WO2020001388A1 - 发送bgp消息的方法、接收bgp消息的方法以及设备 - Google Patents

发送bgp消息的方法、接收bgp消息的方法以及设备 Download PDF

Info

Publication number
WO2020001388A1
WO2020001388A1 PCT/CN2019/092443 CN2019092443W WO2020001388A1 WO 2020001388 A1 WO2020001388 A1 WO 2020001388A1 CN 2019092443 W CN2019092443 W CN 2019092443W WO 2020001388 A1 WO2020001388 A1 WO 2020001388A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
mac address
message
bgp
mac
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/092443
Other languages
English (en)
French (fr)
Inventor
高远
王海波
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CA3104559A priority Critical patent/CA3104559A1/en
Priority to JP2020573178A priority patent/JP7216120B2/ja
Priority to EP19826741.1A priority patent/EP3800842B9/en
Publication of WO2020001388A1 publication Critical patent/WO2020001388A1/zh
Priority to US17/138,205 priority patent/US11973795B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/66—Layer 2 routing, e.g. in Ethernet based MAN's
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/72—Routing based on the source address
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/82—Miscellaneous aspects
    • H04L47/825—Involving tunnels, e.g. MPLS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0886—Fully automatic configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method for sending Border Gateway Protocol (BGP) messages, a method for receiving BGP messages, and related equipment.
  • BGP Border Gateway Protocol
  • Network devices can connect multiple hosts.
  • the network device may be a switch.
  • the network device can forward the message.
  • An attacker may be included in the multiple hosts.
  • Host 1 is an attacker.
  • the engineer can manually configure the forwarding rules for host 1 on the network device.
  • the forwarding rule includes a media access control (MAC) address of the host 1.
  • MAC media access control
  • a MAC address has 48 bits.
  • This application provides a method for sending a BGP message, a method for receiving a BGP message, and related equipment. Helps reduce manual configuration effort.
  • a method for sending a BGP message includes: the first network device determines that the host identified by the first media access control MAC address is an attacker. The first network device generates a BGP message, where the BGP message includes the first MAC address and indication information, where the indication information is used to indicate that the host identified by the first MAC address is the attacker. Sending, by the first network device, the BGP message to a second network device.
  • the first network device may generate a BGP message carrying the first MAC address and the indication information, and send the BGP message to the second network device.
  • the BGP message may be generated, according to the first MAC address and the indication information in the BGP message, a block used to prevent the second network device from forwarding the packet received by the second network device to the host identified by the first MAC address.
  • Forwarding rules That is, the second network device can generate a forwarding rule by using the BGP message sent by the first network device, and the engineer does not need to manually configure the forwarding rule on the second network device. Therefore, the above technical solution helps reduce the workload of engineers performing manual configuration on network equipment.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP.
  • the sending, by the first network device, the BGP message to a second network device includes: the first VTEP sends the BGP message to the second VTEP.
  • VTEP can be used to implement BGP message transmission.
  • a first VTEP address identifies the first VTEP
  • a second VTEP address identifies the second VTEP
  • the BGP message includes an Internet protocol (IP) header and a payload
  • IP Internet protocol
  • the IP header includes a destination IP address
  • the payload includes MP_REACH_NLRI
  • the MP_REACH_NLRI includes a next hop network address
  • the destination IP address is equal to the second VTEP address
  • the next hop network address is equal to the first VTEP address.
  • the first VTEP sends the BGP message to the second VTEP via a tunnel, and the tunnel is a VXLAN tunnel or an LSP.
  • generating the BGP message by the first network device includes: determining, by the first network device, that a host whose MAC address is the first MAC address is an attacker.
  • the first network device receives a data packet, and a source MAC address of the data packet is the first MAC address.
  • the first network device generates the BGP message based on that the host identified by the source MAC address of the data packet is an attacker.
  • the first network device generates the BGP message based on a trigger of the data packet. That is, when the first network device determines that the host identified by the first MAC address is an attacker, the first network device does not have to generate a BGP message immediately and notify the second network device.
  • the host identified by the first MAC address may not access the network governed by the first network device. For example, the host identified by the first MAC address may be offline, or the host identified by the first MAC address may have roamed to another network. Therefore, when the first network device determines that the host identified by the first MAC address is an attacker, the first network device and the second network device may not be attacked by the attacker.
  • the first network device When the first network device is not attacked by the attacker, the first network device temporarily does not generate and send a BGP message, which helps reduce the overhead of the first network device and the second network device.
  • the first network device receives a data packet with the source MAC address being the first MAC address, it indicates that the first network device starts to be attacked by the attacker.
  • the first network device When the first network device starts to be attacked by the attacker, the first network device notifies the second network device of the attacker's MAC address, which helps to obtain a compromise of reducing overhead and preventing the attack of the attacker.
  • the first network device generating the BGP message based on the host identified by the source MAC address of the data packet as an attacker includes: the first network device determining the data packet The text is from the first VXLAN, and the first virtual extended local area network identifier VNI identifies the first VXLAN. Determining, by the first network device, that the host identified by the first MAC address is located in the first VXLAN based on a source MAC address carried in the data packet and the data packet is from a first VXLAN. The first network device generates the BGP message based on the data packet from the first VXLAN, and the BGP message includes the first VNI.
  • the determining, by the first network device, that the data packet is from a first VXLAN includes: receiving, by the first network device, the data packet via a first port, the first port configuration The first VNI.
  • the first network device is configured with the first VNI based on the first port for receiving the data packet, and determines that the data packet comes from the first VXLAN.
  • the determining, by the first network device, that the data packet is from a first VXLAN includes: determining, by the first network device, a first virtual local area network (VLAN) ID configuration included in the data packet The first VNI.
  • the first network device configures the first VNI based on the first VLAN ID included in the data packet, and determines that the data packet comes from the first VXLAN.
  • VLAN virtual local area network
  • a method for receiving a BGP message includes: the second network device receives a BGP message from the first network device, the BGP message includes a first MAC address and indication information, the indication information is used to indicate that the host identified by the first MAC address is an attack By.
  • the second network device receives a first message, and a destination MAC address of the first message is equal to the first MAC address. Avoiding sending to the first network device by the second network device based on the first MAC address in the BGP message, the indication information in the BGP message, and the destination MAC address in the first message.
  • the host identified by a MAC address forwards the first message.
  • the second network device receives a second packet, and a source MAC address of the second packet is equal to the first MAC address. Preventing the second network device from forwarding the first MAC address based on the first MAC address in the BGP message, the indication information in the BGP message, and the source MAC address in the second message. Two messages.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP.
  • the receiving the BGP message from the first network device by the second network device includes: receiving, by the second VTEP, the routing information from the first VTEP.
  • the second VTEP receives a BGP update message from the second VTEP, the BGP message is carried in the BGP update message, and the BGP update message includes an IP header and a payload,
  • the IP header includes a destination IP address
  • the payload includes MP_REACH_NLRI
  • the MP_REACH_NLRI includes a next hop network address
  • the destination IP address is equal to the second VTEP address
  • the next hop network address is equal to the first A VTEP address.
  • the second VTEP receives the BGP update message from the second VTEP via a tunnel, and the tunnel is a VXLAN tunnel or an LSP.
  • a first network device in a third aspect, includes a processor and a transceiver coupled to the processor.
  • the processor is configured to determine that the host identified by the first MAC address is an attacker.
  • the processor is further configured to generate a Border Gateway Protocol BGP message, where the BGP message includes the first MAC address and indication information, and the indication information is used to indicate that the host identified by the first MAC address is The attacker.
  • the transceiver is configured to send the BGP message generated by the processor to a second network device.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP.
  • the transceiver is configured to send the BGP message from the first VTEP to the second VTEP.
  • a second network device in a fourth aspect, includes a first transceiver, a second transceiver, and a processor coupled to the first transceiver and the second transceiver.
  • the first transceiver is configured to receive a Border Gateway Protocol (BGP) message from a first network device, where the BGP message includes a first media access control MAC address and indication information, and the indication information is used to indicate a location of the first MAC address.
  • the identified host is an attacker.
  • the second transceiver is configured to receive a first packet, and a destination MAC address of the first packet is equal to the first MAC address.
  • the processor is configured to avoid sending to the first MAC address based on the first MAC address in the BGP message, the indication information in the BGP message, and the destination MAC address in the first message. The host identified by the MAC address forwards the first message.
  • the second transceiver is further configured to receive a second packet, and a source MAC address of the second packet is equal to the first MAC address.
  • the processor is further configured to avoid forwarding the based on the first MAC address in the BGP message, the indication information in the BGP message, and the source MAC address in the second message. The second message.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP.
  • the first transceiver is configured to send the BGP message from the first VTEP to the second VTEP.
  • a system in a fifth aspect, includes a first network device provided by the third aspect and a second network device provided by the fourth aspect.
  • a computer-readable storage medium stores a computer program.
  • the network device When the computer program is executed by a network device, the network device is caused to execute the method provided by the first aspect, or the method provided by the second aspect.
  • the network device may be a first network device according to the first aspect, or a second network device related to the second aspect.
  • a computer program product includes a computer program.
  • the computer program may be stored on a computer-readable storage medium.
  • the network device is caused to execute the method provided by the first aspect, or the method provided by the second aspect.
  • the network device may be a first network device according to the first aspect, or a second network device related to the second aspect.
  • the BGP message includes a MAC / IP Advertisement route and a MAC Mobility Extended Community, and the first MAC address is carried in the MAC / IP Advertisement route.
  • the instruction information is carried in the MAC Mobility Extended Community.
  • the EVPN routing message defined by the IETF can be used to publish the MAC address of the attacker. It helps to make the technical solution provided in this application compatible with the existing network, and reduces the implementation cost.
  • the MAC Mobility Extended Community includes flags having 8 bits, and the indication information is carried on a most significant bit (MSB) of the flag.
  • MSB most significant bit
  • the fields in the EVPN routing message defined by the IETF are used to carry the indication information, which helps to make the technical solution provided by this application compatible with the existing network and reduce the implementation cost.
  • the BGP message is a BGP update message.
  • FIG. 1 is a schematic structural diagram of a data center network provided by this application.
  • FIG. 1a is a schematic structural diagram of a switch provided by this application.
  • FIG. 1b is a schematic structural diagram of a server provided by this application.
  • FIG. 2 is a schematic flowchart of a method for sending a BGP message provided by this application
  • FIG. 3 is a schematic flowchart of a method for receiving a BGP message provided by this application.
  • FIG. 4 is a schematic structural diagram of a first network device provided by this application.
  • FIG. 5 is a schematic structural diagram of a second network device provided by this application.
  • FIG. 6 is a schematic structural diagram of a system provided by the present application.
  • FIG. 1 is a schematic structural diagram of a data center network provided by this application.
  • the data center network includes servers 1 to 6, leaf switches (LS) 1, LS1, LS3, and spine switches (SS) 1, SS2, and SS3.
  • server 1 and server 2 are connected to LS1.
  • Server 3 and server 4 are connected to LS2.
  • Server 5 and server 6 are connected to LS3.
  • LS1 is connected to SS1, SS2, and SS3.
  • LS2 is connected to SS1, SS2, and SS3.
  • LS3 is connected to SS1, SS2, and SS3.
  • Server 1 needs to communicate with other servers via LS1.
  • the server 6 needs to communicate with other servers via LS3.
  • the data stream sent by the server 1 can reach the server 6 through different paths.
  • Different paths include: Path 1 (LS1-SS1-LS3), Path 2 (LS1-SS2-LS3), and Path 3 (LS1-SS3-LS3).
  • FIG. 1a is a schematic structural diagram of a switch provided by this application.
  • the LS in FIG. 1 may be the switch 100.
  • the SS in FIG. 1 may be the switch 100.
  • the switch 100 includes ports a to f, a network processor 110, a memory 120, a traffic manager 130, and a memory 140.
  • Ports a, b, and c are coupled to the network processor 110.
  • Port a, port b, and port c are sending ports, and the received packets can be sent to the network processor 110.
  • the switch 100 may include more or fewer receiving ports.
  • Ports d, e, and f are coupled to the traffic manager 130.
  • the network processor 110 and the memory 120 are coupled.
  • the memory 120 may store a computer program and a forwarding table.
  • the forwarding table may be a hash table.
