CN103888481A - Method and system for filtering DHCP data package of local area network - Google Patents

Abstract

The invention discloses a method for filtering a DHCP data package of a local area network. According to the method, a middle layer between a network card drive and a protocol drive filters network data packages, sent to a DHCP client, in the local area network, and filtering comprises the four steps of network data package collecting, network data package screening, DHCP data package analyzing and network data package processing. The DHCP data package is gradually separated from the network data packages sent to the DHCP client, and is analyzed, a legal data package sent by a designated DHCP server is received, a data package sent by an illegal DHCP server is discarded, and therefore the aim that the DHCP client obtains the IP address from the designated DHCP server is achieved, the illegal DHCP server is prevented from distributing the IP address to the DHCP client, and meanwhile, the invention further discloses a system for filtering the DHCP data package of the local area network.

Description

A kind of local area network (LAN) DHCP packet filtering method and system

Technical field

The present invention relates to Computer Applied Technology and technical field of the computer network, be specifically related to DHCP packet filtering method and system in a kind of local area network (LAN).

Background technology

DHCP agreement is the abbreviation of DHCP (Dynamic Host Configuration Protocol), it is a kind of local net network agreement, can manage concentratedly and automatically distribute by this protocol network keeper, reclaim the IP address of DHCP client computer in local area network (LAN), greatly, in, in Small-scale LAN, be widely used, especially large, in lan medium, such as College campus network, Large enterprise network, number of clients in these networks is numerous, may be every client computer distribution network IP (Internet Protocol hardly by hand, Internet protocol) address, so be the scheme that client computer dynamic IP address allocation in network becomes a kind of the best by DHCP agreement.

But, these are large, the network manager of lan medium generally can only grasp Dynamic Host Configuration Protocol server quantity legal in network, the Dynamic Host Configuration Protocol server that some are illegal, such as student in the bedroom, the Dynamic Host Configuration Protocol server that set up privately in laboratory etc., the quantity of the Dynamic Host Configuration Protocol server that enterprise staff sets up privately in office etc. is difficult for grasping, therefore generally these are large, in lan medium, often exist many legal and illegal Dynamic Host Configuration Protocol server, and DHCP agreement has DHCP client computer that a shortcoming is exactly each access to LAN to find Dynamic Host Configuration Protocol server to sending DHCP discover packet in local area network (LAN) by the mode of broadcast, the Dynamic Host Configuration Protocol server that receives packet all can be made response, in the IP address of not yet hiring out, select a DHCP client computer of distributing to request in own address pool, and pass through DHCP offer Packet Generation to DHCP client computer, if now DHCP client computer is received the response message of many Dynamic Host Configuration Protocol server, DHCP client computer only can receive first dhcp server response information of receiving so, then in local area network (LAN), send DHCP request broadcast data packet, tell all Dynamic Host Configuration Protocol server in local area network (LAN) it accepted the IP address which platform Dynamic Host Configuration Protocol server provides, other Dynamic Host Configuration Protocol server that now receives DHCP request packet just can be regained the IP address just now distributed, so just, produced a problem, if the IP address that DHCP client computer receives is not exactly the IP address that its Dynamic Host Configuration Protocol server of wanting distributes, will cause a lot of problems, such as DHCP client computer cannot be accessed the Internet, or DHCP client computer cannot be accessed some Intranet resource, or DHCP client computer has accessed a unsafe internal network and has caused DHCP client computer by unauthorized access, network data is coated with illicit interception, the generation of the situations such as analysis.

So how for accessing the DHCP client computer of these large and medium-sized local area network (LAN)s, specify its required legal Dynamic Host Configuration Protocol server for its distribution network IP address, network ip address that to filter illegal DHCP server be its distribution, the reality that is that in these networks, network manager faces and stubborn problem.And in fact, we can be by driving the intermediate layer between protocol-driven at network interface card, gather by the mode of writing intermediate layer driving the packet that sends to DHCP client computer in all local area network (LAN)s, and the DHCP packet of choosing is wherein analyzed, thereby receive the packet of specifying Dynamic Host Configuration Protocol server to send, abandon the packet that other illegal DHCP server sends.

