JP2002319955A - Network bridging device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network bridging device capable of reducing traffic in a LAN and performing security measures by being a so-called ARP server to return a MAC address that has been subjected to an inquiry request when the network bridging device receives the inquiry request for the MAC address of a communication terminal device to be a destination from a communication terminal device. SOLUTION: This network bridging device is provided with an address table T where the MAC address and the IP address of a communication terminal device are associated in each connection port to be registered, and returns the MAC address of the communication terminal device to be the destination by referring to the address table T when the network bridging device receives the inquiry request for the MAC address of the communication terminal device where an IP address is designated as a communication destination.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an improvement of a network bridge device having a plurality of connection ports for connecting communication terminals.

[0002]

2. Description of the Related Art When building a LAN in an office or the like,
If a repeater is used as a relay device for packets transmitted and received between communication terminals, for example, a packet coming from the connection port 1 is always output to all other connection ports, so that the traffic in the LAN increases. In order to solve this, a network bridging device has been used as a relay device.

[0003] By using a network bridge device, for example, packets coming from the connection port 1 can be switched to the connection port 2 and packets coming from the connection port 3 can be switched to the connection port 4, so that traffic can be reduced. Was.

[0004] After that, when a LAN is also built in an apartment house, unlike a LAN in an office,
It is necessary to protect the privacy of the communication terminals in each home connected to the bridge device. As a countermeasure, for example, as shown in FIG. , Packets coming from the Nth port are output from the 1st to N-1th ports, packets coming from the communication terminal are sent only to the upper network, and packets coming from the upper network. Only one that flows to each communication terminal was developed, and as a result, security between each communication terminal was maintained.

In FIG. 5, 1 to N indicate connection port numbers, ports 1 to N-1 are connected to communication terminals on the LAN, and port N is a gateway. An external network such as the Internet is connected via the Internet.

[0006]

By the way, the head of a packet flowing through the LAN includes a destination MAC address, and the packet itself is delivered to a communication terminal having the MAC address.

[0007] Such a MAC address is a unique address set for each communication terminal, and is the same MA address.
Although nothing has a C address, it is impossible to know such a MAC address when communicating on a LAN. Therefore, before transmitting a necessary packet from a communication terminal, usually, ARP (AddressRe
(Solution Protocol), based on the IP address of the communication terminal to which the packet is to be transmitted, and transmitting a MAC address inquiry request of the communication terminal to the network bridge device as an inquiry request packet. Do.

In such an inquiry request packet,
The destination MAC address is "FFFFFFFFFFFF"
When this is extracted by the network bridge device, the received inquiry request packet is
The communication terminal which broadcasts, that is, transmits to all the connection ports, and whose IP address is included in the request packet, returns its MAC address to the inquiring communication terminal. Using the MAC address of the destination, a packet to which transmission data is added is created and transmitted again. The network bridge device receiving this transmits the received packet only to the corresponding communication terminal with reference to the address table T.

In the address table T, the MAC address of the communication terminal is registered corresponding to the connection port, and the M extracted from the packet received from the communication terminal is registered.
If the AC address is registered in this table T, the received data is transmitted from the corresponding connection port.

The operation of such a network bridge device is shown in a flowchart (200 to 20) as shown in FIG.
5).

As described above, the MA to be the destination of the packet
Inquiry of C address to all communication terminals,
Since the MAC address from the responding communication terminal is returned to the inquiring communication terminal via the network bridge device, traffic in the LAN increases.

When another communication terminal is connected to the connection port, if the same IP address is set to the terminal, the terminal automatically receives the MAC address in response to the inquiry. Is returned, so the connectivity of the communication terminal is easy, but it becomes possible for other communication terminals to perform the so-called "spoofing" of the previous communication terminal, which is a security measure. It was a problem.

The present invention has been made in view of the above circumstances.
When an inquiry request for an AC address is received, the server becomes a so-called ARP server and receives the inquiry request.
It is an object of the present invention to provide a network bridge device capable of reducing traffic in a LAN and taking security measures by returning an AC address.

[0014]

In order to achieve the above object, in the network bridge device according to the first aspect of the present invention, the MAC address and the IP address of the communication terminal are associated in advance for each connection port. And an address table registered with the IP address of the communication terminal designated by the IP address as a communication destination.
When an inquiry request for an AC address is received, the MAC address of the destination communication terminal is returned with reference to the address table.

In the network bridge device according to the second aspect, a request for a MAC address inquiry is issued to a communication terminal to which a MAC address is to be registered, by designating the IP address of the communication terminal from a corresponding connection port. Then, the MAC address returned in response to this is registered in the address table in association with the connection port and the IP address.

