WO2010060246A1 - 实现arp请求广播限制的方法和装置 - Google Patents

实现arp请求广播限制的方法和装置 Download PDF

Info

Publication number
WO2010060246A1
WO2010060246A1 PCT/CN2008/073604 CN2008073604W WO2010060246A1 WO 2010060246 A1 WO2010060246 A1 WO 2010060246A1 CN 2008073604 W CN2008073604 W CN 2008073604W WO 2010060246 A1 WO2010060246 A1 WO 2010060246A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
mapping table
bridge port
message
dynamic
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2008/073604
Other languages
English (en)
French (fr)
Inventor
倪沈柳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to EP08878364.2A priority Critical patent/EP2362587B1/en
Publication of WO2010060246A1 publication Critical patent/WO2010060246A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • the present invention belongs to the field of communication technologies, and in particular, to a method and apparatus for address resolution protocol (ARP) broadcast restriction.
  • ARP address resolution protocol
  • IP address fraud is one of the most common hacking methods.
  • the hacker A pretending to host B's IP actively requests communication from host C.
  • hacker A can also pretend to host B to passively respond to host C's communication request.
  • TCP/IP Transmission Control Protocol and Internet Protocol
  • ARP Address Resolution Protocol
  • the request message is broadcast in the Layer 2 VLAN domain. This provides a convenient way for hacker attacks on IP address fraud.
  • the format of an ARP request or response packet is shown in Figure 1.
  • the hacker can easily obtain the IP address of the destination host and can masquerade as the destination host to answer the requester.
  • the hacker machine obtains the sender IP and destination IP in the ARP request, and can also actively attack it. Therefore, the IP address also becomes an object of protection in the network.
  • DHCP Dynamic Host Allocation Protocol
  • PPPoE Ethernet-based Peer-to-Peer Protocol
  • the technical problem to be solved by the present invention is to provide a method and apparatus for implementing ARP request broadcast restriction, so as to implement unicast of ARP request, and effectively prevent hacker attacks.
  • the present invention provides a method for implementing ARP broadcast restriction, the method comprising:
  • IP address and bridge port mapping table includes several mapping table records
  • the network device extracts an ARP request, queries the mapping table according to the destination IP address in the ARP request, and obtains a corresponding bridge port;
  • each mapping table record includes a user's MAC address, a virtual local area network identifier, a request forwarding sequence number, a user IP address, and a bridge port.
  • the dynamic IP address allocation related message refers to a DHCP message or a PPPoE message.
  • the dynamic IP address allocation related message is a DISCOVER, REQUEST, OFFER or ACK message.
  • the mapping table record of the IP address and the bridge port mapping relationship is established or updated; if the dynamic IP address allocation related text is a RELEASE, DECLINE or NACKIP message, the mapping table record of the IP address and the bridge port mapping relationship is deleted.
  • each mapping table record of the IP address and the bridge port mapping table includes a lease period and a time stamp
  • the maintenance in the step (a) refers to the network device timing loop detecting each mapping table record, if the lease period is equal to zero and If the difference between the current time and the timestamp is greater than T, or if the lease period is not equal to zero, but the difference between the current time and the timestamp is greater than the lease period, the record is deleted, and the T value is a normal allocation determined according to the size of the networking. The time value required for a session of an IP address from the time the request is initiated until the response is received.
  • mapping table if the number of detected records is greater than the set number of aging, the next detection cycle is awaited.
  • the present invention further provides an apparatus for implementing ARP broadcast restriction, where the apparatus includes a receiving parsing module, a mapping table maintenance module, a mapping table query module, and a forwarding module, where
  • the receiving parsing module is configured to receive and parse the ARP request to obtain the destination IP address
  • the mapping table maintenance module is configured to allocate the related packet and the dynamic IP address according to the dynamic IP address.
  • the IP address and the bridge port mapping table are created and maintained by the bridge port information of the request packet, and the IP address and bridge port mapping table includes a plurality of mapping table records;
  • the mapping table query module is configured to obtain the purpose according to the receiving parsing module.
  • the IP address query mapping table obtains the bridge port.
  • the forwarding module is configured to unicast the ARP request received by the receiving parsing module to the acquired bridge port. Further, the receiving parsing module is further configured to receive and parse a dynamic IP address allocation related packet; the forwarding module is further configured to forward the dynamic IP address allocation related packet; and the mapping table maintenance module is based on a dynamic IP address. The analysis result of the address allocation related packet creates, stores, and maintains the mapping table of the IP address and the bridge port.
  • the dynamic IP address allocation related message refers to a DHCP message or a PPPoE message.
  • the mapping table maintenance module maintains the mapping table as follows: If the dynamic IP address allocation related message is DISCOVER, REQUEST, OFFER or ACK message, establish or update the mapping table record of the IP address and bridge port mapping relationship; if the dynamic IP address allocation is related to the RELEASE, DECLINE or NACKIP message, delete the IP address and bridge port mapping The mapping table record of the relationship.
  • each mapping table record of the IP address and the bridge port mapping table includes a lease period and a timestamp
