KR101210622B1 - Method for detecting ip shared router and system thereof - Google Patents

Abstract

According to an embodiment of the present invention, an IP router for providing Internet services to a plurality of user terminals with one public IP is detected. At this time, the IP router detection system receives a plurality of web service request messages from a plurality of web service request messages received through an IP network, using a source port number of a web service request message matching a source IP address and a user agent field. Extract according to. The extracted source port numbers are classified into one or more groups by analyzing patterns that change in time order.
At this time, the number of user terminals using the IP router is calculated based on the number of classified groups.

Description

Method for detecting IP router and system for performing the same {METHOD FOR DETECTING IP SHARED ROUTER AND SYSTEM THEREOF}

The present invention relates to a method for detecting an IP router and a system for performing the same. More particularly, the present invention relates to a method and a system for detecting the use of an IP router and the number of user terminals connected to the IP router.

Devices such as computers are assigned with a unique identification number called a public IP address (Internet Protocol Address) from an Internet Service Provider (ISP) to perform Internet-based communication.

Currently, I use an IP router for efficient and private use of these public IP addresses. The IP sharer allows Internet users to use the Internet simultaneously with a single public IP address. For example, a private network is configured using a network address translation (NAT) device.

However, as the IP routers increase, the amount of bandwidth available in a wired / wireless network environment decreases, and subscribers frequently use IP routers to use the network at low cost.

As a result, increasing network traffic is causing serious problems. In addition, financial security events, major portal sites and security sites that illegally obtain funds for transactions by phishing, internet banking sites that steal valuable information such as IDs and passwords using network instability and application vulnerability of client PCs, etc. Disrupted Denial of Service (DDoS) attacks have occurred frequently. If a PC that is doing this attack exists in a private network, there is a great need to block it.

Conventionally, various methods for detecting the use of an IP router have been proposed to solve such a problem, and can be classified into three types as follows.

First, a method of analyzing a Transmission Control Protocol / Internet Protocol (TCP / IP) packet includes a method of using cookie information and a method of using an Initial Sequence Number (ISN) of a TCP header.

However, the use of cookie information requires a monitoring of downlink traffic as well as uplink traffic, thereby increasing the workload.

In addition, when using the ISN of the TCP header, the ISN is an initial sequence number and a number generated when a TCP connection request is generated. The initial value is 1, and is generated on the basis of a time counter that increments by 1 every 4 ms. Therefore, since the ISN number is sequentially increased with time after the time synchronization process, the ISN number can be easily guessed.

However, if the ISN is sequentially increased in this way, there is a lot of potential for security incidents. This is because the 3-way handshaking authentication method used in the TCP / IP protocol uses ISN and AN (Acknowledgment Number). For example, an attacker sends an ACK to the server (IP: 2.2.2.2) before the original client (IP: 1.1.1.1) after tampering with the IP, thus establishing a reliable connection between the attacker and the server (IP: 2.2.2.2). Is generated and a malicious attack against the server (IP: 2.2.2.2) is possible.

Therefore, in recent years, the ISN generation framework has been changed to generate an ISN with a random number for each device, so that the ISN cannot be easily guessed as a result.

As described above, since the ISN is generated by using a random generator for security of each operating system, it is difficult to infer the ISN of the same client. Therefore, when the IP router is to be detected using the ISN, the detection rate is inevitably reduced.

The second method is to install an agent on the client terminal. There are a method of installing a Java applet and a method of installing ActiveX. However, installing a separate program on the client terminal has a problem that the Internet user can recognize this and refuse to install it.

Lastly, if a plurality of user agent fields are found by distinguishing whether the same user is used using the user agent field, the IP router is detected.

However, there are currently public IP addresses corresponding to 32 powers of 2, whereas the number of known user-agent fields is far less than that of public IP addresses. That is, different users having the same user-agent field may exist. Therefore, the following error may occur when classifying a user by only a user-agent field.

First, an error that determines that an IP router is used even though the IP router is not used occurs. That is, when a single client terminal that does not use an IP router accesses the Internet using two or more web programs, for example, Explorer, Firefox, and Opera, two or more user-agent fields may occur. The user is the same. Nevertheless, when classifying a user using only the user-agent field, the user is mistaken for being a different client terminal.