  • the network processor 110 may process a message from the receiving port by executing a computer program stored in the memory 120 and / or looking up a forwarding table. For example, the network processor 110 may execute a computer program to perform a hash operation on a hash key in a message, thereby obtaining a hash value. As another example, the network processor 110 may determine an entry matching the hash value by looking up the hash table. According to the entry that matches the hash value, the sending port used to forward the packet is determined. The sending port may be port d, port e, or port f.
  • the network processor 110 and the traffic manager 130 are coupled. The traffic manager 130 is coupled with the memory 140.
  • the traffic manager 130 may also be referred to as a scheduler.
  • the traffic manager 130 may maintain three sending buffer queues corresponding to the ports d, e and f.
  • the traffic manager 130 may enqueue the message to the sending buffer queue corresponding to the sending port for forwarding the message according to the sending port for forwarding the message.
  • the traffic manager 130 may schedule a message located in a sending buffer queue to send a message through a sending port.
  • the traffic manager 130 may maintain three packet descriptor queues corresponding to the three sending buffer queues on a one-to-one basis.
  • the message descriptor queue contains multiple message descriptors. Each message descriptor contains the address of the message stored in the transmit buffer queue.
  • the traffic manager 130 may add a storage address of the message to the message descriptor queue.
  • the traffic manager 130 may perform a write operation on the memory 140, thereby enqueuing a message to a sending buffer queue.
  • the traffic manager 130 may delete the storage address of the message in the message descriptor queue.
  • the traffic manager 130 may perform a read operation on the memory 140 to dequeue the packets from the sending buffer queue. After the message is dequeued, the message is sent via the sending port.
  • the switch shown in FIG. 1a may include a control plane and a forwarding plane.
  • the control plane can be used for route learning, route advertisement, generating forwarding rules, and updating the forwarding table of the forwarding plane.
  • the forwarding plane may be used to forward a message according to a forwarding table.
  • the forwarding plane may include a network processor 110, a memory 120, a traffic manager 130, and a memory 140.
  • the control plane may include a central processing unit (CPU) and a memory coupled to the central processing unit.
  • the memory coupled with the central processing unit may store a computer program for running a network protocol.
  • the network protocol may be BGP.
  • the central processing unit may implement the functions defined by BGP by executing the computer program.
  • the central processing unit may learn the MAC address of the server. Routing messages can be generated based on the MAC address of the server. You can send routing messages to the remote switch.
  • the switch can update the forwarding table of the forwarding plane according to the routing message from the remote switch. For example, the routing message from the remote switch contains the MAC address of the remote server.
  • the central processing unit may add an entry about the remote server to the forwarding table. Therefore, when the server receives a packet whose destination MAC address is the MAC address of the remote server, the forwarding plane of the switch can forward the packet according to the entry about the remote server.
  • FIG. 1b is a schematic structural diagram of a server provided by this application.
  • the server in FIG. 1 may be the server 1000.
  • the server 1000 includes a central processing unit 1100, a memory 1200, a port 1300, and a bus.
  • the processing unit 1100, the memory 1200, and the port 1300 are coupled through the bus.
  • the memory 1200 stores software.
  • the software includes an operating system and multiple applications.
  • the central processing unit 1100 runs the operating system and the multiple application programs by accessing the memory 1200.
  • the operating system may be Window or Linux.
  • the central processing unit 1100 runs the plurality of application programs.
  • Port 1300 can be used to receive messages and send messages. For example, when the port 1300 receives a message from the switch 100, the memory 1200 can save the message.
  • the central processing unit 1100 may process the message according to the application program.
  • the central processing unit 1100 may generate a message according to the application program, and send the message to the switch 100 via the port 1300.
  • the central processing unit 1100 in FIG. 1b may be replaced with another processor.
  • the other processor may be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic. Devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in connection with the disclosure of the embodiments of the present invention.
  • the processor may also be a combination that realizes computing functions, for example, a combination including one or more microprocessors, a combination of a DSP and a microprocessor, and the like.
  • the data center network shown in FIG. 1 may specifically be an Ethernet Virtual Private Network (EVPN).
  • EVPN Ethernet Virtual Private Network
  • RFC Request for Comments
  • IETF Internet Engineering Task Force
  • RFC7348 is also published by the IETF.
  • LS1 and LS2 can run RFC7348.
  • LS1 and LS2 may each include a virtual extended LAN tunnel endpoint (VXLAN Tunnel Endpoint, VTEP).
  • VTEP is an entity used to originate and / or terminate a VXLAN tunnel.
  • the VTEP included in LS1 is referred to as VTEP1
  • the VTEP included in LS2 is referred to as VTEP2.
  • VTEP1 corresponds to VTEP IP address 1.
  • VTEP2 corresponds to VTEP IP address 2.
  • Engineers can manually configure LS1 so that LS1 includes VTEP1.
  • Engineers can manually configure LS2 so that LS2 includes VTEP2.
  • the engineer can perform the following configuration: Configure VTEP IP address 1 (for example, 1.1.1.9) on LS1.
  • LS1 and LS2 can be on the same VXLAN.
  • LS1 and LS2 are both located on the VXLAN indicated by the Virtual Extended LAN Network Identifier (VNI).
  • VNI Virtual Extended LAN Network Identifier
  • the value of VNI can be 100.
  • Engineers can configure VNI (for example, 100) on LS1.
  • Configure RD for example, 1: 1) on LS1.
  • Configure RT on LS1 for example, 1: 1).
  • Configure VTEP IP address 2 for example, 2.2.2.9
  • VNI Configure VNI (for example, 100) on LS2.
  • engineers can configure a VXLAN tunnel between LS1 and LS2 on LS2.
  • the engineer configures the information of the VXLAN tunnel on LS2.
  • the information may include a source IP address (for example, 2.2.2.9) and a destination IP address (for example, 1.1.1.9).
  • the source IP address is the IP address of the ingress node (for example, VTEP2) of the VXLAN tunnel along the direction of LS2 to LS1.
  • the destination IP address is the IP address of the egress node (for example, VTEP1) of the VXLAN tunnel in the direction from LS2 to LS1.
  • the engineer configures the information of the VXLAN tunnel on LS1.
  • the information may include a tunnel type.
  • TunnelType indicates that the tunnel type of the VXLAN tunnel is VXLAN.
  • the VXLAN tunnel may pass through at least one of SS1, SS2, and SS3. That is, at least one of SS1, SS2, and SS3 may be an intermediate node of the VXLAN tunnel.
  • LS1 runs BGP.
  • LS2 runs BGP.
  • LS1 includes a processor and a memory. The code that implements the functions of BGP is stored in the memory.
  • a processor (such as a central processing unit) in LS1 runs BGP by executing the code.
  • LS2 can also run BGP through the above mechanism.
  • LS2 is the BGP peer of LS1.
  • LS1 and LS2 can also be called a pair of BGP peers.
  • LS1 can learn the MAC addresses of the servers in the network governed by LS1. For example, LS1 can learn the MAC address of server 1 and the MAC address of server 2.
  • LS2 can learn the MAC addresses of the servers in the network governed by LS2.
  • LS2 can learn the MAC address of server 3 and the MAC address of server 4.
  • LS1 may send an EVPN route to LS2 via the VXLAN tunnel.
  • the EVPN route sent by LS1 may include the MAC address of server 1 and the MAC address of server 2.
  • LS2 may send an EVPN route to LS1 via the VXLAN tunnel.
  • the EVPN route sent by LS2 may include the MAC address of server 3 and the MAC address of server 4.
  • LS1 learns the MAC address of server 1 and sends an EVPN route carrying the MAC address of server 1 to LS2 as an example.
  • LS1 contains interface 1.
  • Interface 1 is an Ethernet interface.
  • LS1 is connected to server 1 via interface 1.
  • the engineer configured a VNI (for example, 100) associated with interface 1 on LS1.
  • Server 1 generates Ethernet frame 1 and sends Ethernet frame 1 to LS1 via interface 1.
  • the source MAC address of Ethernet frame 1 is the MAC address of server 1.
  • LS1 determines that the value of the VNI managed by interface 1 is equal to 100.
  • LS1 parses Ethernet frame 1 to obtain the MAC address of server 1.
  • LS1 is based on RFC7432, and generates routing message 1 based on the configuration information saved by LS1 and the information that LS1 obtained from Ethernet frame 1.
  • a processor for example, a central processing unit
  • LS1 may generate routing message 1 by executing a code that implements a function of BGP. The following illustrates routing message 1:
  • the routing message 1 may be carried in an IP packet.
  • the IP packet includes an IP header and an IP payload.
  • the IP header is adjacent to the IP payload.
  • the IP payload is located behind the IP header.
  • the IP header includes a source IP address, a destination IP address, and a protocol.
  • the value of the source IP address can be equal to VTEP IP address 1 (for example, 1.1.1.9).
  • the value of the destination IP address can be equal to VTEP IP address 2 (for example, 2.2.2.9).
  • the protocol in the IP header is used to indicate the type of the next header of the IP header. For example, when the value of the protocol is equal to 6, the protocol in the IP header indicates that in the IP packet, the next header of the IP header is a Transmission Control Protocol (TCP) header.
  • TCP Transmission Control Protocol
  • the IP payload includes a TCP header and a TCP payload.
  • the TCP header is adjacent to the TCP payload.
  • the TCP payload is located behind the TCP header.
  • the TCP header is adjacent to the IP header.
  • the TCP header includes a source port.
  • the source port in the TCP header can be used to indicate the type of TCP payload. For example, when the value of the source port is equal to 179, the source port in the TCP header indicates that the TCP payload is a BGP message.
  • Route message 1 may be a BGP message. Specifically, it may be a BGP update message.
  • the routing message 1 may include multi-protocol reachable network layer reachability information (Multiprotocol, Reachable, Network, Layer, Reachability, Information, MP_REACH_NLRI).
  • the MP_REACH_NLRI is a path attribute. For MP_REACH_NLRI, refer to the related description in RFC4760. Route message 1 may also carry other path attributes. For example, the routing message 1 may also carry a local preference.
  • the MP_REACH_NLRI includes a next hop network address (next hop network address) field.
  • the next hop network address field may carry a VTEP IP address 1 (for example, 1.1.1.9) stored on LS1.
  • the routing message 1 contains a MAC / IP advertisement route (MAC / IP advertisement route). Regarding MAC / IP Advertising Route, you can refer to the relevant description in RFC7432.
  • the routing message may also include a Media Access Control Mobility Extended Community (MAC, Mobility, Extended Community). About MAC Mobility Extended Community, you can refer to the relevant description in RFC7432.
  • MAC Media Access Control Mobility Extended Community
  • the MAC address of the server 1 may be carried in the MAC / IP Advertising Route.
  • the MAC / IP Advertising Route includes a MAC address field.
  • the MAC address field has 6 bytes.
  • the MAC address of the server 1 may be carried in the MAC address field.
  • the MAC / IP Advertising Route includes a Multiprotocol Label Switching Label (MPLS) Label 1 field.
  • the MPLS Label1 field has 3 bytes.
  • the MPLS Label1 field can carry the VNI (for example, 100) stored on LS1.
  • the MAC / IP Advertising Route includes an RD field.
  • the RD field includes 8 bytes.
  • the RD field may carry an RD (for example, 1: 1) stored on LS1.
  • the MAC / IP Advertising Route also includes an MPLS Label 2 field.
  • the routing message 1 may include an extended community attribute.
  • extended community attributes you can refer to the description of BGP Extended communities in RFC4360.
  • the extended community attribute may include a TunnelType field and an RT field.
  • the TunnelType field can carry the TunnelType (for example, 8) stored on LS1.
  • the RT field can carry the RT stored on LS1 (for example, 1: 1).
  • LS1 After LS1 generates routing message 1, it can send routing message 1 to LS2 through the VXLAN tunnel.
  • LS2 After receiving routing message 1, LS2 parses routing message 1 to obtain the value of the next hop network address field in routing message 1.
  • the value of the next hop network address field is equal to VTEP IP address 1 (for example, 1.1.1.9).
  • LS2 determines that LS2 can send the destination address to the MAC address of server 1 to LS1 through the VXLAN tunnel according to the value of the next-hop network address field obtained from routing message 1 and the VXLAN tunnel information saved by LS2 Ethernet frame.
  • the information includes a source IP address (for example, 2.2.2.9) and a destination IP address (for example, 1.1.1.9).
  • LS2 determines that the routing message 1 matches the VXLAN tunnel according to the value of the next hop network address field equal to the destination IP address of the VXLAN tunnel. Furthermore, LS2 can generate forwarding entries.
  • the forwarding entry includes a MAC address (for example, the MAC address of server 1), a VNI (for example, 100), a source IP address (for example, 2.2.2.9), and a destination IP address (for example, 1.1.1.9).
  • LS2 uses the forwarding entry to forward an Ethernet frame as an example.
  • LS2 When LS2 receives an Ethernet frame (Ethernet frame 2) whose destination MAC address is the MAC address of server 1, it can determine Ethernet frame 2 based on the destination MAC address in Ethernet frame 2 being equal to the MAC address in the forwarding entry. Matches a forwarding entry. Furthermore, LS2 can encapsulate Ethernet frame 2 to obtain an encapsulated message. Specifically, LS2 can add a tunnel header to Ethernet frame 2.
  • the tunnel header may include a source IP address (for example, 2.2.2.9), a destination IP address (for example, 1.1.1.9), and a VNI (for example, 100). LS2 may obtain the value of the field in the tunnel header from the forwarding entry, thereby implementing encapsulation of Ethernet frame 2.
  • the tunnel between LS1 and LS2 is a VXLAN tunnel.
  • the tunnel between LS1 and LS2 may be another tunnel.
  • the tunnel between LS1 and LS2 may be a segment routing traffic engineering (Segment Routing, Traffic Engineering, SR-TE) path.
  • LS1 learns the MAC address of server 1 and sends the MAC address of server 1 to LS2 through a routing message.
  • Any LS in FIG. 1 can learn the MAC address of the server in the network managed by the LS in a similar manner, and send the MAC address of the server to the remote LS through a routing message.
  • LS3 can learn the MAC address of server 5.
  • LS3 can send a routing message carrying the MAC address of server 5 to LS2 via the VXLAN tunnel between LS3 and LS2.
  • LS and SS in FIG. 1 are switches.
  • the LS and SS in FIG. 1 may be other network devices.
  • the LS and SS in FIG. 1 may be routers.
  • the LS and SS may be provider edge (PE) routers.
  • PE routers are located at the edge of the core network. PE routers can be used to connect CE routers.
  • the LS may be a PE router.
  • the SS can be a provider (P) router.
  • P router is a label switched router (Label Switch Router, LSR).
  • the P router is a transit router in the core network.
  • a P router can be used to connect one or more PE routers.
  • Figure 1a is a schematic diagram of a switch.
  • FIG. 1a may also be a schematic structural diagram of another network device.
  • FIG. 1a may also be a schematic structural diagram of a router.
