token slot  708 A stores the token of node  108 A, token slot  708 B stores the token of node  108 C, and token slot  708 C is empty. Performance of step  306  by node  108 F results in node  108 F storing its token in the first empty token slot, i.e., in token slot  708 C in this illustrative example. Node  108 F forwards the packet so tagged to node  108 H. 
         [0067]    As shown in  FIG. 8D , when received by node  108 H, token slot  708 A stores the token of node  108 A, token slot  708 B stores the token of node  108 C, and token slot  708 C stores the token of node  108 F. None of token slots  708 A-C is empty. Performance of step  306  by node  108 H results in (i) replacement of the sequence of tokens for nodes  108 A,  108 C, and  108 F with an abbreviation  802  and (ii) node  108 H storing its token in the first empty token slot, i.e., in token slot  708 B in this illustrative example. Replacing three (3) tokens with one (1) frees up two token slots in the subject packet. In addition, since the token of node  108 H immediately follows abbreviation  802 , node  108 H is marked as the author of abbreviation  802 . Such is used in reconstructing the route of the subject packet in the manner described below. Node  108 H forwards the packet so tagged to node  1081 . 
         [0068]    Node  1081  processes the packet in an analogous manner and stores its own token in token slot  708 C as shown in  FIG. 8E . It should be appreciated that another node can replace abbreviation  802 , the token of node  108 H, and the token of node  1081  with another abbreviation token. Node  1081  forward the packet tagged with the token of node  1081  to computer  104 , to thereby effect delivery of the packet to computer  104 . 
         [0069]    Tracing a route taken by a particular packet is illustrated by logic flow diagram  900  ( FIG. 9 ). The steps of logic flow diagram can be performed by logic in any of nodes  108 A-I, node manager  110 , and computers  102  and  104 . For the purposes of current discussion, the logic is referred to as “traceback logic”. 
         [0070]    The traceback logic stores a route  1002  ( FIGS. 10A-E ) and a token list  1004 , both of which are lists of tokens. Initially, route  1002  is empty and token list  1004  includes the tokens stored in token slots  708 A-C of the subject packet, as shown in  FIG. 10A . 
         [0071]    Loop step  902  and next step  914  define a loop in which the traceback logic processes route  1002  and token list  1004  according to steps  904 - 912  until token list  1004  is empty. 
         [0072]    In step  904 , the traceback logic pops the last token from token list  1004 . As used herein, popping the token from token list  1004  means retrieving the token from the last position in token list  1004  and removing the retrieved token from token list  1004 . As shown in  FIG. 10A , the last token of token list  1004  identifies node  1081 . 
         [0073]    In test step  906 , the traceback logic determines whether the popped token identifies a node. If so, processing transfers to step  908 . Conversely, if the popped token does not identify a node, processing by the traceback logic transfers from test step  906  to step  910 . 
         [0074]    In this illustrative example, the token popped from the last position in token list  1004  is the token of node  1081 . Accordingly, processing by the traceback logic transfers to step  908  in which the traceback logic pushes the popped token onto the beginning of route  1002 . The result is shown in  FIG. 10B  in which the token for node  1081  is popped from the end of token list  1004  and is pushed on to the beginning of route  1002 . 
         [0075]    After step  908 , processing by the traceback logic transfers to next step  914 , in which the loop of steps  902 - 914  are repeated if token list  1004  is not empty. 
         [0076]    In the next iteration of the loop of steps  902 - 914  in this illustrative example, the traceback logic pops the token of node  108 H from the end of token list  1004  and pushes the token on to the beginning of route  1002  in an analogous manner. The result is shown in  FIG. 10C . 
         [0077]    In the next iteration of the loop of steps  902 - 914  in this illustrative example, the traceback logic pops abbreviation  802  ( FIG. 10C ) from the end of token list  1004 . In test step  906  ( FIG. 9 ), the traceback logic determines that abbreviation  802  is not a node token and processing of the traceback logic transfers to step  910 . 