In addition, even when using an IP router, an error that determines that the IP router is not used occurs. That is, when different client terminals using the IP router have the same User-Agent field when classifying users by only the User-Agent field, the same reason is because the User-Agent field is the same. It is determined that the client terminal does not use the IP router even though it is determined as the client terminal.

Accordingly, an aspect of the present invention is to provide a method for detecting an IP router using a two-stage classification technique such as HTTP request message analysis and statistical modeling, and a system for performing the same.

According to one aspect of the present invention, an IP router detecting method is provided. The method comprises a web that matches a source IP address and a user agent field from a plurality of web service request messages received over an IP network, where the user agent field contains information about the user who sent the web service request message. Extracting a source port number of a service request message according to a time sequence of receiving the plurality of web service request messages; Classifying the extracted plurality of source port numbers into one or more groups by analyzing patterns changing according to the time sequence; And calculating the number of user terminals using the IP router based on the number of classified groups.

According to another feature of the invention there is provided an IP router detection system. The system includes a web that matches a source IP address and a user agent field from a plurality of web service request messages received through an IP network, where the user agent field contains information about the user who sent the web service request message. An extraction unit for extracting a source port number of a service request message according to a time sequence of receiving the plurality of web service request messages; A classification unit classifying the extracted plurality of source port numbers into one or more groups by analyzing a pattern that changes according to the time sequence; And a detector configured to calculate the number of user terminals using the IP router based on the number of classified groups.

According to an embodiment of the present invention, by extracting the user-agent field from the HTTP request message and detecting the IP router by utilizing the fact that the source port number increases linearly for each time zone, the complexity of the IP router is reduced. The accuracy of the detection can be improved.

Therefore, when detecting an IP router using only the user-agent field detected per public IP address in the related art, the user-agent field when two or more web programs are used in one client PC. Is different but same user, but it is possible to solve the problem of false positive error detected as IP router user and false negative error detected due to the same User-Agent value detected from different client PCs. .

1 is a diagram illustrating a network configuration to which an IP router detection system according to an embodiment of the present invention is applied.
2 is a block diagram showing a detailed configuration of an IP router detection system according to an embodiment of the present invention.
3 and 4 illustrate the structure of an HTTP request message according to an embodiment of the present invention.
5 illustrates a structure of a user-agent field according to an embodiment of the present invention.
6 is a histogram showing the difference between source port numbers for each time zone according to an embodiment of the present invention.
FIG. 7 is a graph illustrating a result of applying a Gaussian mixture model (GMM) to the histogram of FIG. 6.
8 is a flowchart illustrating a method of detecting an IP router according to an embodiment of the present invention.
9 is a flowchart illustrating a threshold setting method according to an embodiment of the present invention.
FIG. 10 is a graph illustrating source port numbers of HTTP request messages having different user agent fields according to time zones according to an embodiment of the present invention.
11 is a graph illustrating an example of detecting an IP router according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

Hereinafter, a method for detecting an IP router according to an embodiment of the present invention and a system for performing the same will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a network configuration to which an IP router detection system according to an embodiment of the present invention is applied.

Referring to FIG. 1, the client 1 terminal 100, the client 2 terminal 200, and the client 3 terminal 300 are all connected to the IP router 400.

The IP router 400 converts one public IP address into one or more private IP addresses corresponding thereto or one or more private IP addresses into one public IP address.

At this time, the IP sharer 400 includes a routing table in which three private IP addresses, 192.168.0.2, 192.168.0.3, and 192.168.0.4, are mapped to one public IP address 125.0.0.1.

The IP router 400 allocates 192.168.0.2, 192.168.0.3, and 192.168.0.4 to the client 1 terminal 100, the client 2 terminal 200, and the client 3 terminal 300, respectively. Then, the client 1 terminal 100, the client 2 terminal 200 and the client 3 terminal 300 is connected to the IP sharer 400 by using the assigned private IP address, and one public IP address mapped thereto 125.0.0.1 is used to access the service server 500 to send and receive traffic.