  • the LS in Figure 1 is used to connect to the server.
  • the LS can be directly connected to the server through a cable or fiber optic cable.
  • the LS can indirectly connect to the server via an intermediate device.
  • the intermediate device may be a router, an Ethernet switch, or a gateway.
  • the LS in Figure 1 can be connected to other types of hosts.
  • Other types of hosts can be personal computers or virtual machines (VMs).
  • the virtual machine may run in a physical server.
  • the LS may be connected to the physical server via an access device.
  • the access device may be a gateway or an Ethernet switch.
  • FIG. 1b is a schematic structural diagram of a server.
  • FIG. 1b may also be a schematic structural diagram of another host.
  • FIG. 1b may also be a schematic diagram of a personal computer.
  • the above embodiment assumes that the server 1 in FIG. 1 is a legitimate user. After LS1 learns the MAC address of server 1 as a legitimate user, it sends a routing message containing the MAC address of server 1 to LS2. LS2 generates a forwarding entry according to the routing message, so that a server (such as server 3) in the network managed by LS2 can use the forwarding entry to communicate with server 1.
  • a server such as server 3 in the network managed by LS2 can use the forwarding entry to communicate with server 1.
  • the server 1 in FIG. 1 is an illegal user.
  • the server 1 may be an attacker.
  • server 1 may launch a cyberattack.
  • the network attack may be a denial-of-service (DDoS) attack, a man-in-the-middle attack, ARP poisoning, ping flooding, wiretapping, Idle scan or port scan.
  • DDoS denial-of-service
  • ARP poisoning ping flooding
  • wiretapping Idle scan or port scan.
  • the following uses the network attack as a DDoS attack as an example to describe the attack behavior of server 1 and the process by which LS1 identifies server 1 as an attacker:
  • a user of the server 1 installs and runs the software in the server 1 when knowing that the software can launch a DDoS attack.
  • Server 1 sends multiple messages under the control of the software, thereby launching a DDoS attack.
  • LS1 has the ability to identify DDoS attacks.
  • LS1 contains the processor and memory.
  • a computer program for identifying DDoS attacks is stored in the memory.
  • LS1 receives the plurality of messages.
  • the processor in LS1 analyzes the characteristics of the multiple packets by executing the computer program, thereby determining that server 1 is an attacker.
  • LS1 obtains the MAC address of server 1 (for example, MAC address 1) by analyzing the source MAC addresses of the multiple packets.
  • LS1 determines that the host identified by MAC address 1 (for example, server 1) is an attacker.
  • the server 1 is infected with a computer virus due to a user's misoperation.
  • the computer virus was able to launch a DDoS attack.
  • the server 1 is pre-installed and runs computer virus monitoring software.
  • the computer virus monitoring software identifies the behavior of the computer virus (a process in the server 1), and determines that the server 1 is infected with the computer virus. Further, the server 1 determines that the server 1 is an attacker under the control of the computer virus monitoring software.
  • the server 1 sends a message 1 to a network management server (not shown in FIG. 1). Message 1 is used to notify the network management server that server 1 is an attacker. For example, the message 1 carries the MAC address of the server 1 (for example, the MAC address 1).
  • the network management server After the network management server determines that server 1 is an attacker according to message 1, it generates message 2. The network management server sends message 2 to LS1. Message 2 is used to inform LS1 that server 1 is an attacker. For example, message 2 carries MAC address 1. After LS1 receives message 2, it determines that the host (for example, server 1) identified by MAC address 1 is an attacker according to the MAC address 1 carried in message 2.
  • LS1 After LS1 determines that the host identified by MAC address 1 (for example, server 1) is an attacker, LS1 generates routing message 2.
  • a processor such as a central processing unit
  • the routing message 2 includes a MAC address 1 and indication information 1.
  • the indication information 1 is used to indicate that the host (for example, server 1) identified by the MAC address 1 is an attacker.
  • LS1 sends routing message 2 to LS2.
  • LS1 can generate routing message 2 based on the configuration information saved by LS1 and the MAC address of server 1. For the process of generating route message 2 based on the MAC address of server 1 by LS1, refer to the description of the process of generating route message 1 above.
  • MAC address 1 can be carried in the MAC / IP Advertisement contained in routing message 2. Specifically, the MAC address 1 may be carried on the MAC address field of the MAC / IP Advertisement route.
  • the format of the routing message 2 please refer to the description of the format of the routing message 1 above.
  • routing message 1 is generated when LS1 determines that server 1 is a legitimate user.
  • LS1 advertises the MAC address of server 1 to LS2, so that LS2 generates a forwarding entry.
  • a server for example, server 3) managed by LS2 can communicate with server 1 via LS2.
  • Route message 2 is generated when LS1 determines that Server 1 is an attacker.
  • LS1 advertises the MAC address of server 1 to LS2, so that LS2 generates a forwarding rule.
  • the server (for example, server 3) administered by LS2 avoids communicating with server 1 via LS2.
  • Route message 2 functions differently than route message 1.
  • the content of routing message 2 is different from the content of routing message 1.
  • the routing message 2 includes indication information 1 for indicating that the host (for example, the server 1) identified by the MAC address 1 is an attacker.
  • the routing message 1 does not include indication information 1.
  • the indication information 1 is carried in the MAC Mobility Extended Community in the routing message 2.
  • the MAC Mobility Extended Community contains a flags field.
  • the flag field has 8 bits.
  • the indication information 1 may be carried in the MSB of the flag field. For example, when the MSB of the flag field is equal to 1, the MSB of the flag field indicates that the host (for example, server 1) identified by the MAC address 1 in the routing message 2 is an attacker.
  • LS2 After LS2 receives routing message 2 from LS1, LS2 can generate forwarding rule 1 and forwarding rule 2 based on routing message 2. According to forwarding rule 1, LS2 avoids forwarding packets with destination MAC address received by LS2 to MAC address 1 to the host (for example, server 1) identified by MAC address 1. LS2 avoids forwarding packets with source MAC address MAC address 1 received by LS2 according to forwarding rule 2.
  • the forwarding rule 1 may specifically be a forwarding entry 1.
  • the forwarding rule 2 may specifically be a forwarding entry 2.
  • the forwarding plane of LS2 may include a forwarding table.
  • the forwarding table may include forwarding entry 1 and forwarding entry 2.
  • the processor (for example, a network processor) of the forwarding plane may process the received packet according to the forwarding table.
  • the forwarding entry 1 includes a matching domain and an action domain.
  • the value of the matching field in forwarding entry 1 is equal to MAC address 1.
  • the action field of the forwarding entry 1 may include a discard instruction.
  • the matching field of forwarding entry 1 is used to match the destination MAC address in the packet (for example, packet 1) received by LS2.
  • packet 1 for example, packet 1
  • LS2 determines that the destination MAC address of packet 1 is equal to the value of the matching field of forwarding entry 1
  • LS2 determines that packet 1 matches forwarding entry 1.
  • LS2 can perform discard processing on packet 1 according to the discard instruction in the action field of forwarding entry 1.
  • the action field of the forwarding entry 1 may include other instructions. Other instructions may instruct sending the message 1 to the control plane of LS2.
  • the processor of the control plane may be a CPU. After receiving the message 1 from the forwarding plane, the CPU may analyze the message 1. In addition, under the control of the CPU, the LS2 can also send the message 1 to the network management server, so that the network management server can analyze the message 1. When LS2 processes packet 1 according to forwarding rule 1, it does not mean that LS2 can only discard packet 1. LS2 can also perform other processing on packet 1. As long as LS2 avoids forwarding packet 1 to the host (for example, server 1) identified by MAC address 1.
  • the forwarding entry 2 includes a matching domain and an action domain.
  • the value of the matching field in forwarding entry 2 is equal to MAC address 1.
  • the action field of the forwarding entry 2 may include a discard instruction.
  • the matching field of forwarding entry 2 is used to match the source MAC address in the packet (for example, packet 2) received by LS2.
  • LS2 determines that the source MAC address of packet 2 is equal to the value of the matching field of forwarding entry 2
  • LS2 determines that packet 2 matches forwarding entry 2.
  • LS2 can perform discard processing on packet 2 according to the discard instruction in the action field of forwarding entry 2.
  • the source MAC address of packet 2 received by LS2 is equal to MAC address 1, which may be due to server 1 roaming from the network governed by LS1 to the network governed by LS2.
  • Another possibility is that the host in the network governed by LS2 has stolen the MAC address of server 1.
  • the server 4 constructs the Ethernet frame the MAC address of the server 1 is stolen, and the MAC address of the server 1 is used as the source MAC address of the constructed Ethernet frame.
  • FIG. 2 is a schematic flowchart of a method for sending a BGP message provided by the present application.
  • the method shown in FIG. 2 is executed by a first network device.
  • the first network device may be LS1 in FIG. 1.
  • the first network device may perform an action performed by LS1 described in the foregoing embodiment.
  • the method includes S201, S202, and S203.
  • the first network device determines that the host identified by the first MAC address is an attacker.
  • the first MAC address may be a MAC address 1.
  • the host identified by the first MAC address may be server 1.
  • the first network device generates a BGP message.
  • the BGP message includes the first MAC address and indication information.
  • the indication information is used to indicate that the host identified by the first MAC address is the attacker.
  • the BGP message may be a routing message 2.
  • the instruction information may be instruction information 1.
  • the first network device sends the BGP message to a second network device.
  • the second network device may be LS2.
  • LS1 may send the BGP message to LS2 via the VXLAN tunnel between LS1 and LS2.
  • the first network device may generate a BGP message carrying the first MAC address and the indication information, and send the BGP message to the second network device.
  • the BGP message may be generated, according to the first MAC address and the indication information in the BGP message, a block used to prevent the second network device from forwarding the packet received by the second network device to the host identified by the first MAC address.
  • Forwarding rules That is, the second network device can generate a forwarding rule by using the BGP message sent by the first network device, and the engineer does not need to manually configure the forwarding rule on the second network device. Therefore, the above technical solution helps reduce the workload of engineers performing manual configuration on network equipment.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP
  • the sending, by the first network device, the BGP message to a second network device includes: the first VTEP sends the BGP message to the second VTEP.
  • the first VTEP may be VTEP1.
  • the second VTEP may be VTEP2.
  • VTEP1 can include the sending interface of LS1.
  • the sending interface may be an Ethernet interface.
  • VTEP2 can include the receiving interface of LS2.
  • the receiving interface may be an Ethernet interface.
  • VTEP1 can send routing message 2 to VTEP2 via the VXLAN tunnel between LS1 and LS2.
  • a first VTEP address identifies the first VTEP
  • a second VTEP address identifies the second VTEP.
  • the BGP message includes an IP header and a payload.
  • the IP header includes a destination IP address
  • the payload includes MP_REACH_NLRI.
  • the MP_REACH_NLRI includes a next hop network address.
  • the destination IP address is equal to the second VTEP address
  • the next hop network address is equal to the first VTEP address.
  • the first VTEP address may be VTEP IP address 1.
  • the second VTEP address may be a VTEP IP address 2.
  • the first VTEP sends the BGP update message to the second VTEP via a tunnel.
  • the tunnel is a VXLAN tunnel or a label switched path (LSP).
  • the LSP may be a segment routing traffic engineering (Segment Routing, Engineering, SR-TE) path.
  • the BGP message includes MAC / IP Advertising Route and MAC Mobility Extended Community.
  • the first MAC address is carried in the MAC / IP Advertisement route.
  • the indication information is carried in the MAC Mobility Extended Community.
  • the MAC Mobility Extended Community includes a flag with 8 bits, and the indication information is carried on the MSB of the flag.
  • the BGP message is a BGP update message.
  • S202 includes: the first network device receives a data packet, and a source MAC address of the data packet is the first MAC address; and the first network device is based on the The host identified by the source MAC address of the data packet is an attacker and generates the BGP message.
  • the first network device generates the BGP message based on a trigger of the data packet. That is, when the first network device determines that the host identified by the first MAC address is an attacker, the first network device does not have to generate a BGP message immediately and notify the second network device.
  • the host identified by the first MAC address may not access the network governed by the first network device. For example, the host identified by the first MAC address may be offline, or the host identified by the first MAC address may have roamed to another network. Therefore, when the first network device determines that the host identified by the first MAC address is an attacker, the first network device and the second network device may not be attacked by the attacker.
  • the first network device When the first network device is not attacked by the attacker, the first network device temporarily does not generate and send a BGP message, which helps reduce the overhead of the first network device and the second network device.
  • the first network device receives a data packet with the source MAC address being the first MAC address, it indicates that the first network device starts to be attacked by the attacker.
  • the first network device When the first network device starts to be attacked by the attacker, the first network device notifies the second network device of the attacker's MAC address, which helps to obtain a compromise of reducing overhead and preventing the attack of the attacker.
  • S202 includes: the first network device determines that the data packet is from a first VXLAN, and the first VNI identifies the first VXLAN. Determining, by the first network device, that the host identified by the first MAC address is located in the first VXLAN based on a source MAC address carried in the data packet and the data packet is from a first VXLAN. Generating, by the first network device based on the host identified by the first MAC address, the first VXLAN, the BGP message, where the BGP message includes the first VNI.
  • the determining, by the first network device, that the data packet is from a first VXLAN includes: receiving, by the first network device, the data packet through a first port, the first port The first VNI is configured. And, the first network device is configured with the first VNI based on the first port for receiving the data packet, and determines that the data packet comes from the first VXLAN.
