CN101170515B - A method, system and gateway device for processing packets - Google Patents
A method, system and gateway device for processing packets Download PDFInfo
- Publication number
- CN101170515B CN101170515B CN2007101952238A CN200710195223A CN101170515B CN 101170515 B CN101170515 B CN 101170515B CN 2007101952238 A CN2007101952238 A CN 2007101952238A CN 200710195223 A CN200710195223 A CN 200710195223A CN 101170515 B CN101170515 B CN 101170515B
- Authority
- CN
- China
- Prior art keywords
- mac address
- user equipment
- message
- gateway device
- request message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 26
- 230000004044 response Effects 0.000 claims description 49
- 230000005540 biological transmission Effects 0.000 description 8
- 238000003672 processing method Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 230000032683 aging Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 206010033799 Paralysis Diseases 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000009931 harmful effect Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 238000004321 preservation Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Landscapes
- Small-Scale Networks (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明提供了一种处理报文的方法、系统和设备，其中，方法包括：接收到用户设备发送的媒体访问控制(MAC)地址请求报文后，查询是否存在与MAC地址请求报文中携带的该用户的MAC地址和IP地址一致的ARP表项，如果否，则屏蔽该用户设备发送的报文。也就是在判断了发送MAC地址请求报文的用户设备为非授权用户后，可以利用该方法屏蔽该用户设备在一定时间内再向网关设备发送MAC地址请求报文，避免了网关设备重复执行报文处理过程，提高网关设备的处理效率，也可以防止非授权用户的恶意攻击。
The present invention provides a method, system and device for processing messages, wherein the method includes: after receiving a Media Access Control (MAC) address request message sent by a user equipment, querying whether there is a MAC address request message carried in the MAC address request message The MAC address of the user is consistent with the ARP entry of the IP address, if not, the packet sent by the user equipment is blocked. That is to say, after judging that the user equipment sending the MAC address request message is an unauthorized user, this method can be used to shield the user equipment from sending the MAC address request message to the gateway device within a certain period of time, so as to avoid the gateway device repeatedly executing the message. It improves the processing efficiency of the gateway device and prevents malicious attacks from unauthorized users.
Description
Technical field
The present invention relates to the network communications technology, particularly a kind of processing method of message, system and gateway device.
Background technology
Address resolution protocol (ARP, Address Resolution Protocol) be to realize the media interviews control (MAC of IP address to Ethernet, Media Access Control) agreement of changing between the address, because communication between the Ethernet is to use MAC Address to come addressing, come addressing and be based on the IP address, finally all need to be encapsulated in the ethernet frame based on the MAC Address addressing based on the various packets of IP addressing of address and transmit based on the various application of TCP/IP.
DHCP (DHCP, Dynamic Host Configuration Protocol) is the agreement of a kind of dynamic-configuration IP address.When solving unauthorized user accesses network problem, usually ARP is used in combination with DHCP, Dynamic Host Configuration Protocol server mandate ARP function is specially: the ARP list item of preserving user equipment (UE) IP address and subscriber equipment MAC Address corresponding relation in the gateway device, this ARP list item is no longer by the gateway device dynamic learning, and be that the IP address of subscriber equipment dynamic assignment generates by Dynamic Host Configuration Protocol server, and, to be called authorized user through Dynamic Host Configuration Protocol server dynamic assignment IP address user equipment, to not be called unauthorized user through Dynamic Host Configuration Protocol server dynamic assignment IP address user equipment, for example, own configuring static IP address user equipment is exactly unauthorized user.
In the prior art, if gateway device has been enabled Dynamic Host Configuration Protocol server mandate ARP function, be that ARP list item that gateway device is preserved is that IP address according to the Dynamic Host Configuration Protocol server dynamic assignment generates, then the message processing procedure of gateway device is: subscriber equipment is in order to obtain the MAC Address of gateway device, send the MAC Address request message to gateway device, this MAC Address request message can be the ARP request message, it also can be network control message protocol (ICMP, Internet Control Message Protocol) heartbeat (Ping) message.Gateway device is after receiving the MAC Address request message of subscriber equipment, can be according to the user device IP address and the MAC Address of carrying in this MAC Address request message, inquire about in the ARP list item of self storing whether the ARP list item identical with MAC Address with this user device IP address is arranged, if, confirm that then this subscriber equipment is an authorized user, send correct response message to this subscriber equipment; If not, then abandon this MAC Address request message.