At this time, the upstream traffic directed to the service server 500 flows into the IP router detection system 600. The IP router detecting system 600 detects the IP router 400 by analyzing the incoming upstream traffic and detects the number of client terminals connected to the IP router 400.

In particular, unlike the conventional TCP / IP packet analysis, the IP router detection system 600 analyzes only a HTTP (HyperText Transfer Protocol) request message, which is a web service request message, among upstream traffic. In this case, since there are 10 packets including the HTTP request message among the 100 packets of TCP / IP, the load burden on the system is less than that in the case of using the TCP / IP packet.

The client 1 terminal 100, the client 2 terminal 200, and the client 3 terminal 300 assign the source IP addresses 192.169.0.2, 192.168.0.3, and 192.168.0.4, which are private IP addresses, which are assigned from the IP router 400. Send the HTTP request message set to. Then, the IP router 400 converts the source IP address of the received HTTP request message into a public IP address (125.0.0.1) and transmits it to the service server 500.

At this time, the IP router detection system 600 collects the HTTP request message on the traffic path, extracts the user-agent field, and classifies the user first. However, other fields besides the user-agent field have no information for uniquely classifying the client terminals 100, 200, and 300. However, the user-agent field is unique to each user. There is no number.

Therefore, the extractor 603 also extracts the source port number from the HTTP request message having the same user-agent field. The extracted plurality of source port numbers are classified into one or more groups by analyzing patterns changing according to the reception time order of the HTTP request message to classify users secondly.

The number of user terminals using the IP router is calculated based on the number of groups classified as described above.

At this time, the linearity of the source port number is analyzed based on the statistical model and the number of client terminals connected to the IP router 400 and the IP router 400 is detected using the linear equation obtained from the result.

The IP router detection system 600 may be utilized for constructing a known system of client terminals 100, 200, and 300 infected with a virus in terms of network security. In addition, the network may be largely composed of the central server devices and the local server device installed in the local node, the IP router detection system 600 may be implemented in the form of a local server device.

Then, the configuration of the IP router detection system 600 will be described in more detail.

2 is a block diagram showing a detailed configuration of an IP router detection system according to an embodiment of the present invention, Figures 3 and 4 show the structure of an HTTP request message according to an embodiment of the present invention, Figure 5 is the present invention 6 illustrates a structure of a user-agent field according to an embodiment of the present invention. FIG. 6 is a histogram showing a difference between source port numbers for each time zone according to an embodiment of the present invention. FIG. 7 is a Gaussian for the histogram of FIG. A graph showing the results of applying the mixed model (GMM).

First, referring to FIG. 2, a collection unit 601, an extraction unit 603, a classification unit 605, a storage unit 607, a setting unit 609, an analysis unit 611, and a detection unit 613 are included. do.

The collecting unit 601 constantly monitors the upward traffic from the client terminals 100, 200, and 300 to the service server 500. In addition, a plurality of web service request messages having the same user-agent field and source IP address are collected for each time zone.

Here, the web service request message is a message transmitted from the client terminal to the service server 500 to use the Internet service. In the embodiment of the present invention, an HTTP request message is used.

Referring to FIG. 3, the HTTP request message 700 includes an Ethernet header (ETH) 710, an internet protocol header (IPH) 720, a transmission control protocol header (TCPH) 730, and an HTTP header (HTTPH) 740. ) And an HTTP Body 750.

Here, the user-agent field is included in the HTTPH 740, and the source port number is stored in the source port number field 731 of the TCPH 730.

The client terminals 100, 200, and 300 transmit an HTTP request message to the service server 500 to use the Internet. In the initial connection request, a new source port number is randomly assigned and a session is created.

Referring to FIG. 4 detailing the structures of the HTTP Header (HTTPH) 740 and the HTTP Body 750, the HTTP request message 700 includes a request line 741, three header information (742, 743, 744) and It consists of a body 750 containing the actual data.

In this case, the three header informations 742, 743, and 744 include a general header 742, a request header 743, and an item header 744. Among these, the request header 743 exists only in the HTTP request message 700.

The request header 743 specifies the configuration of the client terminals 100, 200, and 300, a document format preferred by the client terminals 100, 200, and 300. The request header 743 has a total of 14 detailed information, and contains various information of the sender. Among these, the user-agent field 745 provides identifiable information about the web browser used by the client terminals 100, 200, and 300.