  • the determining, by the first network device, that the data packet is from a first VXLAN includes: determining, by the first network device, a first virtual local area network identifier included in the data packet ( VLAN ID) is configured with the first VNI.
  • the first network device configures the first VNI based on the first VLAN ID included in the data packet, and determines that the data packet comes from the first VXLAN.
  • the first network device determines that the data packet is from the first VXLAN according to the configuration information. Further, the first network device carries a first VNI for identifying the first VXLAN in a BGP message. The second network device learns the corresponding EVPN route according to the first VNI in the BGP message.
  • FIG. 3 is a schematic flowchart of a method for receiving a BGP message provided by the present application.
  • the method shown in FIG. 3 is executed by a second network device.
  • the second network device may be LS2 in FIG. 1.
  • the second network device may perform an action performed by the LS2 described in the foregoing embodiment.
  • the method includes: S301, S302, and S303.
  • the second network device receives a BGP message from the first network device.
  • the BGP message includes a first MAC address and indication information, where the indication information is used to indicate that the host identified by the first MAC address is an attacker.
  • the first network device may be LS1.
  • the first MAC address may be a MAC address 1.
  • the host identified by the first MAC address may be server 1.
  • the BGP message may be a routing message 2.
  • the instruction information may be instruction information 1.
  • the second network device receives a first packet.
  • the destination MAC address of the first packet is equal to the first MAC address.
  • the first packet may be an Ethernet frame generated by a host in a network governed by LS2.
  • the first message may be an Ethernet frame generated by the server 3 or an Ethernet frame generated by the server 4.
  • LS2 may receive the first message via the Ethernet interface of LS2.
  • the destination MAC address of the first packet is equal to the first MAC address, which indicates that the generator (for example, server 3) of the first packet wants to perform the communication with the host (for example, server 1) identified by the first MAC address. Communication.
  • the second network device avoids forwarding the first packet to the host identified by the first MAC address.
  • the second network device avoids sending to the first MAC address based on the first MAC address in the BGP message, the indication information in the BGP message, and the destination MAC address in the first packet.
  • the host identified by the first MAC address forwards the first message.
  • LS2 can generate forwarding entry 1 based on routing message 2.
  • the first message may be message 1.
  • the LS2 may discard the packet 1 according to the forwarding entry 1, or perform other processing.
  • the generation process of the forwarding entry 1 the structure of the forwarding entry 1, and how to process the packet 1 according to the forwarding entry 1, please refer to the related description above, which will not be repeated here.
  • the second network device after the second network device receives the BGP message carrying the first MAC address and the indication information, the second network device is based on the first MAC address in the BGP message and the BGP message. Avoiding forwarding the first message to the host identified by the first MAC address by using the indication information and the destination MAC address in the first message.
  • the second network device may use the BGP message sent by the first network device to form a forwarding mechanism to avoid forwarding the first message to the host identified by the first MAC address. Therefore, the engineer does not need to manually configure a forwarding rule for the destination MAC address as the first MAC address on the second network device. Therefore, the above technical solution helps reduce the workload of engineers performing manual configuration on network equipment.
  • the technical solution shown in FIG. 3 may further include:
  • the second network device receives a second packet, and a source MAC address of the second packet is equal to the first MAC address.
  • LS2 can generate forwarding entry 2 based on routing message 2.
  • the second message may be message 2.
  • the LS2 may discard the packet 2 according to the forwarding entry 2.
  • the generation process of the forwarding entry 2 the structure of the forwarding entry 2, and how to process the packet 2 according to the forwarding entry 2, please refer to the related description above, which will not be repeated here.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP.
  • S301 includes: the second VTEP receives a Border Gateway Protocol BGP update message from the second VTEP.
  • the BGP message is carried in the BGP update message, the BGP update message includes an IP header and a payload, the IP header includes a destination IP address, the payload includes MP_REACH_NLRI, and the MP_REACH_NLRI includes a next hop network address
  • the destination IP address is equal to the second VTEP address, and the next hop network address is equal to the first VTEP address.
  • the first VTEP may be VTEP1.
  • the second VTEP may be VTEP2.
  • VTEP1 can include the sending interface of LS1.
  • the sending interface may be an Ethernet interface.
  • VTEP2 can include the receiving interface of LS2.
  • the receiving interface may be an Ethernet interface.
  • VTEP2 can receive VTEP1 and send routing message 2 via the VXLAN tunnel between LS1 and LS2.
  • the first VTEP address may be VTEP IP address 1.
  • the second VTEP address may be a VTEP IP address 2.
  • the second VTEP receives the first VTEP via a tunnel and sends the BGP update message.
  • the tunnel is a VXLAN tunnel or a label switched path (LSP).
  • the LSP may be a segment routing traffic engineering (Segment Routing, Engineering, SR-TE) path.
  • the BGP message includes MAC / IP Advertising Route and MAC Mobility Extended Community.
  • the first MAC address is carried in the MAC / IP Advertisement route.
  • the indication information is carried in the MAC Mobility Extended Community.
  • the MAC Mobility Extended Community includes a flag with 8 bits, and the indication information is carried on the MSB of the flag.
  • the BGP message is a BGP update message.
  • FIG. 4 is a schematic structural diagram of a first network device 400 provided in this application.
  • the first network device 400 includes a processor 410 and a transceiver 420.
  • the processor 410 is coupled with the transceiver 420.
  • the first network device 400 shown in FIG. 4 may execute the method shown in FIG. 2.
  • the first network device 400 may be LS1 in FIG. 1.
  • the processor 410 is configured to determine that the host identified by the first MAC address is an attacker.
  • the processor 410 may be a processor, or an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA).
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • the processor 410 is further configured to generate a BGP message, where the BGP message includes the first MAC address and indication information, the indication information is used to indicate that the host identified by the first MAC address is the attacker.
  • the processor 410 generates the BGP message based on that the host identified by the first MAC address is an attacker.
  • the transceiver 420 is configured to send the BGP message generated by the processor 410 to a second network device.
  • the second network device may be LS2 in FIG. 1.
  • the first network device 400 may include a memory 430.
  • the memory 430 is coupled to the processor 410.
  • the memory 430 may store a computer program.
  • a memory 430 stores a computer program for identifying a DDoS attack.
  • the processor 410 executes the computer program to analyze characteristics of multiple packets from an attacker, so as to determine that the multiple packets belong to a DDoS attack.
  • the source MAC addresses of the multiple packets are MAC address 1.
  • the processor 410 determines that the host (for example, server 1) identified by the MAC address 1 is an attacker according to the source MAC addresses of the multiple packets.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP
  • the transceiver 420 is configured to send the BGP message from the first VTEP to the second VTEP.
  • a VXLAN tunnel exists between the first VTEP and the second VTEP.
  • the transceiver 420 is located in the VXLAN tunnel.
  • the transceiver 420 includes an Ethernet interface, and the transceiver 420 may receive and transmit messages (for example, Ethernet frames) conforming to the Ethernet protocol.
  • the BGP message includes Media Access Control / Internet Protocol Advertisement Route MAC / IP, Advertisement Route, and Media Access Control Mobility Extended Community, and the first MAC address is carried in the MAC.
  • IP / Advertisement route the instruction information is carried in the MAC Mobility Extended Community.
  • the MAC Mobility Extended Community includes a flag with 8 bits, and the indication information is carried on the MSB of the flag.
  • the BGP message is a BGP update message.
  • FIG. 5 is a schematic structural diagram of a second network device 500 provided in this application.
  • the second network device 500 includes a first transceiver 510, a second transceiver 520, and a processor 530.
  • the first transceiver 510 is coupled to the processor 530.
  • the second transceiver 520 is coupled to the processor 530.
  • the second network device 500 shown in FIG. 5 may execute the method shown in FIG. 3.
  • the second network device 500 may be LS2 in FIG. 1.
  • the first transceiver 510 is configured to receive a BGP message from a first network device, where the BGP message includes a first media access control MAC address and indication information, and the indication information is used to indicate a host identified by the first MAC address Is an attacker.
  • the second transceiver 520 is configured to receive a first packet, and a destination MAC address of the first packet is equal to the first MAC address.
  • the first transceiver 510 may include an Ethernet interface.
  • the first transceiver 510 may receive and transmit a message (for example, an Ethernet frame) that complies with an Ethernet protocol.
  • the second transceiver 520 may include an Ethernet interface.
  • the second transceiver 520 may receive and transmit a message (for example, an Ethernet frame) that complies with the Ethernet protocol.
  • the first transceiver 510 may be located on a VXLAN tunnel between LS1 and LS2.
  • the second transceiver 520 may be used to connect to a network governed by LS2.
  • the second transceiver 520 may be used to connect to the server 3 and the server 4.
  • the processor 530 is configured to avoid sending to the first MAC address based on the first MAC address in the BGP message, the indication information in the BGP message, and the destination MAC address in the first packet.
  • the host identified by the MAC address forwards the first message.
  • the processor 530 may be a central processing unit, or may be an ASIC or an FPGA.
  • the second network device 500 may include a memory 540.
  • the memory 540 is coupled to the processor 530.
  • the memory 540 may store a computer program.
  • the memory 540 stores a computer program for implementing the functions of BGP.
  • the processor 530 executes the computer program to generate a forwarding entry 1 based on the BGP message and configuration information of the second network device 500.
  • the first message may be message 1.
  • the LS2 may discard the packet 1 according to the forwarding entry 1, or perform other processing.
  • the generation process of the forwarding entry 1 the structure of the forwarding entry 1, and how to process the packet 1 according to the forwarding entry 1, please refer to the related description above, which will not be repeated here.
  • the second transceiver 520 is further configured to receive a second packet, and a source MAC address of the second packet is equal to the first MAC address.
  • the processor 530 is further configured to avoid forwarding the first MAC address based on the first MAC address in the BGP message, the indication information in the BGP message, and the source MAC address in the second message. Two messages.
  • LS2 can generate forwarding entry 2 based on routing message 2.
  • the second message may be message 2.
  • the LS2 may discard the packet 2 according to the forwarding entry 2.
  • the generation process of the forwarding entry 2 the structure of the forwarding entry 2, and how to process the packet 2 according to the forwarding entry 2, refer to the related descriptions above, and will not be repeated here.
  • the first network device includes a first VTEP
  • the second network device includes a second VTEP
  • the first transceiver 510 is configured to send the BGP message from the first VTEP to the second VTEP.
  • the first transceiver 510 may be located on a VXLAN tunnel between LS1 and LS2. After receiving the BGP message from the first VTEP (contained in the first network device) via the VXLAN tunnel, the first transceiver 510 may send the BGP message to the second VTEP in the second network device.
  • the BGP message includes Media Access Control / Internet Protocol Advertisement Route MAC / IP, Advertisement Route, and Media Access Control Mobility Extended Community, and the first MAC address is carried in the MAC.
  • IP / Advertisement route the instruction information is carried in the MAC Mobility Extended Community.
  • the MAC Mobility Extended Community includes a flag with 8 bits, and the indication information is carried on the MSB of the flag.
  • FIG. 6 is a system provided by the present application.
  • the system 600 includes a first network device 601 and a second network device 602.
  • the first network device 601 may be the first network device 400 shown in FIG. 4.
  • the second network device 602 may be the second network device 500 shown in FIG. 5.
  • the first network device 601 may execute the method shown in FIG. 2.
  • the second network device 602 may execute the method shown in FIG. 3.
  • the first network device 601 may be LS1 in FIG. 1.
  • the second network device 602 may be LS2 in FIG. 1.
  • the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program.
  • the network device When the computer program is executed by a network device, the network device is caused to execute the method shown in FIG. 2 or the method shown in FIG. 3.
  • the network device may be a first network device involved in the method shown in FIG. 2 or a second network device involved in the method shown in FIG. 3.
  • the computer program product includes a computer program.
  • the computer program may be stored on a computer-readable storage medium.
  • the network device is caused to execute the method shown in FIG. 2 or the method shown in FIG. 3.
  • the network device may be a first network device involved in the method shown in FIG. 2 or a second network device involved in the method shown in FIG. 3.
  • the method or steps in the method described in this application may be implemented in a hardware manner, or may be implemented in a manner in which a processor executes software instructions.
  • Software instructions can be composed of corresponding software modules.
  • a software module may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, mobile hard disk, CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be an integral part of the processor.
  • the processor and the storage medium may reside in an ASIC.
  • the ASIC may reside in a user equipment.
  • the processor and the storage medium may also exist in the user equipment as discrete components.
  • Computer-readable media includes computer storage media and communication media including communication media that facilitates transfer of a computer program from one place to another.
  • a storage medium may be a medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种发送BGP消息的方法。该方法包括：第一网络设备确定第一MAC地址所标识的主机为攻击者。所述第一网络设备生成BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者。所述第一网络设备向第二网络设备发送所述BGP消息。此外，还提供了其他方法以及设备。上述技术方案中有助于减小工程师在网络设备上进行手工配置的工作量。