But, because after definite this subscriber equipment is unauthorized user, gateway device abandons the MAC Address request message of this subscriber equipment, this unauthorized user does not obtain response message then may continue to send the MAC Address request message, this will inevitably make gateway device repeat above-mentioned message processing procedure, has a strong impact on the treatment effeciency of gateway device.In case unauthorized user malicious attack continues to send a large amount of MAC Address request messages, then may cause the paralysis of gateway device.
Summary of the invention
The embodiment of the invention provides a kind of processing method of message, system and equipment, so that improve the treatment effeciency of gateway device, prevents malicious attack.
A kind of processing method of message, this method comprises:
After receiving the media interviews control MAC Address request message of subscriber equipment transmission, inquiry whether exist with described MAC Address request message in the consistent ARP list item of MAC Address and IP address of this subscriber equipment of carrying, if not, then send the errored response message of shielding subscriber equipment message to described subscriber equipment, described errored response message has wrong source MAC.
A kind of system that handles message, this system comprises: gateway device and subscriber equipment;
Described gateway device, after being used to receive the MAC Address request message of described subscriber equipment transmission, inquiry whether exist with described MAC Address request message in the consistent ARP list item of MAC Address and IP address of the described subscriber equipment that carries, if not, then send the errored response message of shielding subscriber equipment message to described subscriber equipment, described errored response message has wrong source MAC;
Described subscriber equipment is used for sending the MAC Address request message to described gateway device, receives the described errored response message that described gateway device sends.
A kind of gateway device, this gateway device comprises: receiving element, query unit and message screen unit;
Described receiving element is used to receive the MAC Address request message that subscriber equipment sends;
Described query unit is used for inquiring about the consistent ARP list item of MAC Address and IP address that whether has this subscriber equipment that carries with described MAC Address request message, if not, then sends the errored response exercise notice;
Described message screen unit, receive described errored response exercise notice after, send the errored response message of shielding subscriber equipment message to described subscriber equipment, described errored response message has wrong source MAC.
As can be seen from the above technical solutions, in the method that the embodiment of the invention provides, system and the equipment, after receiving the MAC Address request message of subscriber equipment transmission, inquiry whether exist with the MAC Address request message in this user's of carrying the consistent ARP list item of MAC Address and IP address, if not, then shield this subscriber equipment and send message.Just after having judged that the subscriber equipment that sends the MAC Address request message is unauthorized user, can shield this subscriber equipment by this method and send the MAC Address request message to gateway device more within a certain period of time, avoided gateway device to repeat the message processing procedure, improve the treatment effeciency of gateway device, also can prevent the malicious attack of unauthorized user.
Description of drawings
The method flow diagram that Fig. 1 provides for the embodiment of the invention;
The system flow chart that Fig. 2 provides for the embodiment of the invention.
Embodiment
In order to make the purpose, technical solutions and advantages of the present invention clearer, describe the present invention below in conjunction with the drawings and specific embodiments.
The method that the embodiment of the invention provides mainly comprises: after receiving the MAC Address request message of subscriber equipment transmission, inquiry whether exist with the MAC Address request message in the consistent ARP list item of MAC Address and IP address of this subscriber equipment of carrying, if not, then shield this messages sent by user equipment.
Wherein, the MAC Address request message can be the ARP request message, also can be ICMP Ping message.In following examples, be that example is described all with the ARP request message.
