CN1878056A - Method for identifying whether there is false network apparatus in local area network or not - Google Patents

Method for identifying whether there is false network apparatus in local area network or not Download PDF

Info

Publication number
CN1878056A
CN1878056A CN 200610098830 CN200610098830A CN1878056A CN 1878056 A CN1878056 A CN 1878056A CN 200610098830 CN200610098830 CN 200610098830 CN 200610098830 A CN200610098830 A CN 200610098830A CN 1878056 A CN1878056 A CN 1878056A
Authority
CN
China
Prior art keywords
network equipment
counterfeit
local area
exist
lan
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN 200610098830
Other languages
Chinese (zh)
Other versions
CN1878056B (en
Inventor
杜凤山
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
New H3C Technologies Co Ltd
Original Assignee
Hangzhou Huawei 3Com Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Huawei 3Com Technology Co Ltd filed Critical Hangzhou Huawei 3Com Technology Co Ltd
Priority to CN2006100988308A priority Critical patent/CN1878056B/en
Publication of CN1878056A publication Critical patent/CN1878056A/en
Application granted granted Critical
Publication of CN1878056B publication Critical patent/CN1878056B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a judging method of false network equipment in the local area networks (LAN), which is characterized by the following: the network equipment sends multiple detecting reports, which affirms false network equipment according to frequency of at least two respond reports more than false affirming threshold in the detecting report of network equipment.