Summary of the invention

The invention provides a kind of local area network (LAN) DHCP packet filtering method, this method is by network packet collection in local area network, network packet screening, DHCP data packet analysis, network packet is processed four steps, realizing the DHCP packet that sends to DHCP client computer in local area network analyzes, judges and selection, receive the packet of specifying Dynamic Host Configuration Protocol server to send to realize DHCP client computer in local area network (LAN), abandon the packet that other illegal DHCP server sends, the present invention simultaneously also provides a kind of local area network (LAN) DHCP packet filtering system.

The present invention is achieved by the following technical solutions:

The invention provides a kind of local area network (LAN) DHCP packet filtering method, comprise following step:

(1) network packet gatherer process sends to all packets of the machine, and each packet is carried out to collection one by one in the driving of DHCP client computer network interface card and the intermediate layer between protocol-driven are intercepted and intercepted and captured local area network (LAN).First, in internal memory, distribute a core buffer that is more than or equal to maximum data packet length in local area network (LAN) to deposit intercepted and captured packet, then by described core buffer content zero clearing, finally intercepted and captured packet content piecemeal is copied in described core buffer.

(2) network packet screening process, first take out described core buffer the 13rd and the value of the 14th byte, if the value of the 13rd byte equals 8, and the value of the 14th byte equals 0, so described packet is IP packet, then take out the value of described core buffer the 24th byte, if the value of the 24th byte equals 17, illustrate that described IP packet is UDP (User Datagram Protocol, User Datagram Protoco (UDP)) packet, now need to calculate the length of described IP packet, the computational methods of IP data packet length are produced by following two formula:

a) $L_{\mathrm{ip}}=\underset{k=1}{\overset{4}{\mathrm{\Σ}}}{2}^{k+1}\left(x_k\mathrm{mod}2\right)$

b)x _k+1＝(x _k-(x _kmod2))/2 k＝(1，2，3)

In described formula a) with formula b) in mod representative get the remainder that two numbers are divided by, wherein formula a) in, L _ipthe length of the IP packet described in representative, k represents variable, and span is four positive integers between 1 to 4, and ∑ representative is carried out sum operation to the multinomial after it, and summation item number is the span of variable k, x _kin in the time that k equals 1, i.e. x ₁the value of core buffer the 15th byte described in representative, x _kin in the time that k equals 2, i.e. x ₂value, by x ₁value substitution formula draw in b), by that analogy, x ₃with x ₄value respectively by x ₂with x ₃value substitution formula draw in b), formula b) in the span of variable k be three positive integers between 1 to 3.

Finally continue to judge that described core buffer side-play amount is 15+L _ip, 16+L _ip, 17+L _ip, 18+L _ipthe value of byte, if described core buffer side-play amount is 15+L _ipthe value of byte equals 0, and described core buffer side-play amount is 16+L _ipthe value of byte equals 67, and described core buffer side-play amount is 17+L _ipthe value of byte equals 0, and described core buffer side-play amount is 18+L _ipthe value of byte equals 68, illustrates that described UDP message bag is DHCP packet, need to carry out next step analysis, and it is medium pending that other packet will directly be submitted to step (4).

(3) DHCP data packet analysis: if described packet is DHCP packet, so first the core buffer the 27th described in judgement, the value of 28,29,30 bytes, the value of checking these four bytes whether respectively with the dhcp server ip address that will receive in four groups of numeral correspondent equals separating of ". " type separator, if correspondent equal one by one, described DHCP packet sends for legal Dynamic Host Configuration Protocol server, otherwise for illegal DHCP server sends, finally described DHCP packet is submitted to step (4) medium pending.

(4) network packet processing: according to the Analysis and judgments of in step (2) and step (3), described packet being made, reception sends to the legal DHCP packet of DHCP client computer and the packet of other type, remaining illegal DHCP packet is dropped immediately, do not received by DHCP client computer, finally discharge described core buffer.

Meanwhile, the present invention also provides a kind of local area network (LAN) DHCP packet filtering system.This system comprises driver sub-system and application subsystem two parts.Described driver sub-system comprises network packet acquisition module, network packet screening module, DHCP data packet analysis module, network data packet handing module, Communication processing module; Described application subsystem comprises bottom communication module, Dynamic Host Configuration Protocol server administration module, Dynamic Host Configuration Protocol server binding management module, IP address update module, system interface module.