At this time, the user agent (User-agent) field 745 is configured as shown in FIG.

Referring to FIG. 5, the user agent field 745 may include OS information, web browser information, user information, or client terminals 100, which are included in the traffic of the client terminals 100, 200, and 300. 200, 300).

The user agent field 745 may have a different field value 747 depending on the type and version of the operating system, the type and version of the web program (browser), and the application 749.

That is, the user agent field 745 may have various field values 747 according to the installed operating system, the web browser, and the application 749.

Each browser's details may vary slightly, depending on the browser's type and version, operating system, and installed software. For example, the field value 747 of the User-agent field 745 when using the operating system of Windows XP Professional SP3 and Internet Explorer 6 is "Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT). 5.1; SV1; InfoPath.1 ".

Meanwhile, the extraction unit 603 receives the HTTP request message as the source port number of the HTTP request message in which the source IP address and the user-agent field match among the HTTP request messages collected by the collection unit 601. Extract a plurality in order.

At this time, the extractor 603 extracts the source port number in which the TCP flag Flag of the TCPH 730 of FIG. 3 is set to 0x18 (PSH | ACK is all 1) in the source port number field 731.

The classifier 605 classifies the extracted plurality of source port numbers into one or more groups according to a pattern that changes according to a time sequence of receiving the HTTP request message.

In this case, the difference between the source port number of the previous time and the source port of the current time is classified into one or more groups including a plurality of source port numbers having a predefined linearity for the plurality of source port numbers. The at least one grouped group is configured as a table mapped for each user agent field and stored in the storage unit 607.

The storage unit 607 stores a table in which one or more groups grouped by the classification unit 605 are mapped to respective user agent fields.

The setting unit 609 applies a Gaussian mixture model to the user agent field and the plurality of source port numbers extracted from the plurality of HTTP request messages collected for a predetermined time through the collecting unit 601. Set the derived threshold.

That is, the composite Gaussian model proves that the source port number extracted from the HTTP request message having the same user-agent field increases linearly with time and derives the threshold through it.

Referring to FIG. 6, the difference value histogram between the source port number extracted at the current time T ₁ and the source port number extracted at the previous time T ₀ from the HTTP request message collected for a predetermined time is shown. . As shown in FIG. 6, it can be seen that most difference values are distributed in {-1, 0, 1}. Moreover, in particular, it can be seen that the largest value is distributed in the difference value '1'. It can be seen from this that the source port number increases or decreases linearly with time.

In order to generalize FIG. 6, a probability distribution model may be defined based on a difference between a current time and a previous time of source port numbers of client terminals 100, 200, and 300 using most IP routers. Same as 7.

Here, the probability distribution model uses a Gaussian Mixture Model. The Gaussian mixture model (GMM) is one of methods for classifying patterns by estimating probability distributions of data. The Gaussian mixture model (GMM) may be defined by Equation 1 as an extended probability model to express various shapes of probability distributions.

Where- _{Yi (x)} denotes a single Gaussian distribution. μ _i and σ _i are the mean and variance of the corresponding distribution, respectively.

The setting unit 609 analyzes the variables defined in Equation 1 to derive a threshold value as shown in Equation 2.

On the other hand, the analysis unit 611 determines the linearity of the plurality of source port numbers received from the classification unit 605 and informs the result.

At this time, the linearity determination is performed as follows. That is, Equation 3 is determined by calculating a difference between the source port number of the previous time and the source port of the current time with respect to the plurality of source port numbers received from the classification unit 605.

Here, Current_Src_Port means a source port of the current time extracted by the extractor 603. Previous_Src_Port means the source port number of the previous time.

In this case, if the determination result of Equation 3 is 'true', it is determined that the linearity is satisfied, and if it is 'false', it is determined as nonlinearity.

The detection unit 613 detects the case where an IP router is used when two or more different groups in which the plurality of source port numbers increase linearly in proportion to time are found. The number of user terminals using the IP router is calculated as the number of groups.

Now, a method of detecting an IP router based on the above description will be described. In this case, the same reference numerals are used to describe the operation of the components described with reference to FIGS. 1 to 7.