Description

Determine whether to exist the method for the counterfeit network equipment in the local area network (LAN)
Technical field
The present invention relates to local area network technology, relate in particular to the technology that determines whether to exist the counterfeit network equipment in the local area network (LAN).
Background technology
In network system, when the user uses the IP agreement to carry out communication, need by DHCP (DynamicHost Configuration Protocol, DHCP) or static configuration IP address identify the IP address of the employed network equipment, the IP address of each network equipment of IP protocol requirement is unique.In Ethernet (Ethernet), each network equipment all has unique MAC (Media Access Control, medium access control) address.In this case, the network equipment can be by other network equipments of the unique identification of mode of MAC+IP address.Some authentications and security protocol as 802.1X etc., also are based on and discern with the control network devices ability to communicate to the MAC+IP address.
In the Windows environment, the user can revise the MAC Address of the network equipment by hand, the IP address of the described network equipment also can be set by hand, so, the MAC+IP address of the network equipment that someone just can use oneself and the MAC+IP address setting of certain network equipment get in full accord, we become the network equipment of the MAC+IP address of certain network equipment to be called the counterfeit network equipment of certain network equipment the MAC+IP address setting, abbreviate the counterfeit network equipment as.If there is the counterfeit network equipment in the local area network (LAN), then can make based on the service of the MAC+IP Address Recognition network equipment and can't correctly distinguish the network equipment of normal use and the counterfeit network equipment, the counterfeit network equipment will obtain will cause safety problem like this with by the on all four rights and interests of the counterfeit network equipment.
With network environment shown in Figure 1 is example, suppose main frame 1 for legal, and main frame 2 is counterfeit main frames, and then the router data that external server may be sent to main frame 1 send to main frame 2 simultaneously, also may select to send to one of them main frame.Can find out that thus the data that script main frame 1 should receive might be received by main frame 2, have so just damaged the rights and interests of main frame 1.
The legal network equipment might need to survey timely the counterfeit network equipment that whether exists in the current network for the consideration of the safety of safeguarding self and rights and interests, promptly whether has the on all four network equipment in MAC+IP address with oneself.
Summary of the invention
The technical problem to be solved in the present invention is the method that determines whether to exist the counterfeit network equipment in a kind of local area network (LAN) is provided, so that the network equipment in the local area network (LAN) can determine whether to exist and self the on all four network equipment in MAC+IP address.
The invention provides the method that determines whether to exist the counterfeit network equipment in a kind of local area network (LAN), comprising: the network equipment sends detection messages; If have at least two response messages in the described network equipment, then determine to exist the counterfeit network equipment at described detection messages.
Described detection messages is an ARP message, and in described ARP message, sender's hardware address and internet address are non-existent hardware address and internet address in the local area network (LAN).
In described ARP message, the targeted internet address is identical with the internet address of the described network equipment.
After the described network equipment sends detection messages, respond described detection messages.
The described network equipment is collected all ARP messages by using Technology of Network Sniffer from network adapter, determine the number of described response message.
When the described network equipment is when other computer uses Windows XP operating system in computer and the local area network (LAN), if there be m response message in the described computer, then determine to exist the individual counterfeit network equipment of m-1, wherein, m is not less than 2 positive integer.
Each counterfeit network equipment sends query message and responds described query message after receiving the response message of the described detection messages of response.
The present invention also provides the method that determines whether to exist the counterfeit network equipment in a kind of local area network (LAN), comprising: the network equipment repeatedly sends detection messages; If existence greater than counterfeit affirmation thresholding, then determines to exist the counterfeit network equipment at the number of times of at least two response messages of described detection messages in the described network equipment.
In the present invention, the network equipment sends a detection messages, the quantity that determine to exist then at the response message of this detection messages, and then determine whether to exist the counterfeit network equipment, this technological means to fill up the present blank that does not also have the technical scheme of feasible inspection counterfeit network equipment.
In the present invention, the network equipment not only can determine whether to exist the counterfeit network equipment, can also further determine to exist the quantity of the counterfeit network equipment under certain condition, for the follow-up processing to the counterfeit network equipment provides information more accurately.
In the present invention, the network equipment can repeatedly send detection messages, and when reaching certain condition, statistics determines to exist the number of times of the counterfeit network equipment, and this mode is a kind of means of fault-toleranr technique, can make the result of detection more accurate.
Description of drawings
Fig. 1 is a kind of network environment schematic diagram;
Fig. 2 is the flow chart of one embodiment of the invention;
Fig. 3 A-Fig. 3 F is the query message of the embodiment of the invention and the schematic diagram of response message;
Fig. 4 A is the ARP message tabulation of first main frame;
Fig. 4 B is the ARP message tabulation of counterfeit main frame;
Fig. 5 is the flow chart of another embodiment of the present invention.
Embodiment
Below we will be in conjunction with the accompanying drawings, optimum implementation of the present invention is described in detail.At first it is to be noted, the implication of the term of using among the present invention, words and claim can not only only limit to its literal and common implication and go to understand, the implication and the notion that also comprise and then conform to technology of the present invention, this is because we are as the inventor, to suitably provide the definition of term, so that the most appropriate description is carried out in our invention.Therefore, the configuration that provides in this explanation and the accompanying drawing is first-selected embodiment of the present invention, rather than will enumerates all technical characteristics of the present invention.We will recognize to also have the various equivalent scheme or the modifications that can replace our scheme.