Described network packet acquisition module, sends to all packets of the machine, and packet is carried out to acquisition and processing one by one for intercepting and intercept and capture local area network (LAN).

Described network packet screening module, for the packet collecting is carried out to category filter, isolates DHCP packet wherein, and the packet of other type is submitted to network data packet handing module wait processing.

Described DHCP data packet analysis module, for the DHCP packet filtering out is carried out to Analysis and judgments, find out wherein legal Dynamic Host Configuration Protocol server and send to the packet of the machine, and be submitted to network data packet handing module wait processing by analyzing complete DHCP packet.

Described network data packet handing module, for processing analyzing complete packet, receive legal Dynamic Host Configuration Protocol server and send to the packet of the machine and send to the packet of other type of the machine, abandon illegal DHCP server and send to the packet of the machine.

Described Communication processing module, sends to the information in intermediate layer, and the feedback information in intermediate layer is sent to upper level applications for receiving upper level applications.

Described bottom communication module, drives transmission information to intermediate layer for upper level applications, or upper level applications drives and obtain required information from intermediate layer, and can show in real time the DHCP packet information having abandoned.

Described Dynamic Host Configuration Protocol server administration module, for managing legal Dynamic Host Configuration Protocol server list, comprises and inserts Dynamic Host Configuration Protocol server record, deletes Dynamic Host Configuration Protocol server record, empties Dynamic Host Configuration Protocol server list, preserves four functions of Dynamic Host Configuration Protocol server list.

Described Dynamic Host Configuration Protocol server binding management module, be used for binding the legal Dynamic Host Configuration Protocol server of current appointment, and the excessively described bottom communication module of Dynamic Host Configuration Protocol server information exchange is sent to intermediate layer driving, as the rule of DHCP Packet Filtering, also can unbind Dynamic Host Configuration Protocol server, allow DHCP client computer to receive all DHCP packets in local area network (LAN).

Described IP address update module, is used for, when changing after the legal Dynamic Host Configuration Protocol server of complete appointment, emptying the IP address of current DHCP client computer, and upgrades the IP address that the IP address of current DHCP client computer is distributed to new Dynamic Host Configuration Protocol server.

Described system interface module, is used for generating the demonstration of each assembly in the operation interface, interface of upper level applications, and input and the output of data in each assembly.

Compare with more existing technology, the invention has the advantages that, the functional module that DHCP Packet Filtering is relevant is all operated in network interface card in the mode driving and drives the intermediate layer between protocol-driven, rather than the application layer of system, the application program of moving in system applies layer only plays the effect of driven management, do not participate in DHCP Packet Filtering directly, so can gather one by one, analyze all packets that send to DHCP client computer, like this DHCP packet is screened, filter accurately, do not omit, and execution efficiency is high, can effectively ensure and filter out the illegal DHCP packet that sends to the machine, and catch in time, reception sends to the legal DHCP packet of the machine.

Accompanying drawing explanation

Fig. 1 is a kind of local area network (LAN) DHCP packet filtering method schematic diagram provided by the present invention;

Fig. 2 is the functional block diagram of a kind of local area network (LAN) DHCP packet filtering system provided by the present invention;

Fig. 3 is that a kind of local area network (LAN) DHCP packet filtering system network packet provided by the present invention is filtered workflow diagram.

Embodiment

As shown in Figure 1, a kind of local area network (LAN) DHCP packet filtering method of the present invention, its main thought is all packets that send to the machine in the driving of DHCP client computer network interface card and the intermediate layer between protocol-driven are intercepted and tackled local area network (LAN), filter out DHCP packet wherein, and check that DHCP packet is that legal Dynamic Host Configuration Protocol server sends, if not abandoning this packet, other packet is normally let pass, received by DHCP client computer, concrete grammar comprises the following steps:

(1) network packet collection: send to all packets of the machine in the driving of DHCP client computer network interface card and the intermediate layer between protocol-driven are intercepted and intercepted and captured local area network (LAN), and each packet is carried out to collection one by one.First, in internal memory, distribute the region of memory of a fixed byte size to deposit intercepted and captured packet as buffering area, the size in this region can be more than or equal to the length of maximum data packet in local area network (LAN), such as 2048 bytes, and define pointer pPacketBuffer and point to described core buffer, then by core buffer content zero clearing pointed pPacketBuffer, finally intercepted and captured packet content piecemeal is copied in pPacketBuffer core buffer pointed, wait for that next step screens intercepted and captured packet.