Description

发送BGP消息的方法、接收BGP消息的方法以及设备
本申请要求于2018年06月30日提交中国国家知识产权局、申请号为201810703112.1、申请名称为“发送BGP消息的方法、接收BGP消息的方法以及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种发送边界网关协议(Border Gateway Protocol，BGP)消息的方法、接BGP消息的方法以及相关设备。
背景技术
网络设备可以连接多个主机。例如，网络设备可以是交换机。网络设备接收到来自主机的报文时，网络设备可以对报文进行转发。所述多个主机中可能包含了攻击者。例如，主机1是攻击者。工程师可以在网络设备上手工配置关于主机1的转发规则。所述转发规则包含了主机1的媒体访问控制(media access control，MAC)地址。例如，MAC地址具有48个比特。当网络设备检测到所述网络设备接收的报文的源MAC地址是主机1的MAC地址时，网络设备可以根据所述转发规则丢弃该报文。
上述技术方案中，工程师需要手工配置关于攻击者的转发规则，手工配置的工作量比较大。
发明内容
本申请提供了一种发送BGP消息的方法、接收BGP消息的方法以及相关设备。有助于降低手工配置的工作量。
本申请提供了如下技术方案。
第一方面，提供了一种发送BGP消息的方法。该方法包括：第一网络设备确定第一媒体访问控制MAC地址所标识的主机为攻击者。所述第一网络设备生成BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者。所述第一网络设备向第二网络设备发送所述BGP消息。
上述技术方案中，第一网络设备确定第一MAC地址所标识的主机为攻击者后，第一网络设备可以生成携带所述第一MAC地址以及指示信息的BGP消息，并向第二网络设备发送所述BGP消息。进而，第二网络设备可以根据BGP消息中的第一MAC地址以及指示信息，生成用于阻止第二网络设备向所述第一MAC地址标识的所述主机转发第二网络设备接收到的报文的转发规则。也就是说，第二网络设备可以利用第一网络设备发送的BGP消息生成转发规则，工程师不需要在第二网络设备上手工配置所述转发规则。因此，上述技术方案有助于减小工程师在网络设备上进行手工配置的工作量。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括 第二VTEP。所述第一网络设备向第二网络设备发送所述BGP消息包括：所述第一VTEP向所述第二VTEP发送所述BGP消息。
上述技术方案中，可以利用VTEP实现BGP消息的传输。
在一种可能的设计中，第一VTEP地址标识所述第一VTEP，第二VTEP地址标识所述第二VTEP，所述BGP消息包括网际协议(internet protocol，IP)头以及净荷，所述IP头包括目的IP地址，所述净荷包括MP_REACH_NLRI，所述MP_REACH_NLRI包括下一跳网络地址，所述目的IP地址等于所述第二VTEP地址，所述下一跳网络地址等于所述第一VTEP地址。
在一种可能的设计中，所述第一VTEP经由隧道向所述第二VTEP发送所述BGP消息，所述隧道是VXLAN隧道，或者LSP。
在一种可能的设计中，所述第一网络设备生成BGP消息包括：所述第一网络设备确定MAC地址为所述第一MAC地址的主机是攻击者。所述第一网络设备接收数据报文，所述数据报文的源MAC地址为所述第一MAC地址。所述第一网络设备基于所述数据报文的源MAC地址标识的主机是攻击者，生成所述BGP消息。
上述技术方案中，所述第一网络设备基于所述数据报文的触发而生成所述BGP消息。也就是说，当第一网络设备确定第一MAC地址所标识的主机为攻击者时，所述第一网络设备不是必须立即生成BGP消息，并通知第二网络设备。当第一网络设备确定第一MAC地址所标识的主机为攻击者时，第一MAC地址所标识的主机可能并没有接入第一网络设备所管辖的网络。例如，第一MAC地址所标识的主机可能已下线，或者第一MAC地址所标识的主机可能已漫游到其他网络。因此，当第一网络设备确定第一MAC地址所标识的主机为攻击者时，第一网络设备和第二网络设备可能并没有遭到所述攻击者的攻击。在第一网络设备没有遭到所述攻击者攻击的情况下，第一网络设备暂时不生成以及发送BGP消息，有助于降低第一网络设备和第二网络设备的开销。当第一网络设备接收到源MAC地址为所述第一MAC地址的数据报文时，表明第一网络设备开始受到所述攻击者的攻击。第一网络设备开始受到所述攻击者的攻击时，第一网络设备通知第二网络设备所述攻击者的MAC地址，有助于获得降低开销和阻止攻击者的攻击的折中。
在一种可能的设计中，所述第一网络设备基于所述数据报文的源MAC地址标识的主机是攻击者，生成所述BGP消息，包括：所述第一网络设备确定所述数据报文来自第一VXLAN，第一虚拟扩展局域网网络标识VNI标识所述第一VXLAN。所述第一网络设备基于所述数据报文携带的源MAC地址，以及所述数据报文来自第一VXLAN，确定所述第一MAC地址标识的主机位于所述第一VXLAN。所述第一网络设备基于所述数据报文来自第一VXLAN，生成所述BGP消息，所述BGP消息包括所述第一VNI。
在一种可能的设计中，所述第一网络设备确定所述数据报文来自第一VXLAN，包括：所述第一网络设备经由第一端口接收所述数据报文，所述第一端口配置了所述第一VNI。所述第一网络设备基于用于接收所述数据报文的所述第一端口配置了所述第一VNI，确定所述数据报文来自所述第一VXLAN。
在一种可能的设计中，所述第一网络设备确定所述数据报文来自第一VXLAN，包括：所述第一网络设备确定所述数据报文中包含的第一虚拟局域网标识VLAN ID配置 了所述第一VNI。所述第一网络设备基于所述数据报文包含的所述第一VLAN ID配置了所述第一VNI，确定所述数据报文来自所述第一VXLAN。
第二方面，提供了一种接收BGP消息的方法。该方法包括：第二网络设备接收来自第一网络设备的BGP消息，所述BGP消息包括第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者。所述第二网络设备接收第一报文，所述第一报文的目的MAC地址等于所述第一MAC地址。所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
在一种可能的设计中，所述第二网络设备接收第二报文，所述第二报文的源MAC地址等于所述第一MAC地址。所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。所述第二网络设备接收来自第一网络设备的BGP消息包括：所述第二VTEP接收来自所述第一VTEP的所述路由信息。
在一种可能的设计中，所述第二VTEP接收来自所述第二VTEP的BGP update消息，所述BGP消息携带在所述BGP update消息中，所述BGP update消息包括IP头以及净荷，所述IP头包括目的IP地址，所述净荷包括MP_REACH_NLRI，所述MP_REACH_NLRI包括下一跳网络地址，所述目的IP地址等于所述第二VTEP地址，所述下一跳网络地址等于所述第一VTEP地址。
在一种可能的设计中，所述第二VTEP经由隧道接收来自所述第二VTEP的所述BGP update消息，所述隧道是VXLAN隧道或者LSP。
第三方面，提供了一种第一网络设备。所述第一网络设备包括处理器以及与所述处理器耦合的收发器。所述处理器用于确定第一MAC地址所标识的主机为攻击者。所述处理器还用于生成边界网关协议BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者。所述收发器用于向第二网络设备发送所述处理器生成的所述BGP消息。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。所述收发器用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
第四方面，提供了一种第二网络设备。所述第二网络设备包括第一收发器、第二收发器以及与所述第一收发器和所述第二收发器耦合的处理器。所述第一收发器用于接收来自第一网络设备的边界网关协议BGP消息，所述BGP消息包括第一媒体访问控制MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者。所述第二收发器用于接收第一报文，所述第一报文的目的MAC地址等于所述第一MAC地址。所述处理器用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
在一种可能的设计中，所述第二收发器还用于接收第二报文，所述第二报文的源 MAC地址等于所述第一MAC地址。所述处理器还用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。所述第一收发器用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
第五方面，提供了一种系统。所述系统包括第三方面提供的第一网络设备以及第四方面提供第二网络设备。
第六方面，提供了一种计算机可读存储介质。所述计算机可读存储介质存储计算机程序。当所述计算机程序被网络设备执行时，使得网络设备执行第一方面提供的方法，或者第二方面提供的方法。举例来说，所述网络设备可以是第一方面涉及的第一网络设备，或者第二方面涉及的第二网络设备。
第七方面，提供了一种计算机程序产品。所述计算机程序产品包含计算机程序。所述计算机程序可以保存在计算机可读存储介质上。当所述计算机程序被网络设备执行时，使得网络设备执行第一方面提供的方法，或者第二方面提供的方法。举例来说，所述网络设备可以是第一方面涉及的第一网络设备，或者第二方面涉及的第二网络设备。
在第一方面至第七方面的一种可能的设计中，所述BGP消息包含MAC/IP Advertisement route以及MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
上述技术方案中，可以利用IETF已定义的EVPN路由消息发布攻击者的MAC地址。有助于使得本申请提供的技术方案兼容已有的网络，降低实现成本。
进一步地，所述MAC Mobility Extended Community包括具有8个比特的旗帜(flags)，所述指示信息携带在所述旗帜的最高有效位(most significant bit，MSB)上。
上述技术方案中，利用了IETF已定义的EVPN路由消息中的字段携带所述指示信息，有助于使得本申请提供的技术方案兼容已有的网络，降低实现成本。
在第一方面至第七方面的一种可能的设计中，所述BGP消息为BGP更新(update)消息。
附图说明
图1为本申请提供的一种数据中心网络的结构示意图；
图1a为本申请提供的一种交换机的结构示意图；
图1b为本申请提供的一种服务器的结构示意图；
图2为本申请提供的一种发送BGP消息的方法的流程示意图；
图3为本申请提供的一种接收BGP消息的方法的流程示意图；
图4为本申请提供的一种第一网络设备的结构示意图；
图5为本申请提供的一种第二网络设备的结构示意图；
图6为本申请提供的一种系统的结构示意图。
具体实施方式
图1为本申请提供的一种数据中心网络的结构示意图。参见图1，数据中心网络包括服务器1至服务器6、叶子交换机(leaf switch，LS)1、LS1、LS3以及脊柱交换机(spine switch，SS)1、SS2以及SS3。其中，服务器1和服务器2连接到LS1。服务器3和服务器4连接到LS2。服务器5和服务器6连接到LS3。LS1连接到SS1、SS2以及SS3。LS2连接到SS1、SS2以及SS3。LS3连接到SS1、SS2以及SS3。服务器1需要经由LS1与其他服务器进行通信。服务器6需要经由LS3与其他服务器进行通信。服务器1与服务器6进行通信时，服务器1发送的数据流可以经由不同的路径到达服务器6。不同的路径包括：路径1(LS1-SS1-LS3)、路径2(LS1-SS2-LS3)以及路径3(LS1-SS3-LS3)。
图1a为本申请提供的一种交换机的结构示意图。图1中的LS可以是交换机100。图1中的SS可以是交换机100。关于图1中的LS和SS的具体实现方式，可以参见本申请对交换机100的描述。
参见图1a，交换机100包括端口a至端口f、网络处理器110、存储器120、流量管理器130以及存储器140。端口a、端口b以及端口c与网络处理器110耦合。端口a、端口b以及端口c为发送端口，可以将接收到的报文发送至网络处理器110。交换机100可以包含更多或者更少的接收端口。端口d、端口e以及端口f与流量管理器130耦合。网络处理器110和存储器120耦合。存储器120中可以保存计算机程序以及转发表。所述转发表可以是哈希表。网络处理器110可以通过执行存储器120中保存的计算机程序和/或查找转发表，对来自接收端口的报文进行处理。例如，网络处理器110可以通过执行计算机程序，对报文中的哈希键执行哈希运算，从而获得哈希值。再例如，网络处理器110可以通过查找哈希表，确定与哈希值匹配的表项。根据与哈希值匹配的表项，确定用于转发报文的发送端口。所述发送端口可以是端口d、端口e或者端口f。网络处理器110和流量管理器130耦合。流量管理器130与存储器140耦合。例如，网络处理器110确定用于转发报文的发送端口后，可以将报文发送至流量管理器130。流量管理器130也可以称为调度器。流量管理器130中可以维护与端口d、端口e以及端口f一一对应的三个发送缓存队列。流量管理器130接收到来自网络处理器110的报文后，可以根据用于转发报文的发送端口，将报文入队到与用于转发报文的发送端口对应的发送缓存队列。流量管理器130可以对位于发送缓存队列中的报文进行调度，从而通过发送端口发送报文。具体地，流量管理器130中可以维护与所述三个发送缓存队列一一对应的三个报文描述符队列。报文描述符队列中包含多个报文描述符。每个报文描述符包含报文存储在发送缓存队列中的地址。当流量管理器130需要将报文入队到发送缓存队列时，流量管理器130可以在报文描述符队列中增加该报文的存储地址。流量管理器130可以对存储器140执行写操作，从而将报文入队到发送缓存队列。当流量管理器130需要将报文从发送缓存队列出队时，流量管理器130可以将报文描述符队列中该报文的存储地址删除。流量管理器130可以对存储器140执行读操作，从而将报文从发送缓存队列出队。报文出队后，报文经由发送端口被发送。
需要说明的是，图1a所示的交换机可以包括控制平面以及转发平面。所述控制平面 可以用于路由学习，路由发布，生成转发规则，以及更新转发平面的转发表。所述转发平面可以用于根据转发表，对报文进行转发。所述转发平面可以包括网络处理器110、存储器120、流量管理器130以及存储器140。所述控制平面可以包括中央处理单元(central processing unit，CPU)以及与所述中央处理单元耦合的存储器。所述与中央处理单元耦合的存储器中可以保存用于运行网络协议的计算机程序。所述网络协议可以是BGP。所述中央处理单元可以通过执行所述计算机程序，实现BGP定义的功能。例如，所述中央处理单元可以学习服务器的MAC地址。可以基于服务器的MAC地址，生成路由消息。可以向远端交换机发送路由消息。另外，交换机接收到来自远端交换机的路由消息后，可以根据来自远端交换机的路由消息更新转发平面的转发表。例如，来自远端交换机的路由消息中包含远端服务器的MAC地址。所述中央处理单元可以在转发表中增加关于远端服务器的表项。因此，当服务器接收目的MAC地址为远端服务器的MAC地址的报文时，交换机的转发平面可以根据关于远端服务器的表项，对该报文进行转发。
图1b为本申请提供的一种服务器的结构示意图。图1中的服务器可以是服务器1000。关于图1中的服务器的具体实现方式，可以参见本申请对服务器1000的描述。
参见图1b，服务器1000包括中央处理单元1100、存储器1200、端口1300以及总线。处理单元1100、存储器1200以及端口1300通过所述总线耦合。存储器1200存储软件。所述软件包含操作系统以及多个应用程序。中央处理单元1100通过访问存储器1200运行所述操作系统以及所述多个应用程序。所述操作系统可以是Window或者Linux。基于所述操作系统，中央处理单元1100运行所述多个应用程序。端口1300可以用于接收报文以及发送报文。例如，当端口1300接收到来自交换机100的报文后，存储器1200可以保存报文。中央处理单元1100可以根据应用程序对报文进行处理。另外，中央处理单元1100可以根据应用程序生成报文，并经由端口1300将报文发送至交换机100。
另外，图1b中的中央处理单元1100可以被替换为其他的处理器。所述其他处理器可以是数字信号处理器(digital signal processor，DSP)、专用集成电路(application-specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等。
图1所示的数据中心网络具体可以是以太网虚拟专用网络(Ethernet Virtual Private Network，EVPN)。关于EVPN，可以参见因特网工程任务组(英文：Internet Engineering Task Force，缩写：IETF)发布的请求评论(英文：Request For Comments，缩写：RFC)7432的说明，所述RFC7432以全文引用的方式并入本申请中。如无相反的说明，本申请提及的以“RFC”开头的文档，都是IETF发布的。例如RFC7348也是IETF发布的。