  • the mapping table maintenance module is further configured to periodically detect each mapping table record to implement an aging mechanism: If the difference between the current time and the timestamp is greater than T, or if the lease period is not equal to zero, but the difference between the current time and the timestamp is greater than the lease period, the record is deleted, and the T value is determined according to the size of the networking. The time value required for a session that normally assigns an IP address from the time the request is initiated until the response is received.
  • mapping table if the number of detected records is greater than the set number of aging, the next detection cycle is awaited.
  • the method and the device of the present invention implement the unicast of the ARP request by directly creating, maintaining, and querying the IP address and the bridge port mapping table based on the technology of dynamically allocating the IP address, and directly sending the ARP request to the destination IP. Hosts, not broadcast in the VLAN domain, effectively prevent hackers. BRIEF abstract
  • Figure 1 is a schematic diagram of the format of an Ethernet ARP request or response packet.
  • FIG. 2 is a schematic diagram of a method for implementing ARP broadcast restriction according to the present invention.
  • FIG. 3 is a schematic diagram of a process of establishing and maintaining a mapping table of an IP address and a bridge port in the present invention.
  • FIG. 4 is a schematic diagram of the aging processing of the mapping table of the IP address and the bridge port in the present invention.
  • Figure 5 is a flow chart showing the processing of an ARP request message in the present invention.
  • Figure 6 is a schematic diagram of the DHCP request and response format.
  • the method and apparatus of the present invention implement ARP broadcast restriction based on the dynamic allocation of IP address technology, and directly send the address resolution protocol AJ JP request to the host of the destination W, and do not broadcast in the VLAN domain.
  • the method for implementing ARP broadcast restriction includes the following steps:
  • Step 201 The network device listens to the dynamic IP address allocation session, and creates and maintains a mapping table of the IP address and the bridge port according to the bridge port information of the request packet and the dynamic IP address allocation request packet;
  • Step 202 The network device extracts an ARP request, queries the mapping table according to the destination IP address in the ARP request, and obtains a corresponding bridge port.
  • Step 203 The network device unicasts the ARP request to the bridge port, and no longer broadcasts in the VLAN to which it belongs.
  • the network device establishes a mapping table of the IP address and the bridge port by listening to the session allocated by the dynamic IP address.
  • the mapping table of IP address and bridge port includes several mapping table records, each mapping table record includes user's MAC address (Ethernet source address, chaddr), VLAN ID (VID, virtual local area network identifier), transaction identifier xid (Transaction ID) , Dhcp request sequence number), lease period, time stamp, user IP address, bridge port information.
  • the DHCP request and response format is as shown in FIG. 6.
  • the network device extracts a DHCP request message that enters the bridge port of the device, obtains a VID in the TAG of the Ethernet header of the packet, and acquires chaddr and xid in the DHCP data. And then record the chaddr, xid, and bridge ports.
  • the network device extracts the DHCP response packet, obtains the VID in the TAG of the Ethernet header of the packet, obtains the lease period from the chaddr, xid, and specific vendor information in the DHCP data, and then updates the mapping table record according to the chaddr, VID, and xid.
  • User IP address, lease period, and timestamp User IP address, lease period, and timestamp.
  • the network device when the network device receives the DHCP packet, it determines whether the DHCP packet is DHCP or not. Otherwise, it determines whether it is an ACK packet. After continuous judgment, it learns the type of the DHCP packet.
  • the network device performs different maintenance on the mapping table according to different types of DHCP packets. The following describes:
  • Type 1 DHCPDISCOVER or DHCPREQUEST message
  • A1 According to the MAC address and VID in the message, it is judged whether there is a corresponding record in the mapping table. If it does not exist, execute B1; otherwise, execute C1;
  • A2 Create a new record in the mapping table, chaddr, user VID, xid, bridge port information in the message; then perform step A4;
  • A3 Update the xid and bridge port information of the record, and then perform step A4;
  • A4 The message is forwarded to the DHCP server.
  • Type 2 DHCPOFFER message
  • B1 According to the chaddr, VID and xid in the message, it is judged whether there is a corresponding record in the mapping table. Record, if the record does not exist, discard the message, the process ends; otherwise, execute B2;
  • Type 3 DHCPACK packet
  • C1 According to chaddr, VID and xid in the message, it is judged whether there is a corresponding record in the mapping table. If not, the message is discarded, and the process ends; otherwise, C2 is executed;
  • C2 update the lease period, time stamp, and user IP address of the record
  • Type 4 DHCPNACK message
  • D1 According to chaddr, VID and xid in the message, it is judged whether there is a corresponding record in the mapping table. If the record exists, D2 is executed, otherwise the file is discarded, and the process ends.
  • Type 5 DHCPRELEASE or DHCPDECLINE
  • E1 Determine whether there is a corresponding record in the mapping table according to the chaddr and the VID in the packet. If the record exists, delete the request record, otherwise, the packet is discarded, and the process ends;
  • E2 Forward the packet to the DHCP server.
  • mapping table by using the DHCP method as an example.
  • PPPoE access mode that dynamically allocates IP addresses.
  • the network device receives the DISCOVER, REQUEST,
  • mapping table record of an IP address and a bridge port mapping relationship is established or updated. Receives a RELEASE, DECLINE or NACK message, and deletes the mapping table record of the IP address and bridge port mapping relationship.
  • the invention also provides an IP address and bridge port mapping table aging mechanism, which can clear the mapping table records of the corresponding IP address and bridge port mapping relationship when the session is abnormal or the message is lost, so that the useless record occupies additional storage. space.