(2) network packet screening: the content that first judges Ethernet data packet header, it is stored in front 14 bytes of pPacketBuffer core buffer pointed, take out the value of the 13rd byte and the 14th byte, be pPacketBuffer[12] and pPacketBuffer[13] value, the value of these two bytes represents the type of Ethernet data bag upper-layer protocol, if the content of the 13rd byte equals 8, and the content of the 14th byte equals 0, so described Ethernet data bag is IP packet, because DHCP packet encapsulates on UDP message package base, and UDP message bag encapsulates on IP packet basis, so we are for further analysis with the IP packet filtering out.

Then take out the value of pPacketBuffer core buffer pointed the 24th byte, be pPacketBuffer[23] value, it represents the upper-layer protocol type of described IP packet, if the value of the 24th byte equals 17, illustrate that described IP packet is UDP message bag, because the total length of IP packet is unfixing, in order further to analyze described IP packet, therefore need to calculate the length of described IP packet, again because the header length of IP packet and the total length of IP packet meet certain relation, so the computational methods of IP data packet length can be produced by following two formula:

a) $L_{\mathrm{ip}}=\underset{k=1}{\overset{4}{\mathrm{\Σ}}}{2}^{k+1}\left(x_k\mathrm{mod}2\right)$

b)x _k+1＝(x _k-(x _k mod2))/2 k＝(1，2，3)

In described formula a) with formula b) in mod representative get the remainder that two numbers are divided by, wherein formula a) in, L _ipthe length of the IP packet described in representative, k represents variable, and span is four positive integers between 1 to 4, and ∑ representative is carried out sum operation to the multinomial after it, and summation item number is the span of variable k, x _kin in the time that k equals 1, i.e. x ₁represent the value of the 15th byte of pPacketBuffer core buffer pointed, i.e. pPacketBuffer[14] value, this value is representing the header length of described IP packet, x _kin in the time that k equals 2, i.e. x ₂value, by x ₁value substitution formula draw in b), by that analogy, x ₃with x ₄value respectively by x ₂with x ₃value substitution formula draw in b), formula b) in the span of variable k be three positive integers between 1 to 3.

Cite an actual example, such as working as pPacketBuffer[14] value, the header length of IP packet equals at 69 o'clock, a) can be obtained by above-mentioned formula:

c)L _ip＝2 ²(x ₁mod2)+2 ³(x ₂mod2)+2 ⁴(x ₃mod2)+2 ⁵(x ₄mod2)

Because x ₁value equal 69, carry it into formula and can obtain x in b) ₂=34, then continue x ₂value substitution formula can obtain x in b) ₃=17, then continue x ₃value substitution formula can obtain x in b) ₄=8, finally above-mentioned four values are brought into formula and can obtain in c):

L _ip＝2 ²(69mod2)+2 ³(34mod2)+2 ⁴(17mod2)+2 ⁵(8mod2)＝2 ²+2 ⁴＝20

Be can be calculated by above-mentioned formula, work as pPacketBuffer[14] value, the header length of IP packet equals at 69 o'clock, the length of described IP packet is 20 bytes.

Then continue to judge that pPacketBuffer core buffer side-play amount pointed is 15+L _ip, 16+L _ip, 17+L _ip, 18+L _ipthe value of byte, i.e. pPacketBuffer[14+L _ip], pPacketBuffer[15+L _ip], pPacketBuffer[16+L _ip], pPacketBuffer[17+L _ip] value, the source port of the described UDP message bag of the value representative of the first two byte, the value of latter two byte represents the destination interface of described UDP message bag, if pPacketBuffer[14+L _ip] value equal 0, and pPacketBuffer[15+L _ip] value equal 67, and pPacketBuffer[16+L _ip] value equal 0, and pPacketBuffer[17+L _ip] value equal 68, illustrate that described UDP message bag is DHCP packet, need to carry out next step analysis, it is medium pending that other packet will directly be submitted to step (4).