例如，LS1和LS2可以运行RFC7348。具体地，LS1和LS2可以分别包含一个虚拟扩展局域网隧道端点(VXLAN Tunnel End Point，VTEP)。VTEP是用于创建(originate)和/或终结(terminate)VXLAN隧道的实体。关于VTEP，可以参考RFC7348中的相关描述。本申请中将LS1中包含的VTEP称为VTEP1，将LS2中包含的VTEP称为VTEP2。 VTEP1对应VTEP IP地址1。VTEP2对应VTEP IP地址2。工程师可以对LS1进行手工配置，从而使得LS1包含VTEP1。工程师可以对LS2进行手工配置，从而使得LS2包含VTEP2。例如，工程师可以进行如下配置：在LS1上配置VTEP IP地址1(例如1.1.1.9)。另外，LS1和LS2可以位于同一个VXLAN。例如，LS1和LS2都位于虚拟扩展局域网网络标识(VXLAN Network Identifier，VNI)指示的VXLAN。VNI的值可以是100。工程师可以在LS1上配置VNI(例如100)。在LS1上配置RD(例如1:1)。在LS1上配置RT(例如1:1)。在LS2上配置VTEP IP地址2(例如2.2.2.9)。在LS2上配置VNI(例如100)。另外，工程师可以在LS2上配置LS1和LS2之间的VXLAN隧道。例如，工程师在LS2上配置所述VXLAN隧道的信息。所述信息可以包括源IP地址(例如2.2.2.9)以及目的IP地址(例如1.1.1.9)。源IP地址为沿着LS2到LS1的方向，所述VXLAN隧道的入口节点(例如VTEP2)的IP地址。目的IP地址为沿着LS2到LS1的方向，所述VXLAN隧道的出口节点(例如VTEP1)的IP地址。工程师在LS1上配置所述VXLAN隧道的信息。所述信息可以包括隧道类型(TunnelType)。例如，当TunnelType的值等于8时，TunnelType指示所述VXLAN隧道的隧道类型为VXLAN。在一种可能的设计中，所述VXLAN隧道可以经过SS1、SS2以及SS3中的至少一个。也就是说，SS1、SS2以及SS3中的至少一个可以所述VXLAN隧道的中间节点。
LS1运行BGP。LS2运行BGP。具体地，LS1包含处理器以及存储器。存储器中保存实现BGP的功能的代码。LS1中的处理器(例如中央处理单元)通过执行所述代码运行BGP。LS2也可以通过上述机制运行BGP。LS2是LS1的BGP peer。也可以将LS1和LS2称为一对BGP peer。LS1可以学习LS1所管辖的网络中的服务器的MAC地址。例如，LS1可以学习服务器1的MAC地址以及服务器2的MAC地址。LS2可以学习LS2所管辖的网络中的服务器的MAC地址。例如，LS2可以学习服务器3的MAC地址以及服务器4的MAC地址。LS1可以经由所述VXLAN隧道向LS2发送EVPN路由。LS1发送的EVPN路由可以包括服务器1的MAC地址以及服务器2的MAC地址。LS2可以经由所述VXLAN隧道向LS1发送EVPN路由。LS2发送的EVPN路由可以包括服务器3的MAC地址以及服务器4的MAC地址。
下文对LS1学习服务器1的MAC地址，并向LS2发送携带服务器1的MAC地址的EVPN路由进行举例说明。
LS1包含接口1。接口1为以太网接口。LS1经由接口1连接服务器1。工程师在LS1上配置了与接口1关联的VNI(例如100)。服务器1生成以太网帧1并经由接口1向LS1发送以太网帧1。以太网帧1的源MAC地址为服务器1的MAC地址。LS1经由接口1接收到以太网帧1后，确定接收以太网帧1的接口为接口1。进而，LS1确定与接口1管理的VNI的值等于100。另外，LS1对以太网帧1进行解析，从而获取服务器1的MAC地址。LS1基于RFC7432，根据LS1保存的配置信息，以及LS1从以太网帧1中获取的信息，生成路由消息1。具体地，LS1中的处理器(例如中央处理单元)可以通过执行实现BGP的功能的代码生成路由消息1。下面对路由消息1进行举例说明：
具体地，路由消息1可以携带在IP报文中。所述IP报文包括IP头以及IP净荷。IP头与IP净荷相邻。IP净荷位于IP头的后面。IP头包括源IP地址、目的IP地址以及协议(protocol)。源IP地址的值可以等于VTEP IP地址1(例如1.1.1.9)。 目的IP地址的值可以等于VTEP IP地址2(例如2.2.2.9)。IP头中的协议用于指示IP头的下一个头的类型。例如，当协议的值等于6时，IP头中的协议指示IP报文中，IP头的下一个头是传输控制协议(Transmission Control Protocol，TCP)头。IP净荷包括TCP头以及TCP净荷。TCP头与TCP净荷相邻。TCP净荷位于TCP头的后面。TCP头与IP头相邻。TCP头包括源端口(source port)。TCP头中的源端口可以用于指示TCP净荷的类型。例如，当源端口的值等于179时，TCP头中的源端口指示TCP净荷是BGP消息。
路由消息1可以是BGP消息。具体地，可以是BGP update消息。路由消息1可以包括多协议可达网络层可达信息(Multiprotocol Reachable Network Layer Reachability Information，MP_REACH_NLRI)。所述MP_REACH_NLRI是一种路径属性(path attribute)。关于MP_REACH_NLRI，可以参考RFC4760中的相关描述。路由消息1还可以携带其他路径属性。例如，路由消息1还可以携带本地偏好(local preference)。所述MP_REACH_NLRI包括下一跳网络地址(next hop network address)字段。所述下一跳网络地址字段可以携带LS1上保存的VTEP IP地址1(例如1.1.1.9)。
路由消息1包含媒体访问控制/网际协议通告路由(MAC/IP Advertisement route)。关于MAC/IP Advertisement route，可以参考RFC7432中的相关描述。此外，路由消息还可以包括媒体访问控制移动性扩展团体(MAC Mobility Extended Community)。关于MAC Mobility Extended Community，可以参考RFC7432中的相关描述。
服务器1的MAC地址可以携带在所述MAC/IP Advertisement route中。具体地，所述MAC/IP Advertisement route包括MAC地址字段。所述MAC地址字段具有6个字节。服务器1的MAC地址可以携带在所述MAC地址字段。所述MAC/IP Advertisement route包括多协议标签交换标签(MPLS Label)1字段。MPLS Label 1字段具有3个字节。MPLS Label 1字段可以携带LS1上保存的VNI(例如100)。所述MAC/IP Advertisement route包括RD字段。所述RD字段包括8个字节。所述RD字段可以携带LS1上保存的RD(例如1:1)。此外，所述MAC/IP Advertisement route还包括MPLS Label 2字段。此外，路由消息1中可以包括扩展团体属性(Extended Communities Attribute)。关于扩展团体属性，可以参考RFC4360中对BGP Extended Communities Attribute的描述。具体地，扩展团体属性可以包括TunnelType字段以及RT字段。TunnelType字段可以携带LS1上保存的TunnelType(例如8)。RT字段可以携带LS1上保存的RT(例如1:1)。
LS1生成路由消息1后，可以通过所述VXLAN隧道向LS2发送路由消息1。
LS2接收到路由消息1后，对路由消息1进行解析，获得路由消息1中的下一跳网络地址字段的值。所述下一跳网络地址字段的值等于VTEP IP地址1(例如1.1.1.9)。LS2根据从路由消息1中获取的所述下一跳网络地址字段的值，以及LS2保存的所述VXLAN隧道的信息，确定LS2能够通过所述VXLAN隧道向LS1发送目的地址为服务器1的MAC地址的以太网帧。所述信息包括源IP地址(例如2.2.2.9)以及目的IP地址(例如1.1.1.9)。具体地，LS2根据所述下一跳网络地址字段的值等于所述VXLAN隧道的目的IP地址，确定路由消息1与所述VXLAN隧道是匹配的。进而，LS2可以生成转发表项。所述转发表项包括MAC地址(例如服务器1的MAC地址)、VNI(例如 100)、源IP地址(例如2.2.2.9)以及目的IP地址(例如1.1.1.9)。
下文对LS2如何利用所述转发表项对以太网帧进行转发进行举例说明。
当LS2接收到目的MAC地址为服务器1的MAC地址的以太网帧(以太网帧2)时，可以基于以太网帧2中的目的MAC地址等于转发表项中的MAC地址，确定以太网帧2与转发表项匹配。进而，LS2可以对以太网帧2进行封装，得到封装的报文。具体地，LS2可以为以太网帧2添加隧道头。所述隧道头可以包括源IP地址(例如2.2.2.9)、目的IP地址(例如1.1.1.9)以及VNI(例如100)。LS2可以从所述转发表项中获取隧道头中的字段的值，从而实现对以太网帧2的封装。LS2生成封装的报文后，可以经由所述VXLAN隧道向LS1发送所述封装的报文。在上述的举例中，LS1和LS2之间的隧道为VXLAN隧道。可替换的，LS1和LS2之间的隧道也可以是其他隧道。例如，LS1和LS2之间的隧道可以是段路由流量工程(Segment Routing Traffic Engineering，SR-TE)路径。
上述的举例中描述了LS1学习服务器1的MAC地址，并通过路由消息向LS2发送服务器1的MAC地址。图1中的任意一个LS可以按照类似的方式学习该LS所管辖的网络中的服务器的MAC地址，并通过路由消息向远端的LS发送服务器的MAC地址。例如，LS3和LS2之间可以存在一个VXLAN隧道。LS3可以学习服务器5的MAC地址。然后，LS3可以经由LS3和LS2之间的VXLAN隧道向LS2发送携带服务器5的MAC地址的路由消息。
上述举例中，图1中的LS和SS为交换机。可替换的，图1中的LS和SS也可以是其他网络设备。例如，图1中的LS和SS可以为路由器。在一种可能的设计中，LS和SS可以是运营商边缘(provider edge，PE)路由器。PE路由器位于核心网(core network)的边缘。PE路由器可以用于连接CE路由器。在另一种可能的设计中，LS可以是PE路由器。SS可以是运营商(provider，P)路由器。P路由器是一种标签交换路由器(Label Switch Router，LSR)。P路由器是核心网中的传输路由器(transit router)。P路由器可以用于连接的一个或者多个PE路由器。图1a为交换机的结构示意图。图1a也可以是其他网络设备的结构示意图。例如，图1a也可以是路由器的结构示意图。
上述举例中，图1中的LS用于连接服务器。在一种的可能的设计中，LS可以通过电缆或者光缆直接连接服务器。在另一种可能的设计中，LS可以经由中间设备间接连接服务器。所述中间设备可以是路由器、以太网交换机或者网关。可替换的，图1中的LS可以连接其他类型的主机。其他类型的主机可以是个人电脑或者虚拟机(virtual machine，VM)。所述虚拟机可以运行在物理服务器中。在一种可能的设计中，LS可以经由接入设备连接到所述物理服务器。所述接入设备可以是网关或者以太网交换机。图1b是服务器的结构示意图。图1b也可以是其他主机的结构示意图。例如，图1b也可以是个人电脑的结构示意图。上述实施例以图1中的服务器1是合法用户为前提。LS1学习了作为合法用户的服务器1的MAC地址后，会将包含服务器1的MAC地址的路由消息发送给LS2。LS2根据路由消息生成转发表项，从而使得LS2管辖的网络中的服务器(例如服务器3)能够利用转发表项和服务器1进行通信。
在一种可能的场景中，图1中的服务器1是非法用户。具体地，服务器1可以是 攻击者。例如，服务器1可能会发起网络攻击(cyberattack)。所述网络攻击可以是拒绝服务(denial-of-service，DDoS)攻击、中间人(man in the middle)攻击、地址解析协议毒害(ARP poisoning)、乒泛洪(Ping flood)、窃听(wiretapping)、空闲扫描(idle scan)或者端口扫描(port scan)。
下文以所述网络攻击为DDoS攻击为例，对服务器1的攻击行为以及LS1识别服务器1为攻击者的过程进行说明：
在一种可能的设计中，服务器1的使用者在知晓某个软件能够发起DDoS攻击的情况下，在服务器1中安装并运行了该软件。服务器1在该软件的控制下，发送了多个报文，从而发起DDoS攻击。LS1具有识别DDoS攻击的能力。例如，LS1中包含了处理器和存储器。存储器中保存了用于识别DDoS攻击的计算机程序。LS1接收到所述多个报文。LS1中的处理器通过执行所述计算机程序，对所述多个报文的特征进行分析，从而确定服务器1是攻击者。进一步地，LS1通过对所述多个报文的源MAC地址进行解析获得服务器1的MAC地址(例如MAC地址1)。LS1确定MAC地址1所标识的主机(例如服务器1)是攻击者。
在另一种可能的设计中，由于使用者的误操作，服务器1被感染了计算机病毒。该计算机病毒能够发起DDoS攻击。服务器1中预先安装，并运行有计算机病毒监测软件。该计算机病毒监测软件对该计算机病毒(服务器1中的一个进程)的行为进行识别，确定服务器1被感染了计算机病毒。进一步地，服务器1在计算机病毒监测软件的控制下，确定服务器1是攻击者。服务器1向网管服务器(图1中未示出)发送消息1。消息1用于通知网管服务器服务器1是攻击者。例如，消息1中携带服务器1的MAC地址(例如MAC地址1)。网管服务器根据消息1确定服务器1是攻击者后，生成消息2。网管服务器向LS1发送消息2。消息2用于通知LS1服务器1是攻击者。例如，消息2中携带MAC地址1。LS1接收到消息2后，根据消息2中携带的MAC地址1确定MAC地址1标识的主机(例如服务器1)是攻击者。
LS1确定MAC地址1标识的主机(例如服务器1)是攻击者后，LS1生成路由消息2。LS1中的处理器(例如中央处理单元)可以通过执行实现BGP的功能的代码生成路由消息2。路由消息2包含MAC地址1以及指示信息1。指示信息1用于指示MAC地址1标识的主机(例如服务器1)为攻击者。LS1向LS2发送路由消息2。LS1可以根据LS1保存的配置信息，以及服务器1的MAC地址，生成路由消息2。关于LS1基于服务器1的MAC地址，生成路由消息2的过程，可以参考上文关于路由消息1的生成过程的描述。MAC地址1可以携带在路由消息2包含的MAC/IP Advertisement route中。具体地，MAC地址1可以携带在MAC/IP Advertisement route的MAC地址字段上。关于路由消息2的格式，可以参考上文对路由消息1的格式的描述。
需要说明的是，路由消息1是LS1确定服务器1是合法用户时生成的。LS1向LS2通告服务器1的MAC地址，使得LS2生成转发表项。进而，LS2管辖的服务器(例如服务器3)可以经由LS2和服务器1通信。路由消息2是LS1确定服务器1是攻击者时生成的。LS1向LS2通告服务器1的MAC地址，使得LS2生成转发规则。进而，LS2管辖的服务器(例如服务器3)避免经由LS2和服务器1通信。
路由消息2的功能不同于路由消息1。路由消息2的内容不同于路由消息1的内 容。具体地，路由消息2中包含了用于指示MAC地址1标识的主机(例如服务器1)为攻击者的指示信息1。路由消息1中不包含指示信息1。在一种可能的设计中，指示信息1携带在路由消息2中的MAC Mobility Extended Community中。MAC Mobility Extended Community包含旗帜(flags)字段。旗帜字段具有8个比特。指示信息1可以携带在旗帜字段的MSB。例如，当旗帜字段的MSB等于1时，旗帜字段的MSB指示路由消息2中的MAC地址1标识的主机(例如服务器1)为攻击者。
LS2接收来自LS1的路由消息2后，LS2可以根据路由消息2生成转发规则1以及转发规则2。LS2根据转发规则1，避免向MAC地址1标识的主机(例如服务器1)转发LS2收到的目的MAC地址为MAC地址1的报文。LS2根据转发规则2，避免转发LS2收到的源MAC地址为MAC地址1的报文。
转发规则1具体可以是转发表项1。转发规则2具体可以是转发表项2。LS2的转发平面可以包括转发表。所述转发表可以包括转发表项1以及转发表项2。所述转发平面的处理器(例如网络处理器)可以根据转发表，对接收到的报文进行处理。
转发表项1包括匹配域以及动作域。转发表项1的匹配域的值等于MAC地址1。转发表项1的动作域可以包括丢弃指令。转发表项1的匹配域用于与LS2接收到的报文(例如报文1)中的目的MAC地址进行匹配。当LS2确定报文1的目的MAC地址等于转发表项1的匹配域的值时，LS2确定报文1与转发表项1匹配。进而，LS2可以根据转发表项1的动作域的丢弃指令，对报文1进行丢弃处理。当然，转发表项1的动作域可以包括其他指令。其他指令可以指示将报文1发送至LS2的控制平面。所述控制平面的处理器可以是CPU。所述CPU收到来自转发平面的报文1后，可以对报文1进行分析。另外，LS2在所述CPU的控制下，还可以将报文1发送至网管服务器，以便网管服务器对报文1进行分析。LS2遵循转发规则1对报文1进行处理时，并不是意味着LS2只能对报文1进行丢弃处理，LS2也可以对报文1进行其他处理。只要LS2避免向MAC地址1标识的主机(例如服务器1)转发报文1即可。
转发表项2包括匹配域以及动作域。转发表项2的匹配域的值等于MAC地址1。转发表项2的动作域可以包括丢弃指令。转发表项2的匹配域用于与LS2接收到的报文(例如报文2)中的源MAC地址进行匹配。当LS2确定报文2的源MAC地址等于转发表项2的匹配域的值时，LS2确定报文2与转发表项2匹配。进而，LS2可以根据转发表项2的动作域的丢弃指令，对报文2进行丢弃处理。可以理解，LS2接收到报文2的源MAC地址等于MAC地址1，可能是由于服务器1从LS1管辖的网络漫游到LS2管辖的网络。另一种可能是，LS2管辖的网络中的主机盗用了服务器1的MAC地址。例如，服务器4构造以太网帧时，盗用了服务器1的MAC地址，将服务器1的MAC地址作为构造的以太网帧的源MAC地址。
图2为本申请提供的一种发送BGP消息的方法的流程示意图。图2所示的方法的执行主体为第一网络设备。例如，所述第一网络设备可以是图1中的LS1。关于所述第一网络设备的结构和功能，可以参考上述实施例关于LS1的结构和功能的描述。所述第一网络设备可以执行上述实施例描述的LS1执行的动作。关于图2所示的方法的具体实现方式，可以参考上述实施例的相关描述。参见图2，所述方法包括S201、S202以及S203。
S201、第一网络设备确定第一MAC地址所标识的主机为攻击者。
举例来说，所述第一MAC地址可以是MAC地址1。第一MAC地址所标识的主机可以是服务器1。
S202、所述第一网络设备生成BGP消息。
所述BGP消息包括所述第一MAC地址以及指示信息。所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者。
例如，所述BGP消息可以是路由消息2。所述指示信息可以是指示信息1。
S203、所述第一网络设备向第二网络设备发送所述BGP消息。
例如，所述第二网络设备可以是LS2。LS1可以经由LS1与LS2之间的VXLAN隧道向LS2发送所述BGP消息。