At first, need to prove that the network equipment of the present invention can be equipment such as switch, router, server and computer.Server and computer can use Windows operating system, Unix operating system or (SuSE) Linux OS.
In conjunction with Fig. 2, the present invention is described in detail now.
As shown in Figure 2, in step S201, first main frame sends detection messages and responds described detection messages.
Described detection messages can be ARP (Address Resolution Protocol, address resolution protocol) message, in described ARP message, sender's hardware address and internet address can be non-existent hardware address and internet address in the local area network (LAN), and the targeted internet address can also be identical with the internet address of first main frame.
Fig. 3 A-Fig. 4 B is that the present invention uses message schematic diagram and the message tabulation that relates under the Windows XP operating system situation at two main frames.A kind of form that is detection messages shown in Fig. 3 A.As shown in Figure 3A, Ethernet Header is the Ethernet head, and wherein, Destination represents the purpose that message arrives, be shown as Ethernet Broadcast (Ethernet broadcasting) among the figure, the purpose that this message arrival promptly is described is any one main frame in the Ethernet; Source represents the person of sending of this message, is worth for 00:0D:88:F8:4E:6E illustrates that this message is is that the main frame of 00:0D:88:F8:4E:6E sends by MAC Address, and promptly first main frame sends; Protocol Type is a protocol type, be worth for 0x0806 description protocol type be IP ARP.Under the catalogue of ARP, Hardware is a hardware, and value is that 1 explanation is an Ethernet; Protocol represents it is what agreement, and being worth for 0x0080 illustrates is the IP agreement; Hardware Addr Length represents hardware address length, i.e. MAC Address length, value are 6 bytes of 6 expressions; Protocol AddrLength presentation protocol address size, i.e. IP address size, value is 4 bytes of 4 expressions; Operation represents action type, and value is that 1 description operation is ARP Request (ARP inquiry); Sender HardwareAddr represents sender's hardware address, i.e. the message person's of sending MAC Address, but this value is set to non-existent 00:0D:88:F8:4E:60 in the local area network (LAN) in this message; Sender Internet Addr represents sender's protocol address, i.e. the message person's of sending IP address, but this value is set to non-existent 172.31.48.33 in the local area network (LAN) in this message; Target Hardware Addr represents target hardware address, i.e. the MAC Address of target; Target Internet Addr represents target protocol address, i.e. the IP address of target, and in general, this value is not identical with the message person's of sending IP address, but this message is arranged to the message person's of sending IP address, i.e. 172.31.48.36 with this value; Extra bytes represents extra byte; ECS represent verification and.
Generally speaking, in the message that first main frame sends, Sender Hardware Addr and SenderInternet Addr should be the MAC Address and the IP address of first main frame, even and inquire about the main frame of certain IP address correspondence, Target Internet Addr should not be the IP address of first main frame yet, but in the present embodiment, first main frame has sent the detection messages shown in Fig. 3 A, the network protocol stack of first main frame may not can send to this detection messages in the local area network (LAN), but may think that MAC Address is 00:0D:88:F8:4E:60, the IP address is that the main frame of 172.31.48.33 is the information of the main frame of 172.31.48.36 in inquiry IP address, so this message is successively returned again, then, first main frame will respond this detection messages, and it is 00:0D:88:F8:4E:60 that response message is sent to MAC Address, the IP address is the main frame of 172.31.48.33.
Enter step S202, each counterfeit main frame sends query message and responds described query message after receiving response message at described detection messages.
In general, though it is that 00:0D:88:F8:4E:60, IP address are the main frame of 172.31.48.33 that first main frame sends to MAC Address with the response message appointment, but each main frame in the local area network (LAN) all can be received this response message, when Target Hardware Addr that finds response message and MAC Address and the IP address that TargetInternet Addr is not oneself, and Sender Hardware Addr and Sender Internet Addr are also irrelevant with oneself, receive that then the main frame of response message will abandon this message.But, because the MAC Address with first main frame is identical with the IP address respectively with the IP address for the MAC Address of counterfeit main frame, so counterfeit main frame is after receiving this response message, can send a query message, promptly inquire about the information that the IP address is the main frame of 172.31.48.36.Identical with first main frame, the network protocol stack of counterfeit main frame may not can send to this detection messages in the local area network (LAN), but may think that the IP address of oneself is exactly 172.31.48.36, so not only with this message but also successively return, then, counterfeit main frame will respond this detection messages, and it is that 00:0D:88:F8:4E:60, IP address are the main frame of 172.31.48.33 that response message is sent to MAC Address.
Enter step S203 at last, first main frame determines to exist counterfeit main frame after receiving the response message that counterfeit main frame sends.
Further, if only there is a counterfeit main frame in the local area network (LAN), then first main frame only can receive a response message; If there be n counterfeit main frame in the local area network (LAN), then first main frame can receive n response message, and wherein, n is not less than 1 positive integer.So first main frame just can be determined the number of counterfeit main frame according to the number that receives response message, for example,, just can determine to exist n counterfeit main frame if receive n response message.
Need to prove that first main frame is after a period of time after sending detection messages, 10-30 second for example, just can judge the number of response message of reception or the number of already present response message.First main frame is after a period of time after sending detection messages, can use Technology of Network Sniffer from described network adapter, to collect all ARP messages, the number of statistics response message just can determine whether to exist counterfeit main frame, if the number of response message is not less than 2, then there is counterfeit main frame in explanation, further, when other main frame uses Windows XP operating system in first main frame and the local area network (LAN), if the number of response message is m in first main frame, then the quantity of counterfeit main frame is m-1, and m is not less than 2 positive integer.