According to a third aspect of the present invention, at least one of the plurality of connection ports is connected to a communication terminal whose start time is designated, and the communication terminal is connected to the start time zone. , Which specifies the IP address of the communication terminal from the corresponding connection port.
A request for an AC address inquiry is made, and the MAC address returned in response to the request is automatically registered in the address table in association with the connection port and the IP address.

According to a fourth aspect of the present invention, there is provided a network bridge device, wherein a plurality of connection ports specify an IP address of each communication terminal at a predetermined time period.
Makes an address inquiry request, extracts the MAC address of the communication terminal returned in response to the request, compares it with the one registered in the address table, and outputs a predetermined warning when it is determined that the addresses do not match. Configuration.

[0018]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing an example of a main configuration of a network bridge device of the present invention.

This network bridge device 1 has an LA
N, a packet receiving unit 10 for receiving a packet from each communication terminal, a MAC address extracting unit 11 for extracting a destination MAC address from the received packet, an ARP detecting unit 12 for detecting an ARP from the aforementioned inquiry packet, and will be described later. A table storage means 13 for storing an address table, a corresponding MAC address extracting means 14 for extracting an inquired MAC address based on information in the address table, and a connection for transmitting a packet based on the information in the address table. Corresponding port extracting means 15 for extracting a port, and corresponding port extracting means 1
5 includes a packet transmitting unit 16 for transmitting a packet to the connection port extracted by the communication unit 5 and a packet returning unit 17 for returning the MAC address extracted by the corresponding MAC address extracting unit to the communication terminal inquiring.

According to such a configuration, when a packet is received from the communication terminal, the processing shown in the flowchart of FIG. 2 is performed. In the figure, T indicates an address table, in which the MAC address and the IP address of the communication terminal are registered in association with each other in advance for each connection port.

When the network bridge device 1 receives a packet (100), the MAC address extracting means 11 extracts a destination MAC address from the received packet (101).

At this time, if the destination MAC address of the received packet is defined as “FFFFFFFFFFFF”, this packet is broadcast,
The ARP detection means 12 checks the bits in the packet to determine whether the packet is a request for the destination MAC address (103). Is extracted by the corresponding MAC address extracting means 14 and returned to the source of the packet (104).

On the other hand, if the received packet is a broadcast and is not an inquiry request (103), the received packet is transmitted from all connection ports (105).

If the destination MAC address of the received packet is not specified as “FFFFFFFFFFFF”, this packet is not a broadcast, and therefore, referring to the address table T (106), the destination M
The connection port corresponding to the AC address is extracted by the corresponding port extraction means 15, and a received packet is transmitted from the extracted connection port (107).

FIG. 3 is a diagram showing another example of the main configuration of the network bridge device of the present invention. In this network bridge device 1A, the packet receiving means 10, MAC
In addition to the address extracting means 11, the table storing means 13, the corresponding port detecting means 15, the packet transmitting means 16, and the packet returning means 17 (all described above), a table updating means 18 for updating the registered contents of the address table,
ARP issuing means 19 for requesting an address inquiry
A timing management unit 20 for managing a time at which an inquiry request is made by the ARP issuing unit 19; a timing setting unit 21 for setting a time at which an inquiry request is made; a reply ARP detection unit 22 for detecting a response to the inquiry request; Input port detecting means 23 for detecting a connection port responding to the request.

In the timing management means 20, a time at which the MAC address of the communication terminal on the port is inquired is set for each connection port. For example, as such a time, the activation time zone of the communication terminal is set. Is set.

The timing management means 20 manages the set time for each connection port.
The issuing unit 19 outputs an inquiry command for inquiring the MAC address of the communication terminal on the corresponding connection port.

Then, the connection port to be output is extracted by the corresponding port extraction means 15, an inquiry command is output from the connection port by the packet transmission means 16, and the ARP response means of the communication terminal receiving the command outputs the inquiry command. Since the MAC address of the communication terminal is returned, the network bridge device 1 receives the MAC address by the packet receiving unit 10, and further detects the connection port that received the packet by the input port detecting unit 20.

Since the inquiry response has been received, the reply ARP detecting means 22 naturally detects this,
The MAC address is extracted by the MAC address extracting unit 11, and the extracted MAC address is registered in the address table T as the MAC address corresponding to the connection port detected by the input port detecting unit 20 by the table updating unit 18.