上述技术方案中，第一网络设备确定第一MAC地址所标识的主机为攻击者后，第一网络设备可以生成携带所述第一MAC地址以及指示信息的BGP消息，并向第二网络设备发送所述BGP消息。进而，第二网络设备可以根据BGP消息中的第一MAC地址以及指示信息，生成用于阻止第二网络设备向所述第一MAC地址标识的所述主机转发第二网络设备接收到的报文的转发规则。也就是说，第二网络设备可以利用第一网络设备发送的BGP消息生成转发规则，工程师不需要在第二网络设备上手工配置所述转发规则。因此，上述技术方案有助于减小工程师在网络设备上进行手工配置的工作量。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。
所述第一网络设备向第二网络设备发送所述BGP消息包括：所述第一VTEP向所述第二VTEP发送所述BGP消息。
举例来说，所述第一VTEP可以是VTEP1。所述第二VTEP可以是VTEP2。VTEP1可以包含LS1的发送接口。所述发送接口可以是以太网接口。VTEP2可以包含LS2的接收接口。所述接收接口可以是以太网接口。VTEP1可以经由LS1和LS2之间的VXLAN隧道向VTEP2发送路由消息2。
在一种可能的设计中，第一VTEP地址标识所述第一VTEP，第二VTEP地址标识所述第二VTEP。所述BGP消息包括IP头以及净荷。所述IP头包括目的IP地址，所述净荷包括MP_REACH_NLRI。所述MP_REACH_NLRI包括下一跳网络地址。所述目的IP地址等于所述第二VTEP地址，所述下一跳网络地址等于所述第一VTEP地址。
举例来说，第一VTEP地址可以是VTEP IP地址1。第二VTEP地址可以是VTEP IP地址2。
在一种可能的设计中，所述第一VTEP经由隧道向所述第二VTEP发送所述BGP update消息。所述隧道是VXLAN隧道或者标签交换路径(label switched path，LSP)。所述LSP可以是段路由流量工程(Segment Routing Traffic Engineering，SR-TE)路径。
可选地，图2所示的方法中，所述BGP消息包含MAC/IP Advertisement route以及MAC Mobility Extended Community。所述第一MAC地址携带在所述MAC/IP Advertisement route中。所述指示信息携带在所述MAC Mobility Extended Community中。
进一步地，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的MSB上。
进一步地，图2所示的方法中，所述BGP消息为BGP更新消息。
在一种可能的设计中，S202包括：所述第一网络设备接收数据报文，所述数据报文的源MAC地址为所述第一MAC地址；以及，所述第一网络设备基于所述数据报文的源MAC地址标识的主机是攻击者，生成所述BGP消息。
上述技术方案中，所述第一网络设备基于所述数据报文的触发而生成所述BGP消息。也就是说，当第一网络设备确定第一MAC地址所标识的主机为攻击者时，所述第一网络设备不是必须立即生成BGP消息，并通知第二网络设备。当第一网络设备确定第一MAC地址所标识的主机为攻击者时，第一MAC地址所标识的主机可能并没有接入第一网络设备所管辖的网络。例如，第一MAC地址所标识的主机可能已下线，或者第一MAC地址所标识的主机可能已漫游到其他网络。因此，当第一网络设备确定第一MAC地址所标识的主机为攻击者时，第一网络设备和第二网络设备可能并没有遭到所述攻击者的攻击。在第一网络设备没有遭到所述攻击者攻击的情况下，第一网络设备暂时不生成以及发送BGP消息，有助于降低第一网络设备和第二网络设备的开销。当第一网络设备接收到源MAC地址为所述第一MAC地址的数据报文时，表明第一网络设备开始受到所述攻击者的攻击。第一网络设备开始受到所述攻击者的攻击时，第一网络设备通知第二网络设备所述攻击者的MAC地址，有助于获得降低开销和阻止攻击者的攻击的折中。
在一种可能的设计中，S202包括：所述第一网络设备确定所述数据报文来自第一VXLAN，第一VNI标识所述第一VXLAN。所述第一网络设备基于所述数据报文携带的源MAC地址，以及所述数据报文来自第一VXLAN，确定所述第一MAC地址标识的主机位于所述第一VXLAN。所述第一网络设备基于所述第一MAC地址标识的主机位于所述第一VXLAN，生成所述BGP消息，所述BGP消息包括所述第一VNI。
在一种可能的实现方式中，所述第一网络设备确定所述数据报文来自第一VXLAN，包括：所述第一网络设备经由第一端口接收所述数据报文，所述第一端口配置了所述第一VNI。以及，所述第一网络设备基于用于接收所述数据报文的所述第一端口配置了所述第一VNI，确定所述数据报文来自所述第一VXLAN。
在另一种可能的实现方式中，所述第一网络设备确定所述数据报文来自第一VXLAN，包括：所述第一网络设备确定所述数据报文中包含的第一虚拟局域网标识(VLAN ID)配置了所述第一VNI。所述第一网络设备基于所述数据报文包含的所述第一VLAN ID配置了所述第一VNI，确定所述数据报文来自所述第一VXLAN。
上述技术方案中，所述第一网络设备根据配置信息，确定所述数据报文来自第一VXLAN。进而，所述第一网络设备在BGP消息中携带用于标识所述第一VXLAN的第一VNI。第二网络设备根据BGP消息中的第一VNI，学习相应的EVPN路由。
图3是本申请提供的一种接收BGP消息的方法的流程示意图。图3所示的方法的执行主体为第二网络设备。例如，所述第二网络设备可以是图1中的LS2。关于所述第二网络设备的结构和功能，可以参考上述实施例关于LS2的结构和功能的描述。所述第二网络设备可以执行上述实施例描述的LS2执行的动作。关于图3所示的方法的 具体实现方式，可以参考上述实施例的相关描述。参见图3，所述方法包括：S301、S302以及S303。
S301、第二网络设备接收来自第一网络设备的BGP消息。
所述BGP消息包括第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者。
举例来说，所述第一网络设备可以是LS1。所述第一MAC地址可以是MAC地址1。第一MAC地址所标识的主机可以是服务器1。所述BGP消息可以是路由消息2。所述指示信息可以是指示信息1。
S302、所述第二网络设备接收第一报文。
所述第一报文的目的MAC地址等于所述第一MAC地址。
举例来说，所述第一报文可以是LS2管辖的网络中的主机生成的以太网帧。例如，所述第一报文可以是服务器3生成的以太网帧，或者服务器4生成的以太网帧。LS2可以经由LS2的以太网接口接收所述第一报文。所述第一报文的目的MAC地址等于所述第一MAC地址，表明所述第一报文的生成者(例如服务器3)想要和第一MAC地址所标识的主机(例如服务器1)进行通信。
S303、所述第二网络设备避免向所述第一MAC地址标识的所述主机转发所述第一报文。
具体地，所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
举例来说，LS2可以根据路由消息2生成转发表项1。所述第一报文可以是报文1。所述LS2可以根据转发表项1对报文1进行丢弃处理，或者其他处理。关于转发表项1的生成过程，转发表项1的结构以及如何根据转发表项1对报文1进行处理，可以参考上文的相关描述，此处不再赘述。
上述技术方案中，第二网络设备接收携带所述第一MAC地址以及指示信息的BGP消息后，所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
也就是说，第二网络设备可以利用第一网络设备发送的BGP消息，形成避免向所述第一MAC地址标识的所述主机转发所述第一报文的转发机制。因此，工程师不需要在第二网络设备上手工配置针对目的MAC地址为所述第一MAC地址的转发规则。因此，上述技术方案有助于减小工程师在网络设备上进行手工配置的工作量。
在一种可能的设计中，图3所示的技术方案中，还可以包括：
所述第二网络设备接收第二报文，所述第二报文的源MAC地址等于所述第一MAC地址。
所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
举例来说，LS2可以根据路由消息2生成转发表项2。所述第二报文可以是报文2。所述LS2可以根据转发表项2对报文2进行丢弃处理。关于转发表项2的生成过程， 转发表项2的结构以及如何根据转发表项2对报文2进行处理，可以参考上文的相关描述，此处不再赘述。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。S301包括：所述第二VTEP接收来自所述第二VTEP的边界网关协议BGP update消息。
所述BGP消息携带在所述BGP update消息中，所述BGP update消息包括IP头以及净荷，所述IP头包括目的IP地址，所述净荷包括MP_REACH_NLRI，所述MP_REACH_NLRI包括下一跳网络地址，所述目的IP地址等于所述第二VTEP地址，所述下一跳网络地址等于所述第一VTEP地址。
举例来说，所述第一VTEP可以是VTEP1。所述第二VTEP可以是VTEP2。VTEP1可以包含LS1的发送接口。所述发送接口可以是以太网接口。VTEP2可以包含LS2的接收接口。所述接收接口可以是以太网接口。VTEP2可以经由LS1和LS2之间的VXLAN隧道接收VTEP1发送路由消息2。
举例来说，第一VTEP地址可以是VTEP IP地址1。第二VTEP地址可以是VTEP IP地址2。
在一种可能的设计中，所述第二VTEP经由隧道接收所述第一VTEP发送所述BGP update消息。所述隧道是VXLAN隧道或者标签交换路径(label switched path，LSP)。所述LSP可以是段路由流量工程(Segment Routing Traffic Engineering，SR-TE)路径。
可选地，图3所示的方法中，所述BGP消息包含MAC/IP Advertisement route以及MAC Mobility Extended Community。所述第一MAC地址携带在所述MAC/IP Advertisement route中。所述指示信息携带在所述MAC Mobility Extended Community中。
进一步地，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的MSB上。
进一步地，图3所示的方法中，所述BGP消息为BGP更新消息。
图4为本申请提供的一种第一网络设备400的结构示意图。第一网络设备400包括处理器410以及收发器420。处理器410与收发器420耦合。图4所示的第一网络设备400可以执行图2所示的方法。举例来说，第一网络设备400可以是图1中的LS1。关于第一网络设备400的具体实现方式，可以参考图2所示的实施例，也可以参考本申请对LS1的描述。
处理器410用于确定第一MAC地址所标识的主机为攻击者。
举例来说，处理器410可以是处理器，也可以是专用集成电路(application-specific integrated circuit，ASIC)或者现场可编程门阵列(field programmable gate array，FPGA)。
处理器410还用于生成BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者。
举例来说，处理器410基于所述第一MAC地址所标识的主机为攻击者，生成所述BGP消息。
收发器420用于向第二网络设备发送处理器410生成的所述BGP消息。
举例来说，第二网络设备可以是图1中的LS2。
在一种可能的设计中，第一网络设备400可以包括存储器430。存储器430与处理器410耦合。存储器430可以保存计算机程序。例如，存储器430中保存了用于识别DDoS攻击的计算机程序。处理器410通过执行所述计算机程序，对来自攻击者的多个报文的特征进行分析，从而确定所述多个报文属于DDoS攻击。所述多个报文的源MAC地址为MAC地址1。处理器410根据所述多个报文的源MAC地址确定MAC地址1所标识的主机(例如服务器1)是攻击者。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。
收发器420用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
举例来说，所述第一VTEP和所述第二VTEP之间存在VXLAN隧道。收发器420位于所述VXLAN隧道。例如，收发器420包含以太网接口，收发器420可以接收和发送遵循以太网协议的报文(例如以太网帧)。
在一种可能的设计中，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
在一种可能的设计中，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的MSB上。
在一种可能的设计中，所述BGP消息为BGP更新消息。
图5为本申请提供的一种第二网络设备500的结构示意图。第二网络设备500包括第一收发器510、第二收发器520以及处理器530。第一收发器510与处理器530耦合。第二收发器520与处理器530耦合。图5所示的第二网络设备500可以执行图3所示的方法。举例来说，第二网络设备500可以是图1中的LS2。关于第二网络设备500的具体实现方式，可以参考图3所示的实施例，也可以参考本申请对LS2的描述。
第一收发器510用于接收来自第一网络设备的BGP消息，所述BGP消息包括第一媒体访问控制MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者。
第二收发器520用于接收第一报文，所述第一报文的目的MAC地址等于所述第一MAC地址。
举例来说，第一收发器510可以包含以太网接口。第一收发器510可以接收和发送遵循以太网协议的报文(例如以太网帧)。第二收发器520可以包含以太网接口。第二收发器520可以接收和发送遵循以太网协议的报文(例如以太网帧)。
举例来说，第一收发器510可以位于LS1和LS2之间的VXLAN隧道上。第二收发器520可以用于连接LS2所管辖的网络。例如，第二收发器520可以用于连接服务器3以及服务器4。
处理器530用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识 的所述主机转发所述第一报文。
举例来说，处理器530可以是中央处理单元，也可以是ASIC或者FPGA。
在一种可能的设计中，第二网络设备500可以包括存储器540。存储器540与处理器530耦合。存储器540可以保存计算机程序。例如，存储器540中保存了用于实现BGP的功能的计算机程序。处理器530通过执行所述计算机程序，基于所述BGP消息以及第二网络设备500的配置信息，生成转发表项1。所述第一报文可以是报文1。所述LS2可以根据转发表项1对报文1进行丢弃处理，或者其他处理。关于转发表项1的生成过程，转发表项1的结构以及如何根据转发表项1对报文1进行处理，可以参考上文的相关描述，此处不再赘述。
在一种可能的设计中，第二收发器520还用于接收第二报文，所述第二报文的源MAC地址等于所述第一MAC地址。
处理器530还用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
举例来说，LS2可以根据路由消息2生成转发表项2。所述第二报文可以是报文2。所述LS2可以根据转发表项2对报文2进行丢弃处理。关于转发表项2的生成过程，转发表项2的结构以及如何根据转发表项2对报文2进行处理，可以参考上文的相关描述，此处不再赘述。
在一种可能的设计中，所述第一网络设备包括第一VTEP，所述第二网络设备包括第二VTEP。
第一收发器510用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
第一收发器510可以位于LS1和LS2之间的VXLAN隧道上。第一收发器510经由VXLAN隧道接收到来自第一VTEP(包含在第一网络设备中)的BGP消息后，可以向第二网络设备中的第二VTEP发送所述BGP消息。
在一种可能的设计中，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
在一种可能的设计中，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的MSB上。
图6为本申请提供的一种系统。参见图6，系统600包括第一网络设备601以及第二网络设备602。第一网络设备601可以是图4所示第一网络设备400。第二网络设备602可以是图5所示的第二网络设备500。例如，第一网络设备601可以执行图2所示的方法。第二网络设备602可以执行图3所示的方法。具体地，第一网络设备601可以是图1中的LS1。第二网络设备602可以是图1中的LS2。关于第一网络设备601的具体实现方式，可以参考图2所示的实施例，以及本申请对LS1的描述。关于第二网络设备602的具体实现方式，可以参考图3所示的实施例，以及本申请对LS2的描述。
本申请还提供了一种计算机可读存储介质。所述计算机可读存储介质存储计算机程序。当所述计算机程序被网络设备执行时，使得网络设备执行图2所示的方法，或 者图3所示的方法。举例来说，所述网络设备可以是图2所示的方法涉及的第一网络设备，或者图3所示的方法涉及的第二网络设备。
本申请还提供了一种计算机程序产品。所述计算机程序产品包含计算机程序。所述计算机程序可以保存在计算机可读存储介质上。当所述计算机程序被网络设备执行时，使得网络设备执行图2所示的方法，或者图3所示的方法。举例来说，所述网络设备可以是图2所示的方法涉及的第一网络设备，或者图3所示的方法涉及的第二网络设备。
本申请所描述的方法或者方法中的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成。软件模块可以被存放于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于用户设备中。当然，处理器和存储介质也可以作为分立组件存在于用户设备中。
本领域技术人员应该可以意识到，本申请所描述的功能可以用硬件或者固件实现。本申请所描述的功能也可以用软件和硬件的组合来实现。所示软件可以存储在计算机可读介质中。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的介质。存储介质可以是通用或专用计算机能够存取的介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明。所应理解的是，以上所述仅为本申请的具体实施方式而已。