  • the network device in order to implement the aging mechanism, the network device enables a timer (such as an interval of 60 seconds) timing detection mapping table to implement the aging function of the record.
  • a timer such as an interval of 60 seconds
  • the implementation process is as follows:
  • Step 401 If the timer expires, cyclically detecting each mapping table record until the traversal is completed;
  • Step 402 Determine whether the lease period of the record is equal to zero, and if it is equal to zero, perform the step
  • step 404 is performed
  • Step 403 Check whether the difference between the current time and the time stamp is greater than T, if yes, go to step 405; otherwise, go to step 404;
  • the T value is the time value required for a session with a normally assigned IP address to determine the response to receive a response based on the size of the network.
  • Step 404 Check whether the difference between the current time and the time stamp is greater than the lease period to delete the record, and if so, step 405 is performed;
  • Step 405 Delete the record, used for aging of the intermediate process record that the DHCP request process is not successfully completed;
  • Step 406 The number of aging times (refer to the number of detection records) is greater than N. If yes, continue the aging check of the next record, and repeat step 402. Otherwise, wait for the arrival of a timer, that is, the next detection cycle. End.
  • N is the set of relatively reasonable aging times because it is not easy to perform too many actions in one timer time.
  • the network device parses the received ARP request, obtains the destination IP address and VID, and then searches for the corresponding mapping table according to the destination IP address. Bridge port information, and finally send it to the user port, no longer in the VLAN Broadcasting.
  • the device In order to improve the function of the network device, you can set whether the device supports the broadcast restriction, that is, whether the device is an enabled ARP relay. You can also set whether the network device discards the current ARP request when unicast is not possible.
  • the following takes the ARP request sent by the server to the user device as an example.
  • the specific unicast process is as follows:
  • Step 501 The network device parses the ARP request, and obtains the destination IP address and the downlink VID.
  • Step 502 The network device determines whether the VID is an enabled ARP relay. If yes, step 503 is performed; otherwise, step 505 is performed;
  • Step 503 Obtain a user bridge port from the mapping table according to the destination IP address, if the acquisition is successful, go to step 504, otherwise go to step 505;
  • Step 504 Unicast the ARP request to the user bridge port, no longer broadcast in the VLAN, and the process ends.
  • Step 505 Determine whether the ARP request needs to be discarded, if it needs to be discarded, discard the request, and the process ends; otherwise, step 506 is performed;
  • Step 506 Broadcast the ARP request in other ports of the same VLAN except the source port.
  • the present invention also provides an apparatus for implementing ARP request broadcast restriction, which is implemented in a network device, and is configured to forward an ARP request between a user equipment and a server, and the apparatus includes a receiving parsing module. , a mapping table maintenance module, a mapping table query module, and a forwarding module, wherein:
  • the receiving parsing module is configured to receive and parse the ARP request, obtain the destination IP address, and is further configured to receive and parse the dynamic IP address allocation related information;
  • the mapping table maintenance module is configured to create, store, and maintain a mapping table of the IP address and the bridge port according to the bridge port information entered by the dynamic IP address allocation related packet and the dynamic IP address allocation request packet; the mapping table of the IP address and the bridge port Including several mapping table records, each mapping table record includes the user's MAC address (chaddr) (Ethernet source address), VLAN ID (VID), request sequence number xid (Transaction ID), lease period, timestamp, user IP address , bridge port information.
  • the mapping table maintenance module maintains the mapping table in this way: If the dynamic IP address allocation related message is a DISCOVER, REQUEST, OFFER or ACK message, the mapping table of the IP address and the bridge port mapping relationship is established or updated. Record; if the dynamic IP address allocation is related to the RELEASE, DECLINE or NACKIP message, delete the mapping table record of the IP address and bridge port mapping relationship.
  • the mapping table maintenance module is further configured to periodically detect each mapping table record to implement an aging mechanism: if the lease period is equal to zero and the difference between the current time and the time stamp is greater than T, or, the lease period is not equal to zero but the current time and time stamp If the difference is greater than the lease period, the record is deleted.
  • the T value is a time value required for the session from a request to receive a response to a normally assigned IP address determined according to the size of the network.
  • mapping table querying module configured to obtain a user bridge port according to the destination IP address query mapping table obtained by the receiving parsing module
  • the unicast forwarding module is configured to forward the dynamic IP address allocation related packet, and unicast the ARP request received by the receiving parsing module to the acquired user bridge port.
  • the device attribute module is used to store the unicast attributes of the current device, such as whether to support broadcast restrictions, and whether to discard ARP requests and other information when unicast is not available.
  • the method and the device of the present invention implement the unicast of the ARP request by creating, maintaining, and querying the IP address and the bridge port mapping table, and directly send the ARP request to the host of the destination IP, instead of in the VLAN domain. Broadcast to prevent hackers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Description