The method flow diagram that Fig. 1 provides for the embodiment of the invention, in this embodiment, gateway device has been enabled DHCP and has been authorized the ARP function, and the ARP list item of preservation is to be that the IP address of subscriber equipment dynamic assignment generates by Dynamic Host Configuration Protocol server.The content of ARP list item is the corresponding relation between user device IP address and the MAC Address.As shown in Figure 1, this method mainly comprises:
Step 101: gateway device obtains the user device IP address and the MAC Address of carrying in this ARP request message after receiving the ARP request message of subscriber equipment transmission.
Source IP address that carries in the ARP request message that subscriber equipment sends and source MAC are user device IP address and the MAC Address that sends this message.
Step 102: gateway device searches whether there be the ARP list item consistent with user device IP address and MAC Address in the ARP list item, if exist, then execution in step 103; If there is no, execution in step 104 then.
Step 103: send correct arp response message to subscriber equipment, and upgrade other relevant information of this ARP list item, process ends.
In this step, the existence ARP list item consistent with user device IP address and MAC Address in the ARP list item illustrates that then this subscriber equipment is an authorized user, and gateway device sends correct arp response message to subscriber equipment according to flow process of the prior art.
Wherein, if do not have this user's IP address or MAC Address in the ARP list item, perhaps, the source IP address and the source MAC that carry in IP address in the list item and MAC Address and the ARP request message are inconsistent, then be the ARP list item that does not exist user device IP address consistent with MAC Address in the ARP list item, promptly this subscriber equipment is a unauthorized user.
Other relevant information of this ARP list item that upgrades in this step can be ageing time, interface message of this ARP list item etc.
Step 104: gateway device sends the errored response message that target MAC (Media Access Control) address and source MAC are the MAC Address of this subscriber equipment, process ends to subscriber equipment.
In this step, there be not the ARP list item consistent in the ARP list item with user device IP address and MAC Address, illustrate that this subscriber equipment is a unauthorized user, at this moment, gateway device sends the errored response message of this subscriber equipment message of shielding to subscriber equipment, can adopt among this embodiment the MAC Address of this subscriber equipment mode, also can adopt the MAC Address that produces a mistake at random source MAC as the errored response message as the target MAC (Media Access Control) address and the source MAC of this errored response message.
After subscriber equipment receives this errored response message, subscriber equipment can generate the ARP list item of a mistake in this locality, the IP address of this ARP list item is the IP address of gateway device, but the MAC Address of this list item is the MAC Address of the MAC Address of subscriber equipment self or a mistake producing at random, and promptly this MAC Address is the MAC Address of a mistake.Like this, because subscriber equipment when sending message, need send message according to the content in the ARP list item of this locality, therefore, this subscriber equipment can't send message again to this gateway device in the ageing time of this ARP list item.
If mainly ask gateway device for the unauthorized user that prevents malicious attack frequently sends ARP, can preestablish a frequency threshold value, after the subscriber equipment that each judgement sends the ARP request message is unauthorized user, write down the number of times that this subscriber equipment sends the ARP request message, if the number of times of record reaches the frequency threshold value of setting, then send the errored response message to this subscriber equipment, if do not reach the frequency threshold value of setting, then can not send any response message to this subscriber equipment.Simultaneously, can set a timer, when timer then, with the record the number of times zero clearing.Can be used to prevent from frequently to send at short notice the influence that the ARP request message causes gateway device like this.
The system construction drawing that Fig. 2 provides for the embodiment of the invention, as shown in Figure 2, this system comprises: gateway device 200 and subscriber equipment 210.
Wherein, gateway device 200 can comprise: receiving element 201, query unit 202 and message screen unit 203.
Receiving element 201 is used to receive the MAC Address request message that subscriber equipment 210 sends.
Wherein, message screen unit 203 can comprise: errored response generation unit 204 and packet sending unit 205.
Errored response generation unit 204 is used to generate the errored response message that target MAC (Media Access Control) address and source MAC are the MAC Address of subscriber equipment 210.
Further, gateway device 200 can also comprise: number of times record cell 206 and number of times judging unit 207.
Number of times record cell 206, be used to receive the errored response exercise notice after, the number of times of the MAC Address request message that recording user equipment 210 sends.