(3) DHCP data packet analysis: if described packet is DHCP packet, so first, judge pPacketBuffer core buffer pointed the 27th, 28, 29, the value of 30 bytes, be pPacketBuffer[26], pPacketBuffer[27], pPacketBuffer[28], pPacketBuffer[29] value of byte, the value of these four bytes is representing the source address of described DHCP packet, send the IP address of the Dynamic Host Configuration Protocol server of described DHCP packet, the value of checking these four bytes whether respectively with the dhcp server ip address that will receive in four groups of numeral correspondent equals separating of ". " type separator, such as the address of the Dynamic Host Configuration Protocol server that will receive is " 172.26.1.254 ", so relatively pPacketBuffer[26] value whether equal 172, pPacketBuffer[27] value whether equal 26, pPacketBuffer[28] value whether equal 1, pPacketBuffer[29] value whether equal 254, if correspondent equal one by one, described DHCP packet sends for legal Dynamic Host Configuration Protocol server, otherwise for illegal DHCP server sends, finally described DHCP packet is submitted to step (4) medium pending.

(4) network packet processing: according to the Analysis and judgments of in step (2) and step (3), described packet being made, reception sends to the legal DHCP packet of DHCP client computer and the packet of other type, and described Packet Generation is arrived to protocol-driven, remaining illegal DHCP packet is dropped immediately, do not received by DHCP client computer, finally discharge pPacketBuffer core buffer pointed.

Meanwhile, the present invention also provides a kind of local area network (LAN) DHCP packet filtering system, its functional block diagram, and as shown in Figure 2, described system comprises driver sub-system and application subsystem two parts.Described driver sub-system comprises network packet acquisition module, network packet screening module, DHCP data packet analysis module, network data packet handing module, Communication processing module; Described application subsystem comprises bottom communication module, Dynamic Host Configuration Protocol server administration module, Dynamic Host Configuration Protocol server binding management module, IP address update module, system interface module.

Described network packet acquisition module, be operated in intermediate layer, send to all packets of the machine for intercepting and intercept and capture local area network (LAN), and packet is carried out to acquisition and processing one by one, and the packet being disposed is copied in the buffering area of the regular length of having distributed in internal memory, this regular length is generally more than or equal to the length of maximum data packet in network.

Described network packet screening module, be operated in intermediate layer, for the value of the packet assigned address byte that copies core buffer to is carried out to Analysis and judgments, thereby the network packet of catching is carried out to category filter, isolate DHCP packet wherein, and the packet of other type is submitted to network data packet handing module wait processing.

Described DHCP data packet analysis module, be operated in intermediate layer, for the value of the DHCP packet assigned address byte that is stored in core buffer filtering out is carried out to Analysis and judgments, isolate the packet that legal Dynamic Host Configuration Protocol server sends to the machine, and be submitted to network data packet handing module wait processing by analyzing complete DHCP packet.

Described network data packet handing module, be operated in intermediate layer, for processing analyzing complete packet, receiving legal Dynamic Host Configuration Protocol server sends to the packet of the machine and sends to the packet of other type of the machine, abandon the packet that illegal DHCP server sends to the machine, and discharge the core buffer previously having distributed.

Described Communication processing module, be operated in intermediate layer, send to the information in intermediate layer for receiving upper level applications, and the feedback information in intermediate layer is sent to upper level applications, described information is stored in the self-defined structure body that a type is FILTERRULE, and this structure is defined as follows:

In described structure, member Header presentation protocol title, member Protocol presentation protocol type, member Server_IP represent that Dynamic Host Configuration Protocol server address, member Server_Port represent that Dynamic Host Configuration Protocol server port, member Client_Port represent DHCP client computer port, member Server_Bind represents binding state, and intermediate driver sends to the packet of DHCP client computer in using the information in this structure as rule-based filtering local area network (LAN).