实现 ARP请求广播限制的方法和装置
技术领域
本发明属于通信技术领域， 具体涉及地址解析协议（ARP )广播限制的 方法和装置。
背景技术
随着宽带接入技术和宽带业务的迅猛发展， 网络安全越来越得到关注。 但目前网络中存在各种各样的病毒和黑客攻击。 IP地址欺诈是一种最为常见 的一个黑客攻击手段。 如黑客机 A冒充主机 B的 IP主动向主机 C请求通讯。 黑客 A也可以冒充主机 B被动响应主机 C的通讯请求。 基于 TCP/IP (传输控 制协议和网际协议)的网络通信技术中， ARP的主要目的就是实现地址解析， 即获得 IP地址到 MAC (媒体访问控制)地址的对应关系。其请求报文是在二层 VLAN域中广播的。 这给 IP地址欺诈的黑客攻击提供了便捷的途径。
ARP请求或应答分组的格式如图 1。 黑客机很容易就可以获取目的主机 的 IP地址， 并可以冒充目的主机应答请求方。 黑客机获得了 ARP请求中的 发送方 IP和目的 IP, 也可以对其进行主动攻击。 所以 IP地址也成为网络中 保护的对像。
在目前宽带接入网络中， 接入方式主要有 3种： 固定 IP, DHCP (动态 主机分配协议） ， PPPoE (基于以太网的点对点协议） 。 而 DHCP和 PPPoE 都是动态分配 IP地址的接入方式。 随着网络技术的发展， 宽带用户成指数级 增长。 这样 IP地址相对宽带用户而言， 变得越来越少了。 所以在目前的宽带 接入中， 动态分配 IP地址的接入方式被普遍地运用。
发明内容
本发明要解决的技术问题是提供一种实现 ARP请求广播限制的方法和装 置， 以实现 ARP请求的单播， 有效防止黑客攻击。 为了解决上述问题， 本发明提供了一种实现 ARP广播限制的方法， 该方 法包括：
文进入的桥端口信息， 创建并维护 IP地址和桥端口映射表， 所述 IP地址和 桥端口映射表包括若干条映射表记录；
( b )所述网络设备提取 ARP请求， 根据所述 ARP请求中的目的 IP地 址查询所述映射表并获取对应的桥端口；
( c )所述网络设备将所述 ARP请求单播到所述桥端口。
进一步地， 每条映射表记录包括用户的 MAC地址、 虚拟局域网标识、 请求转发序号、 用户 IP地址及桥端口。
进一步地， 步骤（a ) 中， 所述的动态 IP地址分配相关报文指 DHCP报 文或 PPPoE 报文， 对于 DHCP 方式， 若动态 IP 地址分配相关报文是 DISCOVER, REQUEST, OFFER或 ACK报文， 则建立或更新 IP地址和桥 端口映射关系的映射表记录； 若动态 IP地址分配相关 文是 RELEASE, DECLINE或 NACKIP报文 ,则删除 IP地址和桥端口映射关系的映射表记录。
进一步地， 所述 IP地址和桥端口映射表的每条映射表记录包括租约期和 时间戳， 步骤（a )中所述维护指网络设备定时循环检测每条映射表记录， 如 果租约期等于零且当前时间和时间戳之差大于 T, 或， 租约期不等于零但当 前时间和时间戳之差是否大于租约期， 则删除此条记录， 所述 T值是根据组 网的规模确定的一个正常分配 IP地址的会话从发起请求到收到回应需要的时 间值。
进一步地， 循环检测映射表记录的过程中， 如果检测记录条数大于设定 的老化次数， 则等待下一个检测周期。
为解决上述技术问题， 本发明还提供了一种实现 ARP广播限制的装置， 该装置包括接收解析模块、 映射表维护模块、 映射表查询模块及转发模块， 其中，
接收解析模块， 用于接收并解析 ARP请求， 获取目的 IP地址； 映射表维护模块， 用于根据动态 IP地址分配相关报文及动态 IP地址分 配请求报文进入的桥端口信息创建及维护 IP地址和桥端口映射表， 所述 IP 地址和桥端口映射表包括若干条映射表记录； 映射表查询模块， 用于根据接收解析模块获取的目的 IP地址查询映射表 获取桥端口；
转发模块， 用于将接收解析模块接收的 ARP请求单播到获取的桥端口。 进一步地， 所述接收解析模块还用于接收并解析动态 IP地址分配相关报 文； 所述转发模块还用于转发所述动态 IP地址分配相关报文； 所述映射表维 护模块是根据动态 IP地址分配相关报文的解析结果创建、 存储及维护 IP地 址和桥端口的映射表的。
进一步地， 所述的动态 IP地址分配相关报文指 DHCP报文或 PPPoE报 文， 对于 DHCP方式， 所述映射表维护模块是这样维护映射表的： 若动态 IP 地址分配相关报文是 DISCOVER, REQUEST, OFFER或 ACK报文， 则建立 或更新 IP地址和桥端口映射关系的映射表记录； 若动态 IP地址分配相关才艮 文是 RELEASE, DECLINE或 NACKIP报文， 则删除 IP地址和桥端口映射关 系的映射表记录。
进一步地， 所述 IP地址和桥端口映射表的每条映射表记录包括租约期和 时间戳， 所述映射表维护模块， 还用于定时循环检测每条映射表记录， 实现 老化机制： 如果租约期等于零且当前时间和时间戳之差大于 T, 或， 租约期 不等于零但当前时间和时间戳之差是否大于租约期， 则删除此条记录， 所述 T值是根据组网的规模确定的一个正常分配 IP地址的会话从发起请求到收到 回应需要的时间值。
进一步地， 循环检测映射表记录的过程中， 如果检测记录条数大于设定 的老化次数， 则等待下一个检测周期。