In the described execution mode of Fig. 2, if only there is a counterfeit main frame, then first main frame and counterfeit main frame use the ARP message of Technology of Network Sniffer collection respectively shown in Fig. 4 A and Fig. 4 B.In Fig. 4 A, the 1st Packet (bag) is the detection messages as shown in Figure 3A that first main frame sends; The 2nd Packet is the response message that first main frame sends at detection messages, and Fig. 3 B is the schematic diagram of this response message; The 3rd Packet is the response message that counterfeit main frame that first main frame receives sends, and Fig. 3 C is the schematic diagram of this response message.In Fig. 4 B, the 1st Packet is the response message that first main frame shown in Fig. 3 B that counterfeit main frame receives sends, and Fig. 3 D is the schematic diagram of this response message, and Fig. 3 D is consistent with Fig. 3 B; The 2nd Packet of Fig. 4 B is the query message that counterfeit main frame sends at response message, and Fig. 3 E is the schematic diagram of this query message; The 3rd Packet is the response message that counterfeit main frame sends at query message, and Fig. 3 F is the schematic diagram of this response message, and Fig. 3 F is consistent with Fig. 3 C.EthernetBroadcast is Ethernet broadcasting, and D-Link is the sign of equipment vendor, and Summary is summary.First main frame is after obtaining the message tabulation shown in Fig. 4 A, and the number of the ARP Response message that exists in the statistics tabulation is 2, then determines to exist counterfeit main frame, and further, the quantity that also can determine counterfeit main frame is 1.
In actual applications, because some cause specifics, message can not be received and dispatched normally, so just may cause the result of execution mode shown in Figure 2 may not be very accurate.For this reason, the present invention has also considered to use fault-tolerant means, promptly repeatedly implements execution mode shown in Figure 2, and after reaching certain condition, statistics determines to exist the number of times of counterfeit main frame, with this as the foundation of determining to exist counterfeit main frame.
In conjunction with Fig. 5, another kind of method provided by the invention is described now.
As shown in Figure 5, in step S501, first main frame sends detection messages at set intervals.
The blanking time of sending detection messages can be identical, also can be inequality, and can also be according to the practical application adjustment.The form of detection messages as shown in Figure 3A, the Sender HardwareAddr of the message that at every turn sends and/or Sender Internet Addr can be different, but preferably guarantee it is non-existent MAC Address and/or IP address in the local area network (LAN), Target Internet Addr preferably is the IP address of the network equipment.
After first main frame sends detection messages at every turn, follow-up flow process is identical with execution mode shown in Figure 2, that is: detection messages can not arrive in the local area network (LAN), have only first main frame can respond this message, response message can arrive in the local area network (LAN), have only counterfeit main frame to send query message at response message, and this query message also has only counterfeit main frame just can respond, after the response message that counterfeit main frame sends arrives in the local area network (LAN), first main frame can receive this response message, can tentatively determine to exist counterfeit main frame thus.But this determines to be preliminary conclusion, also needs repeatedly to repeat said process, enters step S502 thus.
Enter step S502,, then determine to exist counterfeit main frame if when determining to exist the number of times of counterfeit main frame to reach counterfeit affirmation thresholding.
Counterfeit affirmation thresholding also can be determined according to practical application, for example, stipulate that counterfeit affirmation thresholding is to determine that having the number of times of counterfeit main frame is 3, if promptly to have the number of times of counterfeit main frame be 3 to first host acknowledgement, then can conclude the on all four main frame of MAC Address and IP address that exists really in the local area network (LAN) with oneself fully.In actual applications, owing to the reason such as unusual that message is transmitted, handled, first main frame may not can continuous several times confirm to exist counterfeit main frame, but determine that counterfeit main frame exists and the alternately appearance of non-existent situation,
In addition, step S502 can also be further defined to: when timing statistics arrives, if when determining to exist the number of times of counterfeit main frame to reach counterfeit affirmation thresholding, then determine to exist counterfeit main frame.
Timing statistics also can be determined and adjustment according to practical application.For example, if timing statistics is 60 seconds, then first main frame sends after the detection messages 60 seconds when arriving for the first time, then statistics determines to exist the number of times of counterfeit main frame, if number of times is not less than counterfeit statistics thresholding, then determine certain existence and the on all four main frame of MAC Address and IP address of oneself in the local area network (LAN).Whether first main frame also can continue detection and exist counterfeit main frame, timing statistics can continue to be defined as 60 seconds after current statistics finishes, and can also adjust.
In addition, step S502 can also be further defined to: if when sending the number of times of detection messages and reaching number of times statistics thresholding and determine to exist the number of times of counterfeit main frame to reach counterfeit affirmation thresholding, then determine to exist counterfeit main frame.
Number of times statistics thresholding can be determined and adjustment according to practical application.For example, number of times statistics thresholding is 10 times, and then first main frame is after sending detection messages the 10th time, and statistics determines to exist the number of times of counterfeit main frame, if number of times is not less than counterfeit statistics thresholding, then determine certain existence and the on all four main frame of MAC Address and IP address of oneself in the local area network (LAN).First main frame also can continue to detect whether have counterfeit main frame after current statistics finishes, number of times statistics thresholding can continue to be defined as 10 times, can also adjust.
The above only is a preferred implementation of the present invention; should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.