Described bottom communication module, drive transmission information to intermediate layer for upper level applications, or upper level applications drives the required information of obtaining from intermediate layer, and demonstration that can be real-time, intermediate layer drives the relevant information sending in the DHCP packet that upper level applications abandoned, for reference.

Described Dynamic Host Configuration Protocol server administration module, for managing legal Dynamic Host Configuration Protocol server list, comprises and inserts Dynamic Host Configuration Protocol server record, deletes Dynamic Host Configuration Protocol server record, empties Dynamic Host Configuration Protocol server list, preserves four functions of Dynamic Host Configuration Protocol server list.

Described Dynamic Host Configuration Protocol server binding management module, be used for binding the legal Dynamic Host Configuration Protocol server that the some Dynamic Host Configuration Protocol server in legal Dynamic Host Configuration Protocol server list are current appointment, and the excessively described bottom communication module of Dynamic Host Configuration Protocol server information exchange is sent to intermediate layer driving, intermediate layer drives by Communication processing module and receives the information that upper level applications sends, and using this information as DHCP data packet analysis, the rule of filtering, now the Communication processing module in intermediate layer will send an identical information to upper level applications, judge that for upper level applications intermediate layer drives the information that it sends that whether receives, and whether intermediate layer drives the information receiving correct, simultaneously, above-mentioned module, also can the current Dynamic Host Configuration Protocol server of unbind, allow DHCP client computer to receive all DHCP packets in local area network (LAN).

Described IP address update module, be used for when changing after the legal Dynamic Host Configuration Protocol server of specifying, by creating a more new thread of DHCP client computer IP address, empty the IP address of current DHCP client computer, and upgrade the IP address that the IP address of current DHCP client computer is distributed to new Dynamic Host Configuration Protocol server.

Described system interface module, is used for generating the demonstration of each assembly in the operation interface, interface of upper level applications, and input and the output of data in each assembly.

As shown in Figure 3, be that the network packet of described system is filtered workflow diagram, describe and in described system local area network, send to the workflow that the packet of DHCP client computer filters below by an example:

Because may there are many legal Dynamic Host Configuration Protocol server in local area network (LAN), if and DHCP client computer is accessed the different resource in local area network (LAN) or the Internet, may need different Dynamic Host Configuration Protocol server for its distributing IP address, so first by the upper level applications in the system described in all legal Dynamic Host Configuration Protocol server address typings in local area network (LAN), then choosing a current required legal Dynamic Host Configuration Protocol server binds, the now upper level applications in described system, the structure FilterRule that can create a FILTERRULE type is used for the information of the legal Dynamic Host Configuration Protocol server of storing current binding, the IP address of serving such as the legal DHCP of current binding is " 172.26.1.254 ", so in described FilterRule structure, the value of member Header equals character string " DHCP ", the value of member Protocol equals 17, the value of member Server_IP equals character string " 172.26.1.254 " that draw and long shaping value its equivalence after conversion, the value of member Server_Port equals 67, the value of member Client_Port equals 68, the value of member Server_Bind equals 1.

Then the upper level applications in described system, structure FilterRule is sent to intermediate layer to be driven, intermediate layer drives and receives after FilterRule structure, first empty the doubly linked list of the LIST_ENTRY structure of system definition, then the information in FilterRule structure is inserted into the form of head node in the doubly linked list of LIST_ENTRY structure, then intermediate layer drives the information that will copy in a FilterRule structure to be transmitted to upper level applications, upper level applications receives intermediate layer driving and issues after its information, compare with the value of each member in the own FilterRule structure sending to intermediate layer, carry out data check, if equated, return to the prompting of Dynamic Host Configuration Protocol server binding success, if unequal, return data verification failure, the prompting of Dynamic Host Configuration Protocol server Bind Failed, if Dynamic Host Configuration Protocol server binding success, upper level applications will create a more new thread of DHCP client computer IP address so, empty the IP address of current configuration in DHCP client computer, the IP address that the legal Dynamic Host Configuration Protocol server that wait has been bound distributes for the machine, and by this IP address configuration in current DHCP client computer, then upper level applications will discharge the more new thread of DHCP client computer IP address creating, if after Dynamic Host Configuration Protocol server binding success, select unbind, so, the message that upper level applications will send a unbind drives to intermediate layer, intermediate layer drives after the message of receiving upper level applications transmission, the value of member Server_Bind in the doubly linked list of LIST_ENTRY structure node can be arranged to 0, intermediate layer drives and will can not analyze and filter sending to any packet of DHCP client computer like this, directly receive these packets, and send to protocol-driven.