相较于现有技术， 本发明方法和装置基于动态分配 IP地址的技术， 通过 创建、 维护及查询 IP地址和桥端口映射表来实现 ARP请求的单播， 将 ARP 请求直接发送给目的 IP的主机， 而不在 VLAN域中进行广播，从而有效防止 黑客攻击。 附图概述
图 1 是以太网 ARP请求或应答分组格式示意图。
图 2是本发明实现 ARP广播限制的方法示意图。
图 3 是本发明中 IP地址和桥端口的映射表建立及维护过程示意图。
图 4 是本发明中的 IP地址和桥端口的映射表老化处理示意图。
图 5是本发明中 ARP请求报文处理流程图。
图 6 是 DHCP请求和应答格式示意图。
本发明的较佳实施方式
本发明方法和装置在基于动态分配 IP地址技术的基础上, 实现 ARP广 播限制，将地址解析协议 AJ JP请求直接发送给目的 W的主机， ¾不在 VLAN 域中进行广播。
如图 2所示， 本发明实现 ARP广播限制的方法包括以下步骤：
步骤 201、 网络设备监听动态 IP地址分配会话， 根据动态 IP地址分配的 相关报文及动态 IP地址分配请求报文进入的桥端口信息， 创建并维护 IP地 址和桥端口的映射表；
步骤 202、 网络设备提取 ARP请求， 根据 ARP请求中的目的 IP地址查 询该映射表并获取对应的桥端口；
步骤 203、 网络设备将 ARP请求单播到该桥端口， 不再在所属 VLAN中 广播。
以下以 DHCP接入方式为例进行说明，在 DHCP接入方式的宽带网络中， 网络设备通过监听动态 IP地址分配的会话， 建立一张 IP地址和桥端口的映 射表的过程。 IP地址和桥端口的映射表包括若干条映射表记录， 每条映射表 记录包括用户的 MAC地址（以太网源地址， chaddr ) 、 VLAN ID(VID, 虚拟 局域网标识） 、 事务标示 xid ( Transaction ID, Dhcp请求序号） 、 租约期、 时间戳、 用户 IP地址、 桥端口信息。 DHCP请求和应答格式如图 6所示， 具体地， 网络设备提取进入该设备 桥端口的 DHCP请求报文，在该报文的以太网头的 TAG中获取 VID ,在 DHCP 数据中获取 chaddr和 xid,然后记录 chaddr、 xid和桥端口。网络设备提取 DHCP 应答报文， 在该报文的以太网头的 TAG 中获取 VID, DHCP数据中获取 chaddr, xid和特定厂商信息中获取租约期、 然后根据 chaddr、 VID和 xid更 新映射表记录中的用户 IP地址、 租约期和时间戳。
下面结合图 3对创建和维护 IP地址和桥端口的映射表的过程进行详细说 明。
如图 3所示， 网络设备收到 DHCP包时， 判断该 DHCP包是否是 DHCP 否则判断是否是 ACK报文； 经过连续判断后获知 DHCP报文的类型。
网络设备根据 DHCP报文的不同类型， 对映射表进行不同的维护， 以下 分别说明：
类型一： DHCPDISCOVER或者 DHCPREQUEST报文
网络设备收到用户设备发送的 DHCPDISCOVER或者 DHCPREQUEST 才艮文时， 执行以下步骤：
A1： 根据报文中的 MAC地址和 VID判断在映射表中是否存在相应的记 录， 若不存在则执行 B1 , 否则执行 C1 ;
A2: 在映射表中新建一个记录， 报文中的 chaddr、 用户 VID、 xid、 桥端 口信息； 再执行步骤 A4;
A3: 更新该记录的 xid和桥端口信息， 再执行步骤 A4;
A4: 报文转发 DHCP服务器。
类型二： DHCPOFFER报文
收到 Server发送 DHCPOFFER报文时， 执行以下步骤：
B1 : 根据报文中的 chaddr、 VID和 xid判断映射表中是否存在相应的记 录， 如果记录不存在， 则丟弃报文， 流程结束； 否则执行 B2;
B2： 记录用户 IP和时间戳；
B3: 将报文直接转发到该桥端口。
类型三： DHCPACK报文
收到 Server发送的 DHCPACK报文时， 执行以下步骤：
C1 : 根据报文中的 chaddr、 VID和 xid判断映射表中是否存在相应的记 录， 若不存在， 则丟弃该报文， 流程结束； 否则执行 C2;
C2: 更新该记录的租约期、 时间戳、 用户 IP地址；
C3： 将该报文直接转发到该桥端口。
类型四： DHCPNACK报文
收到 Server发送的 DHCPNACK报文时， 执行以下步骤：
D1 : 根据报文中的 chaddr、 VID和 xid判断映射表中是否存在相应的记 录， 如果记录存在， 则执行 D2, 否则丟弃该 ^艮文， 流程结束。
D2: 删除该请求记录；
D3: 将报文转发给用户。
类型五： DHCPRELEASE或 DHCPDECLINE
收到用户发送的 DHCPRELEASE或 DHCPDECLINE报文时， 执行以下 步骤：
E1 : 根据报文中的 chaddr和 VID判断映射表中是否存在相应的记录，如 果记录存在， 则删除该请求记录， 否则执行丟弃该报文， 流程结束；
E2: 将报文转发给 DHCP服务器。
以上是以 DHCP方式为例对映射表的创建和维护进行说明的， 当然对于 同样是动态分配 IP地址的 PPPoE接入方式也是同样适用的。
