Patent ID: 7565426

Claim:
A method of determining a source of data packet flow into a plurality of network nodes forming an Autonomous System and connected to network devices that are external to the Autonomous System in a communication network, said Autonomous System including a Director that signals network nodes in said Autonomous System to initiate marking of packets, said method comprising: detecting, by a detecting entity and according to a signature, packets of a particular flow for which the source is to be determined, said detecting entity signaling said Director to start a tracing process; said Director requesting some of said network nodes to mark a subset of packets received by network nodes from said network devices through incoming interfaces during a period of time when marking network nodes are being identified and discontinue marking packets by said network nodes when there are no more marking network nodes to be identified, the marking including a router label that identifies a particular network node for each packet and an external interface label that identifies a particular incoming interface for each packet; identifying, by a detecting network node, ones of said network nodes that are marking packets of the particular flow; and for each identified network node that is marking packets of the particular flow, recording said router label and said external interface label as a source of the particular flow.