Then, if during intermediate layer drives, in the doubly linked list of LIST_ENTRY structure, in a node, the value of member Server_Bind equals 1, intermediate layer drives in the doubly linked list with LIST_ENTRY structure so, node institute canned data is as filtering rule, the packet that sends to DHCP client computer in local area network carries out analysis and filtration one by one, and according to priority step, isolate the IP packet in these packets, UDP message bag in IP packet, DHCP packet in UDP message bag, and isolated DHCP packet is analyzed, find out the packet that legal Dynamic Host Configuration Protocol server wherein sends to DHCP client computer, and receive legal Dynamic Host Configuration Protocol server and send to the packet of the machine, and other type sends to the packet of the machine, abandon the packet that illegal DHCP server sends to the machine.

Finally, intermediate layer drives and will create the structure DropPacket of a FILTERRULE type, and by the relevant information in the DHCP packet having abandoned, store in the corresponding member in DropPacket structure, such as, the DHCP packet being dropped is that Dynamic Host Configuration Protocol server " 192.168.1.254 " sends, in DropPacket structure, the value of member Header equals character string " DHCP " so, the value of member Protocol equals 17, the value of member Server_IP equals character string " 192.168.1.254 " that draw and long shaping value its equivalence after conversion, the value of member Server_Port equals 67, the value of member Client_Port equals 68, the value of member Server_Bind can be given, then DropPacket structure is sent to upper level applications by driving meeting in intermediate layer, upper level applications receives intermediate layer and drives after the DropPacket structure sending, will be the information in DropPacket structure, the relevant information of the DHCP packet having abandoned, the mode that can intuitively browse with user, real-time shows in upper level applications, for reference.

Technique scheme is preferably embodiment of one of the present invention, not limits thus the scope of the claims of the present invention, and every equivalent transformation that utilizes specification of the present invention and Figure of description to do, includes in scope of patent protection of the present invention.

Claims (2)

1. a local area network (LAN) DHCP packet filtering method, is characterized in that, comprises the following steps:

(1) network packet gatherer process, in intercepting and intercept and capture local area network (LAN), the driving of DHCP client computer network interface card and the intermediate layer between protocol-driven send to all packets of the machine, and each packet is carried out to collection one by one, first, in internal memory, distribute a core buffer that is more than or equal to maximum data packet length in local area network (LAN) to deposit intercepted and captured packet, then by described core buffer content zero clearing, finally intercepted and captured packet content piecemeal is copied in described core buffer;

(2) network packet screening process, first take out described core buffer the 13rd byte and the value of the 14th byte, if the value of the 13rd byte equals 8, and the value of the 14th byte equals 0, so described packet is IP packet, then take out the value of described core buffer the 24th byte, if the value of the 24th byte equals 17, illustrate that described IP packet is UDP message bag, the length that now needs to calculate described IP packet, the computational methods of IP data packet length are produced by following two formula:

a) $L_{\mathrm{ip}}=\underset{k=1}{\overset{4}{\mathrm{\Σ}}}{2}^{k+1}\left(x_k\mathrm{mod}2\right)$

b)x _k+1＝(x _k-(x _kmod2))/2 k＝(1，2，3)

In described formula a) with formula b) in mod representative get the remainder that two numbers are divided by, wherein formula a) in, L _ipthe length of the IP packet described in representative, k represents variable, and span is four positive integers between 1 to 4, and ∑ representative is carried out sum operation to the multinomial after it, and summation item number is the span of variable k, x _kin in the time that k equals 1, i.e. x ₁the value of core buffer the 15th byte described in representative, x _kin in the time that k equals 2, i.e. x ₂value, by x ₁value substitution formula draw in b), by that analogy, x ₃with x ₄value respectively by x ₂with x ₃value substitution formula draw in b), formula b) in the span of variable k be three positive integers between 1 to 3;