Claims (10)

1. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN), it is characterized in that comprising:
The network equipment sends detection messages;
If have at least two response messages in the described network equipment, then determine to exist the counterfeit network equipment at described detection messages.
2. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 1, it is characterized in that: described detection messages is an ARP message, in described ARP message, sender's hardware address and internet address are non-existent hardware address and internet address in the local area network (LAN).
3. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 2, it is characterized in that: in described ARP message, the targeted internet address is identical with the internet address of the described network equipment.
4. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 1, it is characterized in that: after the described network equipment sends detection messages, respond described detection messages.
5. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 1, it is characterized in that: the described network equipment is collected all ARP messages by using Technology of Network Sniffer from network adapter, determine the number of described response message.
6. as determining whether to exist the method for the counterfeit network equipment in claim 1, the 4 or 5 described local area network (LAN)s, it is characterized in that: when the described network equipment for the computer that uses Windows XP operating system and local area network (LAN) in other computer when using Windows XP operating system, if there be m response message in the described computer, then determine to exist m-1 counterfeit computer, wherein, m is not less than 2 positive integer.
7. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 4, it is characterized in that also comprising: each counterfeit network equipment sends query message and responds described query message after receiving the response message of the described detection messages of response.
8. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 1, it is characterized in that: the described counterfeit network equipment is meant the hardware address and the identical respectively network equipment of internet address with the described network equipment.
9. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN), it is characterized in that comprising:
The network equipment repeatedly sends detection messages;
If existence greater than counterfeit affirmation thresholding, then determines to exist the counterfeit network equipment at the number of times of at least two response messages of described detection messages in the described network equipment.
10. determine whether to exist the method for the counterfeit network equipment in the local area network (LAN) as claimed in claim 9, it is characterized in that: described detection messages is an ARP message, in described ARP message, sender's hardware address and internet address are non-existent hardware address and internet address in the local area network (LAN), and the targeted internet address is identical with the internet address of the described network equipment.
CN2006100988308A 2006-07-13 2006-07-13 Method for identifying whether there is false network apparatus in local area network or not Active CN1878056B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2006100988308A CN1878056B (en) 2006-07-13 2006-07-13 Method for identifying whether there is false network apparatus in local area network or not

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2006100988308A CN1878056B (en) 2006-07-13 2006-07-13 Method for identifying whether there is false network apparatus in local area network or not

Publications (2)

Publication Number Publication Date
CN1878056A true CN1878056A (en) 2006-12-13
CN1878056B CN1878056B (en) 2011-07-20