         [0078]    In step  910 , the traceback logic queries the node whose token is at the top of route  1002  ( FIG. 10C ) for expansion of abbreviation  802 . It should be appreciated that, in embodiments such as those described above in which an abbreviation is a hash of the multiple tokens and is produced in a manner shared by all of nodes  108 A-I, it is unnecessary to query the particular one of nodes  108 A-I that stored abbreviation  802  in the packet and step  910  is therefore obviated. However, as described above in some embodiments, each of nodes  108 A-I maintains its own token table  214  ( FIG. 2 ) separately and independently of other nodes of network  106 . Accordingly, the only node of network  106  that can expand abbreviation  802  in this illustrative embodiment is the node that created abbreviation  802 . Since the node that created abbreviation  802  in a performance of step  408  ( FIG. 4 ) stored its own token in the subject packet in step  414 , the token immediately following abbreviation  802  identifies the node that authored abbreviation  802 . 
         [0079]    As shown in  FIG. 10C , the token of node  108 H is at the top of route  1002  and is therefore the node that created abbreviation  802 . The traceback logic therefore queries node  108 H for expansion of abbreviation  802  in step  910 . Each of nodes  108 A-I is configured to receive requests for expansion of abbreviation tokens and to respond by returning the sequence of tokens associated with the received abbreviation token within token table  214 . In this illustrative example, node  108 H responds with the sequence described above, namely, tokens for nodes  108 A,  108 C, and  108 F in order. 
         [0080]    In step  912 , the traceback logic appends the token sequence received in step  910  to token list  1004  ( FIG. 10D ). As shown in  FIG. 10D , token list  1004  does not include abbreviation  802  (popped from token list  1004  in step  904 ) and includes the expansion thereof (appended in step  912 ). It should be appreciated that the token list resulting from expansion of abbreviation  802  can include other abbreviations, including abbreviations authored by other nodes. 
         [0081]    Subsequent iterations of the loop of steps  902 - 914  ( FIG. 9 ) by the traceback logic result in moving the tokens of nodes  108 F,  108 C, and  108 A from the end of token list  1004  to route  1002  in sequence until token list  1004  is empty, as shown in  FIG. 10E . 
         [0082]    Thus, in accordance with the present invention, a route of five ( 5 ) hops was completely recorded and reconstructed from only three (3) slots available to record nodes to which the packet hopped. Given the recursive nature of the recording of the nodes as described above, i.e., that abbreviations of token sequences can themselves include abbreviations of token sequences that can in turn include abbreviations of token sequences, the length of a packet route through a network that can be traced is unlimited, aside from the practical limitations of the collective capacity of token table  214  of all nodes of the network. 
         [0083]    As described above, some embodiments require that each of nodes  108 A-I knows all the tokens of at least its adjacent nodes, i.e. those of nodes  108 A-I with which data is directly exchanged. Of course, all of nodes  108 A-I can know the tokens of all others of nodes  108 A-I, but such is not always necessary. For example, since node  108 A never directly exchanges data with node  108 D, node  108 A is not always required to have the token of node  108 D. 
         [0084]    As described briefly, each of nodes  108 A-I receives a token from node manager  110 . Node manager  110  derives the token from a digital fingerprint of each node. Thus, the token identifies the particular physical device that acts as a node and not an easily reconfigurable attribute such as a network address. 
         [0085]    Nodes  108 A-I learn the tokens of others of nodes  108 A-I during route configuration. Route configuration involves an exchange of information among nodes  108 A-I to build routing table  212 . In particular, each of nodes  108 A-I builds a routing table such that a given destination address of a packet indicates to which node the packet should be forwarded. Conventional route configuration protocols include RIP (Routing Information Protocol), EIGRP (Enhanced Interior Gateway Routing Protocol), and OSPF (Open Shortest Path First). 
         [0086]    In each such route configuration protocol, one or more packets are exchanged between nodes  108 A-I to share various elements of information of nodes  108 A-I that can be used by each of nodes  108 A-I to properly identify a next node in routing a particular packet to its destination. In this illustrative embodiment, nodes  108 A-I include their respective tokens assigned by node manager  110  in such route configuration packets, either by including the token as a field in a packet conveying other items of information (such as an additional field in a RIP packet) or as an additional packet such as a Hello packet in EIGRP or OSPF. 
         [0087]    The above description is illustrative only and is not limiting. The present invention is defined solely by the claims which follow and their full range of equivalents. It is intended that the following appended claims be interpreted as including all such alterations, modifications, permutations, and substitute equivalents as fall within the true spirit and scope of the present invention.