Finally continue to judge that described core buffer side-play amount is 15+L _ip, 16+L _ip, 17+L _ip, 18+L _ipthe value of byte, if described core buffer side-play amount is 15+L _ipthe value of byte equals 0, and described core buffer side-play amount is 16+L _ipthe value of byte equals 67, and described core buffer side-play amount is 17+L _ipthe value of byte equals 0, and described core buffer side-play amount is 18+L _ipthe value of byte equals 68, illustrates that described UDP message bag is DHCP packet, need to carry out next step analysis, and it is medium pending that other packet will directly be submitted to step (4).

(3) DHCP data packet analysis: if described packet is DHCP packet, so first the core buffer the 27th described in judgement, the value of 28,29,30 bytes, the value of checking these four bytes whether respectively with the dhcp server ip address that will receive in four groups of numeral correspondent equals separating of ". " type separator, if correspondent equal one by one, described DHCP packet sends for legal Dynamic Host Configuration Protocol server, otherwise for illegal DHCP server sends, finally described DHCP packet is submitted to step (4) medium pending;

(4) network packet processing: according to the Analysis and judgments of in step (2) and step (3), described packet being made, reception sends to the legal DHCP packet of DHCP client computer and the packet of other type, remaining illegal DHCP packet is dropped immediately, do not received by DHCP client computer, finally discharge described core buffer.

2. a local area network (LAN) DHCP packet filtering system, it is characterized in that, comprise driver sub-system and application subsystem two parts, described driver sub-system comprises network packet acquisition module, packet screening module, DHCP data packet analysis module, network data packet handing module, Communication processing module; Described application subsystem comprises bottom communication module, Dynamic Host Configuration Protocol server administration module, Dynamic Host Configuration Protocol server binding management module, IP address update module, system interface module;

Described network packet acquisition module, sends to all packets of the machine, and packet is carried out to acquisition and processing one by one for intercepting and intercept and capture local area network (LAN);

Described network packet screening module, for the packet collecting is carried out to category filter, isolates DHCP packet wherein, and the packet of other type is submitted to network data packet handing module wait processing;

Described DHCP data packet analysis module, for the DHCP packet filtering out is carried out to Analysis and judgments, find out wherein legal Dynamic Host Configuration Protocol server and send to the packet of the machine, and be submitted to network data packet handing module wait processing by analyzing complete DHCP packet;

Described network data packet handing module, for processing analyzing complete packet, receive legal Dynamic Host Configuration Protocol server and send to the packet of the machine and send to the packet of other type of the machine, abandon illegal DHCP server and send to the packet of the machine;

Described Communication processing module, sends to the information in intermediate layer, and the feedback information in intermediate layer is sent to upper level applications for receiving upper level applications;

Described bottom communication module, drives transmission information to intermediate layer for upper level applications, or upper level applications drives and obtain required information from intermediate layer, and can show in real time the DHCP packet information having abandoned;

Described Dynamic Host Configuration Protocol server administration module, for managing legal Dynamic Host Configuration Protocol server list, comprises and inserts Dynamic Host Configuration Protocol server record, deletes Dynamic Host Configuration Protocol server record, empties Dynamic Host Configuration Protocol server list, preserves four functions of Dynamic Host Configuration Protocol server list;

Described Dynamic Host Configuration Protocol server binding management module, be used for binding the legal Dynamic Host Configuration Protocol server of current appointment, and the excessively described bottom communication module of Dynamic Host Configuration Protocol server information exchange is sent to intermediate layer driving, as the rule of DHCP Packet Filtering, also can unbind Dynamic Host Configuration Protocol server, allow DHCP client computer to receive all DHCP packets in local area network (LAN);

Described IP address update module, is used for, when changing after the legal Dynamic Host Configuration Protocol server of complete appointment, emptying the IP address of current DHCP client computer, and upgrades the IP address that the IP address of current DHCP client computer is distributed to new Dynamic Host Configuration Protocol server;

Described system interface module, is used for generating the demonstration of each assembly in the operation interface, interface of upper level applications, and input and the output of data in each assembly.

Images