Claims (20)

  1. 一种发送边界网关协议BGP消息的方法，其特征在于，包括：
    第一网络设备确定第一媒体访问控制MAC地址所标识的主机为攻击者；
    所述第一网络设备生成BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者；
    所述第一网络设备向第二网络设备发送所述BGP消息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网络设备包括第一虚拟扩展局域网隧道端点VTEP，所述第二网络设备包括第二VTEP；
    所述第一网络设备向第二网络设备发送所述BGP消息包括：
    所述第一VTEP向所述第二VTEP发送所述BGP消息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
  4. 根据权利要求3所述的方法，其特征在于，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的最高有效位MSB上。
  5. 根据权利要求1至4中任一所述的方法，其特征在于，所述BGP消息为BGP更新消息。
  6. 一种接收边界网关协议BGP消息的方法，其特征在于，包括：
    第二网络设备接收来自第一网络设备的BGP消息，所述BGP消息包括第一媒体访问控制MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者；
    所述第二网络设备接收第一报文，所述第一报文的目的MAC地址等于所述第一MAC地址；
    所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
  7. 根据权利要求6所述的方法，其特征在于，还包括：
    所述第二网络设备接收第二报文，所述第二报文的源MAC地址等于所述第一MAC地址；
    所述第二网络设备基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的 所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
  8. 根据权利要求6或7所述的方法，其特征在于，所述第一网络设备包括第一虚拟扩展局域网隧道端点VTEP，所述第二网络设备包括第二VTEP；
    所述第二网络设备接收来自第一网络设备的BGP消息包括：
    所述第二VTEP接收来自所述第一VTEP的所述路由信息。
  9. 根据权利要求6至8中任一所述的方法，其特征在于，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
  10. 根据权利要求9所述的方法，其特征在于，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的最高有效位MSB上。
  11. 一种第一网络设备，其特征在于，包括：处理器以及与所述处理器耦合的收发器；
    所述处理器用于确定第一媒体访问控制MAC地址所标识的主机为攻击者；
    所述处理器还用于生成边界网关协议BGP消息，所述BGP消息包括所述第一MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址标识的的所述主机是所述攻击者；
    所述收发器用于向第二网络设备发送所述处理器生成的所述BGP消息。
  12. 根据权利要求11所述的第一网络设备，其特征在于，所述第一网络设备包括第一虚拟扩展局域网隧道端点VTEP，所述第二网络设备包括第二VTEP；
    所述收发器用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
  13. 根据权利要求11或12所述的第一网络设备，其特征在于，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
  14. 根据权利要求13所述的第一网络设备，其特征在于，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的最高有效位MSB上。
  15. 根据权利要求11至14中任一所述的第一网络设备，其特征在于，所述BGP消息为BGP更新消息。
  16. 一种第二网络设备，其特征在于，包括：第一收发器、第二收发器以及与所述第一收发器和所述第二收发器耦合的处理器；
    所述第一收发器用于接收来自第一网络设备的边界网关协议BGP消息，所述BGP消息包括第一媒体访问控制MAC地址以及指示信息，所述指示信息用于指示所述第一MAC地址所标识的主机是攻击者；
    所述第二收发器用于接收第一报文，所述第一报文的目的MAC地址等于所述第一MAC地址；
    所述处理器用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第一报文中的所述目的MAC地址，避免向所述第一MAC地址标识的所述主机转发所述第一报文。
  17. 根据权利要求16所述的第二网络设备，其特征在于，所述第二收发器还用于接收第二报文，所述第二报文的源MAC地址等于所述第一MAC地址；
    所述处理器还用于基于所述BGP消息中的所述第一MAC地址、所述BGP消息中的所述指示信息以及所述第二报文中的所述源MAC地址，避免转发所述第二报文。
  18. 根据权利要求16或17所述的第二网络设备，其特征在于，所述第一网络设备包括第一虚拟扩展局域网隧道端点VTEP，所述第二网络设备包括第二VTEP；
    所述第一收发器用于向所述第二VTEP发送来自所述第一VTEP的所述BGP消息。
  19. 根据权利要求16至18中任一所述的第二网络设备，其特征在于，所述BGP消息包含媒体访问控制/网际协议通告路由MAC/IP Advertisement route以及媒体访问控制移动性扩展团体MAC Mobility Extended Community，所述第一MAC地址携带在所述MAC/IP Advertisement route中，所述指示信息携带在所述MAC Mobility Extended Community中。
  20. 根据权利要求19所述的第二网络设备，其特征在于，所述MAC Mobility Extended Community包括具有8个比特的旗帜，所述指示信息携带在所述旗帜的最高有效位MSB上。
PCT/CN2019/092443 2018-06-30 2019-06-23 发送bgp消息的方法、接收bgp消息的方法以及设备 Ceased WO2020001388A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CA3104559A CA3104559A1 (en) 2018-06-30 2019-06-23 Bgp message sending method, bgp message receiving method, and device
JP2020573178A JP7216120B2 (ja) 2018-06-30 2019-06-23 Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
EP19826741.1A EP3800842B9 (en) 2018-06-30 2019-06-23 Method for sending bgp message, method for receiving bgp message, and device
US17/138,205 US11973795B2 (en) 2018-06-30 2020-12-30 BGP message sending method, BGP message receiving method, and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810703112.1A CN110661714B (zh) 2018-06-30 2018-06-30 发送bgp消息的方法、接收bgp消息的方法以及设备
CN201810703112.1 2018-06-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/138,205 Continuation US11973795B2 (en) 2018-06-30 2020-12-30 BGP message sending method, BGP message receiving method, and device

Publications (1)

Publication Number Publication Date
WO2020001388A1 true WO2020001388A1 (zh) 2020-01-02

Family

ID=68986293

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/092443 Ceased WO2020001388A1 (zh) 2018-06-30 2019-06-23 发送bgp消息的方法、接收bgp消息的方法以及设备

Country Status (6)

Country Link
US (1) US11973795B2 (zh)
EP (1) EP3800842B9 (zh)
JP (1) JP7216120B2 (zh)
CN (1) CN110661714B (zh)
CA (1) CA3104559A1 (zh)
WO (1) WO2020001388A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11502874B2 (en) 2019-10-16 2022-11-15 Arista Networks, Inc. Filtering advertising of route advertisements based on virtual network identifiers
US11206155B2 (en) * 2019-10-16 2021-12-21 Arista Networks, Inc. Filtering advertising of route advertisements based on virtual network identifiers
CN113132220B (zh) * 2019-12-31 2022-12-06 华为技术有限公司 一种路由信息的处理方法及装置
CN113225194B (zh) * 2020-01-21 2022-09-09 华为技术有限公司 路由异常检测方法、装置及系统、计算机存储介质
CN113163276B (zh) * 2020-01-22 2025-02-25 华为技术有限公司 路由信息的发布方法、装置及系统
CN114338768A (zh) * 2020-09-25 2022-04-12 华为技术有限公司 一种建立会话的方法及网络设备
US20230327989A1 (en) * 2022-04-12 2023-10-12 Juniper Networks, Inc. Systems and methods for low convergence time for media access control move events
CN117640122A (zh) * 2022-08-19 2024-03-01 华为技术有限公司 一种通信方法及其相关设备
CN118827138B (zh) * 2024-05-29 2026-01-16 中国移动通信有限公司研究院 一种验证信息生成方法、装置、设备、存储介质及计算机程序产品

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101621428A (zh) * 2009-07-29 2010-01-06 成都市华为赛门铁克科技有限公司 一种僵尸网络检测方法及系统以及相关设备
US20160373447A1 (en) * 2013-07-05 2016-12-22 Nippon Telegraph And Telephone Corporation Unauthorized access detecting system and unauthorized access detecting method
CN107154939A (zh) * 2017-05-10 2017-09-12 深信服科技股份有限公司 一种数据追踪的方法及系统
CN108023974A (zh) * 2017-11-30 2018-05-11 新华三技术有限公司 一种地址老化方法和装置

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005130190A (ja) 2003-10-23 2005-05-19 Nippon Telegr & Teleph Corp <Ntt> 攻撃パケット防御システム
US8347383B2 (en) * 2007-09-28 2013-01-01 Nippon Telegraph And Telephone Corporation Network monitoring apparatus, network monitoring method, and network monitoring program
BR112012033693B8 (pt) 2010-06-29 2022-07-19 Huawei Tech Co Ltd Componente de rede para encaminhamento de quadro de dados
CN104283882B (zh) * 2014-10-11 2018-01-12 武汉烽火网络有限责任公司 一种路由器的智能安全防护方法
US9577943B1 (en) * 2015-03-12 2017-02-21 Juniper Networks, Inc. Tiered services in border gateway protocol flow specification
CN106161226B (zh) * 2015-03-23 2019-06-11 华为技术有限公司 发送、接收流规范规则的方法和装置
US9917794B2 (en) * 2015-08-11 2018-03-13 Luxar Tech, Inc Redirection IP packet through switch fabric
CN105763440B (zh) * 2016-01-29 2019-04-09 新华三技术有限公司 一种报文转发的方法和装置
US10404648B2 (en) 2016-02-26 2019-09-03 Nokia Of America Corporation Addressing for customer premises LAN expansion
CN107682275B (zh) 2016-08-01 2020-08-04 新华三技术有限公司 报文监控方法及装置
CN107770294B (zh) * 2016-08-18 2021-12-07 中兴通讯股份有限公司 Evpn中ip地址冲突的处理方法及装置
JP2018029303A (ja) 2016-08-19 2018-02-22 日本電信電話株式会社 通知システムおよび通知方法
US10855719B2 (en) * 2016-09-22 2020-12-01 Verisign, Inc. Automated DDOS attack mitigation via BGP messaging
CN108075969B (zh) 2016-11-17 2020-01-03 新华三技术有限公司 报文转发方法和装置
US10554554B2 (en) * 2016-12-06 2020-02-04 Microsoft Technology Licensing, Llc Hybrid network processing load distribution in computing systems
CN106878258A (zh) * 2016-12-14 2017-06-20 新华三技术有限公司 一种攻击定位方法及装置
CN108574614B (zh) * 2017-03-10 2020-11-17 华为技术有限公司 一种报文处理方法、设备及网络系统
WO2019028293A1 (en) * 2017-08-02 2019-02-07 CipherTooth, Inc. DETECTION OF INTERCEPTOR ATTACKS ON A LOCAL NETWORK
CN107743095A (zh) * 2017-11-30 2018-02-27 新华三技术有限公司 报文转发方法和装置
CN108199945B (zh) * 2017-12-23 2019-10-01 华为技术有限公司 报文传输方法、网络设备及报文处理系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101621428A (zh) * 2009-07-29 2010-01-06 成都市华为赛门铁克科技有限公司 一种僵尸网络检测方法及系统以及相关设备
US20160373447A1 (en) * 2013-07-05 2016-12-22 Nippon Telegraph And Telephone Corporation Unauthorized access detecting system and unauthorized access detecting method
CN107154939A (zh) * 2017-05-10 2017-09-12 深信服科技股份有限公司 一种数据追踪的方法及系统
CN108023974A (zh) * 2017-11-30 2018-05-11 新华三技术有限公司 一种地址老化方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3800842A4

Also Published As

Publication number Publication date
EP3800842B1 (en) 2025-08-06
US20210152593A1 (en) 2021-05-20
JP7216120B2 (ja) 2023-01-31
EP3800842A4 (en) 2021-08-04
CN110661714B (zh) 2022-06-28
JP2021530158A (ja) 2021-11-04
US11973795B2 (en) 2024-04-30
EP3800842A1 (en) 2021-04-07
CA3104559A1 (en) 2020-01-02
CN110661714A (zh) 2020-01-07
EP3800842B9 (en) 2025-10-15

Similar Documents

Publication Publication Date Title
JP7216120B2 (ja) Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
US12160362B2 (en) Traceroute for multi-path routing
US11411774B2 (en) Virtual private network VPN service optimization method and device
US8750288B2 (en) Physical path determination for virtual network packet flows
CN112910792B (zh) 报文处理的方法、装置及相关设备
CN105453492B (zh) 具有第三层分布式路由器功能的交换机集群
US12081367B2 (en) Generating route target values for virtual private network routes
US10148560B2 (en) Enhanced error signaling and error handling in a network environment with segment routing
WO2019024880A1 (zh) 发送报文的方法和网络设备
CN103595648A (zh) 用于在服务器的接收侧进行负载均衡的方法和系统
US11799688B2 (en) Method for managing virtual private network, and device
US12542739B2 (en) Generating route distinguishers for virtual private network addresses based on physical hardware addresses
CN111865806B (zh) 基于前缀的胖流
US20230077101A1 (en) Network Node-to-Node Connectivity Verification including Data Path Processing of Packets within a Packet Switching Device
CN105471817A (zh) 业务流的卸载方法、装置和系统
US12574316B2 (en) Route distinguishers for same destination path diversity
Kawashima et al. Accelerating the Performance of Software Tunneling Using a Receive Offload-Aware Novel L4 Protocol
CN120980004A (zh) 报文处理方法、装置、存储介质及程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19826741

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3104559

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2020573178

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019826741

Country of ref document: EP

Effective date: 20201230

WWG Wipo information: grant in national office

Ref document number: 2019826741

Country of ref document: EP