NetFlow-based NAT detection module
Vojtěch Krmíček, Jan Vykopal, Tomáš Plesník, Andrej Ružička, Pavel Čeleda, Michal Trunečka · 2009
Netflow-based NAT detection module consists of five detection methods that process extended NetFlow data (IPid, TTL, PortSequences, SubnetTTL and TCP_SYN) and aggregator. Each of detection method produces a list of IP addresses and uncertainty of NAT behind the given IP address. The aggregator evalutes and correlates these outputs and produces total uncertainty of NAT behind the given IP addres.