具体的， 对于 DHCP方式， 网络设备在收到 DISCOVER, REQUEST,
OFFER或 ACK报文时，建立或更新 IP地址和桥端口映射关系的映射表记录。 收到 RELEASE, DECLINE或 NACK报文， 删除 IP地址和桥端口映射关系 的映射表记录。
本发明还提供一种 IP地址和桥端口映射表老化机制，在会话异常或丟失 释放报文的时候能清除相应的 IP地址和桥端口映射关系的映射表记录， 以免 无用的记录占用额外的存储空间。
如图 4所示， 为了实现老化机制， 网络设备启用一个定时器（如间隔为 60秒）定时检测映射表， 实现记录的老化功能。 该实现过程如下：
步骤 401 : 若定时器时间到， 则循环检测每条映射表记录， 直到遍历结 束；
步骤 402: 判断该条记录的租约期是否等于零， 若等于零， 则执行步骤
403 , 否则执行步骤 404;
步骤 403: 检查当前时间和时间戳之差是否大于 T, 如果是， 则执行步骤 405; 否则执行步骤 404;
T值是根据组网的规模确定的一个正常分配 IP地址的会话从发起请求到 收到回应需要的时间值。
步骤 404: 检验当前时间和时间戳之差是否大于租约期删除此记录， 如 果是， 则执行步骤 405;
步骤 405: 删除此条记录， 用于 DHCP请求过程未顺利完成的中间过程 记录的老化；
步骤 406: 老化次数（指检测记录条数）是否大于 N, 如果是， 则继续 下条记录的老化检查， 重复执行步骤 402, 否则， 等待一个定时器时间的到 来， 即下一个检测周期， 流程结束。
N为设定的相对合理的老化次数， 因为一个定时器时间内不易执行太多 动作。
经过以上 IP地址和桥端口映射表的创建过程后， 如图 4所示， 网络设备 对收到的 ARP请求进行解析， 并获取目的 IP和 VID, 然后再根据目的 IP在 映射表中查找对应的桥端口信息， 最后将其发送到用户端口， 不再在 VLAN 中广播。
为了完善网络设备的功能可以设定该设备是否支持广播限制， 即该设备 是否是使能的 ARP relay, 还可以设定该网络设备在无法实现单播时， 是否丟 弃当前 ARP请求。
以下以服务器端向用户设备发送的 ARP请求为例进行说明，具体单播过 程如下：
步骤 501 : 网络设备解析 ARP请求， 获取目的 IP地址和下行 VID； 步骤 502: 网络设备判断该 VID是否是使能的 ARP relay, 若是则执行步 骤 503 , 否则执行步骤 505;
步骤 503: 根据目的 IP地址从映射表中获取用户桥端口， 若获取成功则 执行步骤 504, 否则执行步骤 505;
步骤 504: 将 ARP请求单播到该用户桥端口， 不再在 VLAN中广播， 流 程结束；
步骤 505: 判断是否需要丟弃该 ARP请求， 如需要丟弃， 则丟弃该请求， 流程结束； 否则执行步骤 506;
步骤 506： 除源端口外， 在同一 VLAN的其他端口广播该 ARP请求。 为了实现以上 ARP请求广播限制方法， 本发明还提供了一种实现 ARP 请求广播限制的装置， 该装置在网络设备实现， 用于在用户设备和服务器之 间转发 ARP请求， 该装置包括接收解析模块、 映射表维护模块、 映射表查询 模块、 及转发模块， 其中：
接收解析模块， 用于接收并解析 ARP请求， 获取目的 IP地址， 还用于 接收并解析动态 IP地址分配相关 4艮文；
映射表维护模块， 用于根据动态 IP地址分配相关报文及动态 IP地址分 配请求报文进入的桥端口信息创建、 存储及维护 IP地址和桥端口的映射表； IP地址和桥端口的映射表包括若干条映射表记录， 每条映射表记录包括 用户的 MAC地址（ chaddr ) (以太网源地址） 、 VLAN ID(VID) 、 请求序 号 xid ( Transaction ID ) 、 租约期、 时间戳、 用户 IP地址、 桥端口信息。 对于 DHCP方式， 所述映射表维护模块是这样维护映射表的： 若动态 IP 地址分配相关报文是 DISCOVER, REQUEST, OFFER或 ACK报文， 则建立 或更新 IP地址和桥端口映射关系的映射表记录； 若动态 IP地址分配相关才艮 文是 RELEASE, DECLINE或 NACKIP报文， 则删除 IP地址和桥端口映射关 系的映射表记录。
所述映射表维护模块， 还用于定时循环检测每条映射表记录， 实现老化 机制： 如果租约期等于零且当前时间和时间戳之差大于 T, 或， 租约期不等 于零但当前时间和时间戳之差是否大于租约期， 则删除此条记录， 所述 T值 是根据组网的规模确定的一个正常分配 IP地址的会话从发起请求到收到回应 需要的时间值。
映射表查询模块， 用于根据接收解析模块获取的目的 IP地址查询映射表 获取用户桥端口；
单播转发模块， 用于转发动态 IP地址分配相关报文， 以及将接收解析模 块接收的 ARP请求单播到获取的用户桥端口。
设备属性模块， 用于存储当前设备的单播属性， 如是否支持广播限制， 无法实现单播时， 是否丟弃 ARP请求等信息。
工业实用性
本发明方法和装置基于动态分配 IP地址的技术， 通过创建、 维护及查询 IP地址和桥端口映射表来实现 ARP请求的单播， 将 ARP请求直接发送给目 的 IP的主机， 而不在 VLAN域中进行广播， 从而有效防止黑客攻击。