Number of times judging unit 207 is used to judge whether the number of times of number of times record cell 206 records reaches default frequency threshold value, if then send the errored response exercise notice to message screen unit 203.
Further, this gateway device 200 can also comprise: timer 2 08, be used to set the time that shields subscriber equipment 210, and when arriving setting-up time, send the zero clearings notice to number of times record cell 206.
Number of times record cell 206, be used to receive zero clearing notice after, the number of times zero clearing of the MAC Address request message that the subscriber equipment 210 of record is sent.
By above description as can be seen, in the method that the embodiment of the invention provides, system and the equipment, after receiving the MAC Address request message of subscriber equipment transmission, inquiry whether exist with the MAC Address request message in this user's of carrying the consistent ARP list item of MAC Address and IP address, if not, then shield this messages sent by user equipment.Just after having judged that the subscriber equipment that sends the MAC Address request message is unauthorized user, can utilize this method to shield this subscriber equipment and send the MAC Address request message to gateway device more within a certain period of time, avoided gateway device to repeat the message processing procedure, improve the treatment effeciency of gateway device, also can prevent the malicious attack of unauthorized user.
In addition, a kind of mode by setting regularly the time limit and transmission MAC Address request number of times being write down also is provided in the embodiment of the invention, when the record number of times of setting MAC Address request message in the time limit reaches setting threshold, send the errored response message of this subscriber equipment message of shielding to subscriber equipment, thereby prevent from frequently to send at short notice the harmful effect that the MAC Address request message causes gateway device.
The above only is preferred embodiment of the present invention, and is in order to restriction the present invention, within the spirit and principles in the present invention not all, any modification of being made, is equal to replacement, improvement etc., all should be included within the scope of protection of the invention.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2007101952238A CN101170515B (en) | 2007-12-04 | 2007-12-04 | A method, system and gateway device for processing packets |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2007101952238A CN101170515B (en) | 2007-12-04 | 2007-12-04 | A method, system and gateway device for processing packets |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101170515A CN101170515A (en) | 2008-04-30 |
| CN101170515B true CN101170515B (en) | 2010-10-13 |
Family
ID=39390988
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2007101952238A Expired - Fee Related CN101170515B (en) | 2007-12-04 | 2007-12-04 | A method, system and gateway device for processing packets |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101170515B (en) |
Families Citing this family (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101415012B (en) * | 2008-11-06 | 2011-09-28 | 杭州华三通信技术有限公司 | Method and system for defending address analysis protocol message aggression |
| CN101527913B (en) * | 2009-04-01 | 2011-08-10 | 中兴通讯股份有限公司 | Method for realizing that wireless application protocol gateway is used for resisting malicious attacks and system |
| CN101997768B (en) * | 2009-08-21 | 2012-10-17 | 华为技术有限公司 | Method and device for uploading address resolution protocol messages |
| CN101938533B (en) * | 2010-09-10 | 2015-04-01 | 中兴通讯股份有限公司 | Method and device for processing address resolution |
| CN101980496A (en) * | 2010-10-13 | 2011-02-23 | 华为数字技术有限公司 | Message processing method and system, exchange board and access server equipment |
| CN102857584B (en) * | 2011-06-28 | 2019-05-31 | 中兴通讯股份有限公司 | A kind of arp cache entry update method and equipment |
| CN102694876A (en) * | 2012-05-10 | 2012-09-26 | 北京星网锐捷网络技术有限公司 | Method and device for determining effectiveness of learned MAC (Media Access Control) address and gateway equipment |
| CN104219338B (en) * | 2014-09-15 | 2017-12-15 | 新华三技术有限公司 | The generation method and device of the safe list item of authorized address analysis protocol |