FIG. 4 is a diagram showing another example of the main configuration of the network bridge device of the present invention. In this network bridge device 1B, the packet receiving means 10, MAC
Address extraction means 11, table storage means 13, corresponding port detection means 15, packet transmission means 16, packet reply means 17, ARP issuing means 19, timing management means 20, timing setting means 21, reply ARP detection means 22, input port In addition to the detection means 23 (both described above), there are provided an address comparison means 24 for performing MAC address comparison and collation to be described later, and a warning issuing means 25 for outputting a predetermined warning to be described later.

The timing management means 20 manages the time period for inquiring the MAC address for each connection port, and for each time period, the MA on the corresponding connection port
The C address is queried, the MAC address returned is extracted, and the address comparison unit 24 compares and compares the MAC address with the one registered in the address table T.
As a result of the comparison and collation, if it is determined that they do not match, the warning issuing unit 25 transmits a predetermined warning, for example, a warning mail specifying a predetermined mail address of the administrator.

[0032]

As can be understood from the above description, in the network bridge device according to the first aspect of the present invention, a communication terminal having an IP address specified as a communication destination from a communication terminal of a partner. When the MAC address inquiry request is received, the MAC address of the communication terminal as the destination is returned with reference to the address table, so that a so-called ARP server returns the MAC address for which the inquiry request was received. It is possible,
The traffic in the LAN can be reduced and security measures can be taken.

In the network bridge device according to the second aspect, a request for MAC address inquiry is issued to a communication terminal to which a MAC address is to be registered, by designating the IP address of the communication terminal from a corresponding connection port. Then, the MAC address returned in response to this is registered in the address table in correspondence with the connection port and the IP address, so that even the IP address of the communication terminal can be registered in correspondence with the connection port. If you do, you can automatically register the MAC address of the communication terminal,
It is convenient.

In the network bridge device according to the third aspect, the IP address of the communication terminal is designated from the corresponding connection port in the activation time zone of the communication terminal.
A request for an AC address inquiry is made, and the MAC address returned in response to the request is automatically registered in the address table in association with the connection port and the IP address. If the power of the bridge device is turned on, the MAC address of the communication terminal is automatically registered, thereby relieving the complexity of the registration operation.

According to the network bridge device of the present invention, an inquiry request for the MAC address of the communication terminal is made at a predetermined time period, and the MAC address of the communication terminal returned in response to the request is extracted. Then, when it is determined that there is no match, a predetermined warning is output.Therefore, at a predetermined time period, it is possible to check whether an unauthorized communication terminal is connected, If the communication terminal is determined to be an appropriate communication terminal, a predetermined warning is output, so that an administrator or the like can confirm that fact and take an appropriate measure.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an example of a main configuration of a network bridge device according to the present invention.

FIG. 2 is a flowchart illustrating an example of an operation of the network bridge device.

FIG. 3 is a diagram showing another example of a main configuration of the network bridge device of the present invention.

FIG. 4 is a diagram showing still another example of the main configuration of the network bridge device of the present invention.

FIG. 5 is a diagram showing setting contents of packet input / output in a conventional network bridge device.

FIG. 6 is a flowchart for explaining the operation of a conventional network bridge device.

[Explanation of symbols]

 1: Network bridge device T: Address table

Continued on the front page (72) Inventor Koji Hoshi 1048 Odakadoma, Kadoma-shi, Osaka Matsushita Electric Works F-term (reference) 5K033 AA03 AA08 CB09 CC01 DA01 DB18 EC03

Claims (4)

[Claims] 1. A network bridge device having a plurality of connection ports for connecting a communication terminal, wherein a MAC address of the communication terminal and an I
It has an address table in which P addresses are registered in association with each other in advance, and when receiving a request for inquiry of the MAC address of a communication terminal whose IP address is specified as a communication destination from a destination communication terminal, A network bridge device configured to refer to the address table and return a MAC address of a destination communication terminal. 2. A communication terminal in which a MAC address is to be registered, wherein a request for MAC address inquiry is made from a corresponding connection port by designating the IP address of the communication terminal. A network bridge device configured to register a MAC address returned to the address table in association with the connection port and the IP address thereof. 3. The communication terminal according to claim 2, wherein at least one of the plurality of connection ports is connected to a communication terminal device having a specified start time. From the connection port, a request for an inquiry of the MAC address, which specifies the IP address of the communication terminal, is made.
A network bridge device configured to automatically register an AC address in the address table in association with the connection port and the IP address. 4. A request according to any one of claims 1 to 3, wherein, at a predetermined time period, an inquiry request for a MAC address, which designates an IP address of each communication terminal, is made from said plurality of connection ports, A network bridge configured to extract the MAC address of the communication terminal returned thereto, compare and collate the MAC address with the one registered in the address table, and output a predetermined warning when it is determined that the MAC address does not match. apparatus.