Claims

权 利 要 求 书
1、 一种实现地址解析协议 ARP请求广播限制的方法， 其特征在于， 该 方法包括： 文进入的桥端口信息， 创建并维护 IP地址和桥端口映射表， 所述 IP地址和 桥端口映射表包括若干条映射表记录；
( b )所述网络设备提取 ARP请求， 根据所述 ARP请求中的目的 IP地 址查询所述映射表并获取对应的桥端口；
( c )所述网络设备将所述 ARP请求单播到所述桥端口。
2、 如权利要求 1所述的方法，其特征在于： 每条映射表记录包括用户的 媒体访问控制 MAC地址、 虚拟局域网标识、 请求转发序号、 用户 IP地址及 桥端口。
3、 如权利要求 1所述的方法， 其特征在于： 步骤（a ) 中， 所述的动态 IP地址分配相关报文指 DHCP报文或 PPPoE报文，对于 DHCP方式，若动态 IP地址分配相关报文是 DISCOVER, REQUEST, OFFER或 ACK报文， 则 建立或更新 IP地址和桥端口映射关系的映射表记录； 若动态 IP地址分配相 关报文是 RELEASE, DECLINE或 NACKIP报文， 则删除 IP地址和桥端口映 射关系的映射表记录。
4、 如权利要求 1至 3中任一项所述的方法， 其特征在于： 所述 IP地址 和桥端口映射表的每条映射表记录包括租约期和时间戳， 步骤（a )中所述维 护指网络设备定时循环检测每条映射表记录， 如果租约期等于零且当前时间 和时间戳之差大于 T, 或， 租约期不等于零但当前时间和时间戳之差是否大 于租约期， 则删除此条记录， 所述 T值是根据组网的规模确定的一个正常分 配 IP地址的会话从发起请求到收到回应需要的时间值。
5、 如权利要求 4所述的方法，其特征在于： 循环检测映射表记录的过程 中， 如果检测记录条数大于设定的老化次数， 则等待下一个检测周期。
6、 一种实现地址解析协议 ARP请求广播限制的装置， 其特征在于， 该 装置包括接收解析模块、 映射表维护模块、 映射表查询模块及转发模块， 其 中， 接收解析模块， 用于接收并解析 ARP请求， 获取目的 IP地址； 映射表维护模块， 用于根据动态 IP地址分配相关报文及动态 IP地址分 配请求报文进入的桥端口信息创建及维护 IP地址和桥端口映射表， 所述 IP 地址和桥端口映射表包括若干条映射表记录； 映射表查询模块， 用于根据接收解析模块获取的目的 IP地址查询映射表 获取桥端口； 转发模块， 用于将接收解析模块接收的 ARP请求单播到获取的桥端口。
7、 如权利要求 6所述的装置，其特征在于： 所述接收解析模块还用于接 收并解析动态 IP地址分配相关报文； 所述转发模块还用于转发所述动态 IP 地址分配相关报文； 所述映射表维护模块是根据动态 IP地址分配相关报文的 解析结果创建及维护 IP地址和桥端口的映射表的。
8、 如权利要求 6所述的装置， 其特征在于： 所述的动态 IP地址分配相 关报文指 DHCP报文或 PPPoE报文，对于 DHCP方式， 所述映射表维护模块 是这样维护映射表的： 若动态 IP 地址分配相关报文是 DISCOVER , REQUEST, OFFER或 ACK报文， 则建立或更新 IP地址和桥端口映射关系 的映射表记录； 若动态 IP地址分配相关报文是 RELEASE, DECLINE 或 NACKIP报文， 则删除 IP地址和桥端口映射关系的映射表记录。
9、 如权利要求 6至 8中任一项所述的装置， 其特征在于： 所述 IP地址 和桥端口映射表的每条映射表记录包括租约期和时间戳， 所述映射表维护模 块， 还用于定时循环检测每条映射表记录， 实现老化机制： 如果租约期等于 零且当前时间和时间戳之差大于 T, 或， 租约期不等于零但当前时间和时间 戳之差是否大于租约期， 则删除此条记录， 所述 T值是根据组网的规模确定 的一个正常分配 IP地址的会话从发起请求到收到回应需要的时间值。
10、 如权利要求 9所述的装置， 其特征在于： 循环检测映射表记录的过 程中， 如果检测记录条数大于设定的老化次数， 则等待下一个检测周期。
PCT/CN2008/073604 2008-11-25 2008-12-19 实现arp请求广播限制的方法和装置 Ceased WO2010060246A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP08878364.2A EP2362587B1 (en) 2008-11-25 2008-12-19 Method and apparatus for realizing ARP request broadcasting limitation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200810179016.8 2008-11-25
CN2008101790168A CN101741702B (zh) 2008-11-25 2008-11-25 实现arp请求广播限制的方法和装置

Publications (1)

Publication Number Publication Date
WO2010060246A1 true WO2010060246A1 (zh) 2010-06-03

Family

ID=42225195

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/073604 Ceased WO2010060246A1 (zh) 2008-11-25 2008-12-19 实现arp请求广播限制的方法和装置

Country Status (3)

Country Link
EP (1) EP2362587B1 (zh)
CN (1) CN101741702B (zh)
WO (1) WO2010060246A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113132385A (zh) * 2021-04-20 2021-07-16 广州锦行网络科技有限公司 一种防止网关arp欺骗的方法及装置