| CN108259294B (en) * | 2017-02-28 | 2021-01-26 | 新华三技术有限公司 | Message processing method and device |
| CN108512714B (en) * | 2017-02-28 | 2021-10-01 | 华为技术有限公司 | A message transmission method, related equipment and system |
| CN107819776B (en) * | 2017-11-17 | 2021-01-15 | 锐捷网络股份有限公司 | Message processing method and device |
| CN112954027B (en) * | 2021-01-29 | 2022-11-25 | 杭州迪普科技股份有限公司 | Network service characteristic determination method and device |
| CN114980113B (en) * | 2022-06-17 | 2024-11-22 | 西安紫光展锐科技有限公司 | How to prevent ARP attacks on the terminal side |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1466341A (en) * | 2002-06-22 | 2004-01-07 | ��Ϊ��������˾ | A Method of Preventing IP Address Spoofing in Dynamic Address Assignment |
| US20050050365A1 (en) * | 2003-08-28 | 2005-03-03 | Nec Corporation | Network unauthorized access preventing system and network unauthorized access preventing apparatus |
| CN1627715A (en) * | 2003-12-08 | 2005-06-15 | 华为技术有限公司 | Access gate wireless local area network and implementation for guaranteeing network safety |
| CN1874223A (en) * | 2006-06-27 | 2006-12-06 | 天津移动通信有限责任公司 | Access control system and method for implementing binding MAC/IP of network device |
-
2007
- 2007-12-04 CN CN2007101952238A patent/CN101170515B/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1466341A (en) * | 2002-06-22 | 2004-01-07 | ��Ϊ��������˾ | A Method of Preventing IP Address Spoofing in Dynamic Address Assignment |
| US20050050365A1 (en) * | 2003-08-28 | 2005-03-03 | Nec Corporation | Network unauthorized access preventing system and network unauthorized access preventing apparatus |
| CN1627715A (en) * | 2003-12-08 | 2005-06-15 | 华为技术有限公司 | Access gate wireless local area network and implementation for guaranteeing network safety |
| CN1874223A (en) * | 2006-06-27 | 2006-12-06 | 天津移动通信有限责任公司 | Access control system and method for implementing binding MAC/IP of network device |
Non-Patent Citations (1)
| Title |
|---|
| CN 1466341 A,权利要求1. |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101170515A (en) | 2008-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101170515B (en) | A method, system and gateway device for processing packets | |
| US10375110B2 (en) | Luring attackers towards deception servers | |
| Wing et al. | Port control protocol (PCP) | |
| EP2469787B1 (en) | Method and device for preventing network attacks | |
| CN102165741A (en) | Method for intercepting and searching host in IPV6 network | |
| WO2011140795A1 (en) | Method and switching device for preventing media access control address spoofing attack | |
| CN101115063B (en) | Method for prevent MAC address/IP address spuriousness of broadband access equipment | |
| EP2724508B1 (en) | Preventing neighbor-discovery based denial of service attacks | |
| Ullrich et al. | {IPv6} security: Attacks and countermeasures in a nutshell | |
| US20110202670A1 (en) | Method, device and system for identifying ip session | |
| WO2012075850A1 (en) | Method and system for preventing mac address cheat, and switch | |
| CN106878326A (en) | IPv6 Neighbor Cache Protection Method and Device Based on Reverse Detection | |
| JPWO2015174100A1 (en) | Packet transfer device, packet transfer system, and packet transfer method | |
| CN103026685B (en) | Nications control device and communications system | |
| CN101494536B (en) | Method, apparatus and system for preventing ARP aggression | |
| CN107508840A (en) | A kind of method that monitoring DNS domain name based on DNS Proxy is attacked | |
| WO2018090865A1 (en) | Method and apparatus for registering network device | |
| CN107786496B (en) | Early warning method and device for ARP (Address resolution protocol) table entry spoofing attack of local area network | |
| Cisco | Command Reference | |
| CN110392129B (en) | IPv6 client and method for IPv6 client to communicate with server | |
| CN111614791B (en) | Access device for entity link analysis and method thereof | |
| Cisco | Command Reference | |
| KR101188308B1 (en) | Pseudo packet monitoring system for address resolution protocol spoofing monitoring of malicious code and pseudo packet monitoring method therefor | |
| RU2686023C1 (en) | Method of protecting computer networks | |
| Salim et al. | A precise model to secure systems on Ethernet against man-in-the-middle attack |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20101013 |