FIG. 8 is a flowchart illustrating a method of detecting an IP router according to an exemplary embodiment of the present invention, and illustrates an operation of the IP router detecting system 600 of FIG. 2.

Referring to FIG. 8, the collector 601 collects an HTTP request message having the same source IP address on the uplink traffic path of FIG. 1 (S101).

Then, the extractor 603 extracts a user-agent field and a source port number from the HTTP request message collected by the collector 601 (S103 and S015).

The classification unit 605 determines whether the user-agent field extracted in step S103 is stored in the table (S107).

In this case, if not stored, the user-agent field extracted in steps S103 and S105 and the source port number of the current time are mapped and stored in the table (S109), and then starts again from step S101.

As such, the source port numbers mapped to the user-agent fields in the table are represented by a graph as shown in FIG. 8.

However, if it is determined that the case is stored in step S107, the analysis unit 611 calculates the difference between the source port number of the previous time stored in the table and the source port number of the current time extracted in step S105 (S111). In operation S113, it is determined whether the calculated difference between the source port numbers is equal to or less than a predetermined threshold set by the setting unit 609.

At this time, if it is determined that the threshold value is exceeded, the analysis unit 611 determines to be non-linear (S115).

However, if it is less than the threshold, the analysis unit 611 determines that the linearity satisfies (S117), the classification unit 605 deletes the previous source port number stored in the table and the source port of the current time extracted in step S105 Update to the number (S119).

Then, the detector 613 generates a linear curve of the source port number for each time zone as shown in FIG. 9 (S121).

The detector 613 determines whether two or more linear curves generated in step S121 occur (S123).

At this time, if two or more do not occur, step S101 is restarted. However, if two or more occur, it is detected that the IP router is used (S125). The number of user terminals of the IP router is calculated by the number of linear curves (S127). For example, if four different linear curves are generated, it is calculated that there are user terminals sharing four IP routers.

FIG. 9 is a flowchart illustrating a threshold setting method according to an exemplary embodiment of the present invention, and illustrates a method of previously setting a threshold used in operation S113 of FIG. 9.

Referring to FIG. 9, the collection unit 601 collects a plurality of HTTP request messages having the same public IP for a predetermined time (S201).

The extractor 603 extracts a user-agent field from a plurality of HTTP request messages that match the source IP address (S203). The source port number of the HTTP request message with which the user-agent field is matched is extracted according to the time order of receiving the HTTP request message (S205).

The setting unit 609 calculates a difference between the source port number of the previous time zone and the source port number of the current time zone from the plurality of source port numbers extracted in step S205 (S207). The threshold value is derived by applying a Gaussian mixture model to the result of calculating the difference between the source port numbers (S209).

10 and 11 show simulation results of applying the IP router detection method described above.

FIG. 10 is a graph illustrating source port numbers of HTTP request messages having different user agent fields according to time zones according to an embodiment of the present invention, and FIG. 11 is an example of detecting an IP router according to an embodiment of the present invention. This is a graph.

At this time, the IP router used in the simulation has four User Datagram Protocol (UTP) ports of the ipTIME series. A total of 3 client PCs (Client 1 PC, Client 2 PC, Client 3 PC) are used to construct a private network.

Among them, the client 1 PC used the Internet using two web programs to show the false detection rate of the primary classification scheme. The other client 2 PCs and the client 3 PCs used only one web program.

Referring to FIG. 10, it can be seen that the source port number increases differently for each client. This is because the source port number assignment is generated randomly within the range when the first HTTP request is made, but the source port number increases differently for each client because the source port number increases linearly for subsequent HTTP requests.

FIG. 11 illustrates a result of generating a linear curve of source port numbers for each time zone using threshold values for the plurality of source port numbers of FIG. 10.

Here, the thick solid line corresponds to a linear curve of source port numbers for each client.