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101860575B (zh) * 2010-07-02 2013-01-09 迈普通信技术股份有限公司 UPnP网关设备NAT端口映射的维护方法及其设备
CN102761474A (zh) * 2011-04-28 2012-10-31 华为技术有限公司 一种报文的过滤方法和接入设备
WO2013064170A1 (en) * 2011-10-31 2013-05-10 Telefonaktiebolaget L M Ericsson (Publ) Discovery and disconnection of client addresses in an access node for an ip network
CN103516821B (zh) * 2012-06-25 2017-05-03 中国移动通信集团公司 地址解析方法及相应的系统、交换机和服务器
CN103024852B (zh) * 2012-11-27 2015-08-05 华为技术有限公司 业务转发的方法及设备
CN103701784B (zh) * 2013-12-17 2017-02-15 迈普通信技术股份有限公司 一种主机防护方法
CN103731353B (zh) * 2013-12-26 2017-07-14 华为技术有限公司 虚拟机的物理地址获取方法
CN104917729A (zh) * 2014-03-12 2015-09-16 国基电子（上海）有限公司 网络设备及其防止地址解析协议报文攻击的方法
CN105450690B (zh) 2014-08-21 2019-02-22 国际商业机器公司 虚拟机管理程序执行的方法和虚拟机管理系统
CN105245629B (zh) * 2015-09-25 2018-10-16 互联网域名系统北京市工程研究中心有限公司 基于dhcp的主机通信方法及装置
CN114008993B (zh) * 2019-06-17 2023-08-22 中兴通讯股份有限公司 用于无线通信网络中的会话建立的方法、装置和系统
CN110351399A (zh) * 2019-07-04 2019-10-18 四川天邑康和通信股份有限公司 一种网关终端lan侧地址动态分配管理方法及管理装置
CN110798546A (zh) * 2019-11-08 2020-02-14 杭州海兴电力科技股份有限公司 一种基于duid的dhcp客户端接入认证方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030072032A (ko) * 2002-03-05 2003-09-13 주식회사 프리컴시스템 사설 ｄｈｃｐ 서버 제어 방법
CN1925493A (zh) * 2006-09-15 2007-03-07 杭州华为三康技术有限公司 一种arp报文处理方法及装置
CN101094235A (zh) * 2007-07-04 2007-12-26 中兴通讯股份有限公司 一种防止地址解析协议攻击的方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0106919D0 (en) * 2001-03-20 2001-05-09 Marconi Comm Ltd Access networks
US7320070B2 (en) * 2002-01-08 2008-01-15 Verizon Services Corp. Methods and apparatus for protecting against IP address assignments based on a false MAC address
WO2003067821A1 (en) * 2002-02-08 2003-08-14 Telefonaktiebolaget Lm Ericsson (Publ) Method and system relating service providers to clients, in an access network, using dynamically allocated mac addresses
CN1549546B (zh) * 2003-05-09 2011-06-22 中兴通讯股份有限公司 使用dhcp协议实现pppoe用户动态获取ip地址的装置及方法
JP2006020085A (ja) * 2004-07-01 2006-01-19 Fujitsu Ltd ネットワークシステム、ネットワークブリッジ装置、ネットワーク管理装置およびネットワークアドレス解決方法
EP1868354A1 (en) * 2006-06-12 2007-12-19 Research In Motion Limited System and method for handling address resolution protocol requests

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030072032A (ko) * 2002-03-05 2003-09-13 주식회사 프리컴시스템 사설 ｄｈｃｐ 서버 제어 방법
CN1925493A (zh) * 2006-09-15 2007-03-07 杭州华为三康技术有限公司 一种arp报文处理方法及装置
CN101094235A (zh) * 2007-07-04 2007-12-26 中兴通讯股份有限公司 一种防止地址解析协议攻击的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2362587A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113132385A (zh) * 2021-04-20 2021-07-16 广州锦行网络科技有限公司 一种防止网关arp欺骗的方法及装置
CN113132385B (zh) * 2021-04-20 2022-06-21 广州锦行网络科技有限公司 一种防止网关arp欺骗的方法及装置

Also Published As

Publication number Publication date
CN101741702B (zh) 2012-02-29
EP2362587A1 (en) 2011-08-31
EP2362587B1 (en) 2013-06-05
CN101741702A (zh) 2010-06-16
EP2362587A4 (en) 2012-12-12

Similar Documents

Publication Publication Date Title
CN101741702B (zh) 实现arp请求广播限制的方法和装置
CN101764734B (zh) IPv6环境下提高邻居发现安全性的方法及宽带接入设备
CN114500135B (zh) 用户终端设备的接入方法、装置和系统
CN101577675B (zh) IPv6网络中邻居表保护方法及邻居表保护装置
CN101427523B (zh) 一种业务绑定的方法和设备
CN100527711C (zh) 包传输装置、通信网和数据包传输方法
CN102165741B (zh) 在ipv6网络中用于封锁和搜索主机的方法
CN101883158B (zh) 获取虚拟局域网标识和网络协议地址的方法及客户端
KR20090064431A (ko) 라우트 정보를 관리하고 액세스 디바이스에서 데이터를 재전송하기 위한 방법 및 디바이스
CN101582888B (zh) 一种创建邻居发现表项的方法和一种服务器
WO2013053266A1 (zh) 一种报文的学习方法、装置和系统
US20140313933A1 (en) Method, apparatus, and system for layer 2 interworking based on ipv6
CN102405629B (zh) 用于将用户设备连接到支持IPv6的聚合网络的方法和装置
WO2011107052A2 (zh) 一种防止地址冲突的方法及接入节点
WO2008151548A1 (en) A method and apparatus for preventing the counterfeiting of the network-side media access control (mac) address
CN102546429B (zh) 基于dhcp监听的isatap隧道的认证方法和系统
CN1744597A (zh) IPv6网络中主机用户获取IP地址参数的方法
CN100583904C (zh) 一种ipv6网络中主机地址的自动配置方法
JP2001326696A (ja) アクセス制御方法
CN102340548B (zh) 一种IPv6用户接入的控制方法和装置
CN102571592B (zh) 具有端口绑定功能的三层交换设备和数据报文转发方法
JP2004312482A (ja) ネットワークシステム、網内識別子の設定方法、アクセス認証情報管理装置、そのプログラム、ネットワーク接続点、網内識別子の設定プログラム、及び記録媒体
CN102594808B (zh) 一种防止DHCPv6服务器欺骗的系统及方法
WO2015014167A1 (zh) 一种处理原始ip报文的方法和相应装置
CN103561026A (zh) 硬件访问控制列表的更新方法、更新装置和交换机

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08878364

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2008878364

Country of ref document: EP