Family

ID=37510369

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2006100988308A Active CN1878056B (en) 2006-07-13 2006-07-13 Method for identifying whether there is false network apparatus in local area network or not

Country Status (1)

Country Link
CN (1) CN1878056B (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577645B (en) * 2009-06-12 2011-06-22 北京星网锐捷网络技术有限公司 Method and device for detecting counterfeit network equipment
CN103401847A (en) * 2009-07-08 2013-11-20 中兴通讯股份有限公司 Counterfeit judging method
CN112153027A (en) * 2020-09-14 2020-12-29 杭州迪普科技股份有限公司 Counterfeit behavior identification method, apparatus, device and computer readable storage medium

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3813571B2 (en) * 2002-11-13 2006-08-23 株式会社東芝 Border router device, communication system, routing method, and routing program
CN1292564C (en) * 2003-06-04 2006-12-27 华为技术有限公司 Method for detecting and processing forgery network service
CN100484132C (en) * 2003-09-29 2009-04-29 华为技术有限公司 A method for preventing counterfeit host in IP Ethernet

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577645B (en) * 2009-06-12 2011-06-22 北京星网锐捷网络技术有限公司 Method and device for detecting counterfeit network equipment
CN103401847A (en) * 2009-07-08 2013-11-20 中兴通讯股份有限公司 Counterfeit judging method
CN103401847B (en) * 2009-07-08 2016-12-28 中兴通讯股份有限公司 A kind of counterfeit determination methods
CN112153027A (en) * 2020-09-14 2020-12-29 杭州迪普科技股份有限公司 Counterfeit behavior identification method, apparatus, device and computer readable storage medium
CN112153027B (en) * 2020-09-14 2022-11-25 杭州迪普科技股份有限公司 Counterfeit behavior identification method, apparatus, device and computer readable storage medium

Also Published As

Publication number Publication date
CN1878056B (en) 2011-07-20

Similar Documents

Publication Publication Date Title
CN101110821B (en) Method and apparatus for preventing ARP address cheating attack
US7725938B2 (en) Inline intrusion detection
US6073178A (en) Method and apparatus for assignment of IP addresses
CN1177439C (en) Method of acting address analytic protocol Ethernet Switch in application
US8086732B1 (en) Method and apparatus for rate limiting client requests
CN101674306B (en) Address resolution protocol message processing method and switch
CN1929404A (en) System and method for identifying source of malicious network messages
CN1682516A (en) Method and apparatus for preventing spoofing of network addresses
US9183382B2 (en) Method for blocking a denial-of-service attack
CN1175621C (en) Method of detecting and monitoring malicious user host machine attack
EP3340568A2 (en) Anycast-based spoofed traffic detection and mitigation
US8243736B2 (en) Packet capturing device
CN112910735A (en) Comprehensive detection method and system for discovering illegal external connection of intranet equipment
CN104660730B (en) The means of communication and its system of server-side and far-end unit
CN109561111A (en) A kind of determination method and device of attack source
CN1878056A (en) Method for identifying whether there is false network apparatus in local area network or not
CN101030912A (en) Fast ring network method against attack based on RRPP, apparatus and system
CN102170484A (en) A detection method a detection device of IP address conflict
CN1808998A (en) Method of detection and maintenance of PPP link
CN101179515A (en) Method and device for inhibiting black hole routing
CN101043356A (en) Method for preventing MAC address cheat
CN1152517C (en) Method of guarding network attack
US8687622B2 (en) Systems and methods for discovering SCTP associations in a network
CN1567900A (en) A method for implementing message forwarding control in routing equipment
US8144688B2 (en) System and method for discovering SCTP associations in a network

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CP03 Change of name, title or address

Address after: 310052 Binjiang District Changhe Road, Zhejiang, China, No. 466, No.

Patentee after: Xinhua three Technology Co., Ltd.

Address before: 310053 Hangzhou hi tech Industrial Development Zone, Zhejiang province science and Technology Industrial Park, No. 310 and No. six road, HUAWEI, Hangzhou production base

Patentee before: Huasan Communication Technology Co., Ltd.

CP03 Change of name, title or address