Referring to FIG. 11, since two or more linear curves are detected, it can be seen that an IP router using a single public IP address is used. In addition, since three different linear curves are detected, it can be seen that a total of three client PCs (client 1 PC, client 2 PC, and client 3 PC) used in the simulation are detected.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

100, 200, 300: client terminal 400: IP router
500: service server 600: IP router detection system
601: collecting unit 603: extracting unit
605: classification unit 607: storage unit
609: setting unit 611: analysis unit
613: detection unit

Claims (11)

From among a plurality of web service request messages received through an IP network, a source IP address and a user agent field, where the user agent field contains information about the user who sent the web service request message. Extracting each source port number according to a time sequence of receiving the plurality of web service request messages;
Classifying the extracted plurality of source port numbers into one or more groups by analyzing patterns changing according to the time sequence; And
Calculating the number of user terminals using the IP router based on the number of classified groups;
The classifying step,
The source port numbers having mutual linearity among the plurality of source port numbers are classified into one group, and a linear curve is generated based on the source port numbers classified into the same group. IP router detection method to detect the use of IP router. The method of claim 1,
The classifying step,
Calculating a difference between a source port number of a previous time and a source port of a current time with respect to the extracted plurality of source port numbers; And
Classifying the difference between the source port numbers into one or more groups consisting of a plurality of source port numbers having a predefined linearity.
IP router detection method comprising a. The method of claim 2,
Classifying into one or more groups consisting of the plurality of source port numbers,
If the difference between the source port number has a predetermined threshold or less, it is determined that the linearity, and classifies into one or more groups consisting of a plurality of source port numbers having a difference below the predetermined threshold. The method of claim 3,
Before the extracting step,
Setting the threshold value using a Gaussian mixture model to a user agent field and a plurality of source port numbers extracted from the plurality of web service request messages collected for a predetermined time;
IP router detection method further comprising. 5. The method according to any one of claims 2 to 4,
Wherein the calculating step comprises:
Creating a table that maps the one or more groups with user agent fields;
Generating a linear curve in which a plurality of source port numbers increase linearly with time using a plurality of source port numbers included in the one or more groups mapped to user agent fields stored in the table; And
Detecting the use of the IP router when two or more different linear curves are generated, and calculating the number of user terminals using the number of the different linear curves
IP router detection method comprising a. The method of claim 5,
The web service request message,
And an HTTP (HyperText Transfer Protocol) request message including the user agent field and the source port number in header information. From among a plurality of web service request messages received through an IP network, a source IP address and a user agent field, where the user agent field contains information about the user who sent the web service request message. An extraction unit for extracting each source port number according to a time sequence of receiving the plurality of web service request messages;
A classification unit classifying the extracted plurality of source port numbers into one or more groups by analyzing a pattern that changes according to the time sequence; And
A detector configured to calculate the number of user terminals using the IP router based on the number of classified groups,
Wherein,
The source port numbers having mutual linearity among the plurality of source port numbers are classified into one group, and a linear curve is generated based on the source port numbers classified into the same group.
Wherein:
An IP router detection system for detecting the use of an IP router when the linear curve is two or more. The method of claim 7, wherein
The apparatus may further include an analyzer configured to determine whether a difference between a source port number of a previous time and a source port of a current time satisfies a predefined linearity among the extracted plurality of source port numbers.
Wherein,
And classifying the extracted plurality of source port numbers into one or more groups consisting of a plurality of source port numbers having a predefined linearity between the source port numbers. 9. The method of claim 8,
The analysis unit,
After setting a threshold by applying a Gaussian mixture model to the user agent field and the plurality of source port numbers extracted from the plurality of web service request messages collected for a predetermined time, a difference between the source port numbers is less than or equal to a preset threshold. IP router detection system to determine if the case having a linearity. 10. The method according to claim 8 or 9,
Wherein:
After generating a table in which the at least one group is mapped to a user agent field, a plurality of source port numbers in accordance with time using a plurality of source port numbers included in the at least one group mapped for each user agent field stored in the table. Generates a linearly increasing linear curve, and when two or more different linear curves occur, detecting the use of the IP router and calculating the number of the user terminals using the number of the different linear curves. IP Router Detection System. The method of claim 10,
A collecting unit for constantly monitoring upstream traffic, collecting a HTTP (HyperText Transfer Protocol) request message including the user agent field and the source port number in header information from the upstream traffic, and forwarding the HTTP to the extractor.
IP router detection system further comprising.

Images