KR100478910B1 - IP collision detection/ Interseption method thereof - Google Patents

Abstract

The present invention interrupts and analyzes each ARP packet that occurs when IP communication is started through the network, and then lists and logs each IP collision address to notify the administrator to facilitate IP management. (a ddress R esolution P rotocol) using the IP (IP) conflict detection and prevention system and relates to its method.

The present invention monitors network traffic packets, monitors the collision of each packet each time an ARP packet is collected on the network, informs the administrator of the status, and determines whether access is permitted by determining whether access is allowed. Blocks using MAC.

Description

IP collision detection / interseption method

The present invention interrupts and analyzes each ARP packet generated when IP communication begins to occur through a network, and then lists and logs each IP conflict address and notifies an administrator to the IP. In order to facilitate management, more specifically, it monitors network traffic packets, monitors the collision of each packet whenever an ARP packet is collected on the network, informs the administrator of the status, and checks whether access is allowed. judged by using ARP (a ddress R esolution P rotocol) which to perform block the network access of the host to the MAC center using ARP, IP (IP) relates to a collision detection and prevention system and method.

In general, ARP is used as follows.

1. The sender is a host and wants to send a packet to another host on the same network. In this case, the logical address that must be translated into the physical address is the destination IP address in the datagram header.

2. The sender is a host and wants to send a packet to another host on another network. In this case, the host looks up the routing table to find the IP address of the next hop (router) for the destination. If there is no routing table, find the IP of the default router. The router's IP address becomes the logical address that needs to be translated into a physical address.

3. The sender is a router that receives datagrams destined for a host on another network. This router looks up the routing table to find the IP address of the next hop router. The IP address of the next router is a logical address that will be translated into a physical address.

4. The sender is a router that receives a datagram destined for a host on the same network. The destination IP of the datagram becomes the logical address that needs to be translated into a physical address.

Looking at the operation of ARP, the sender knows the target IP address. How the sender obtains this address is as follows.

1. Request IP to generate ARP request message. In this request message, the sender's physical address, IP address, and target IP address are filled in, but the target's physical address (MAC address) field is filled with zeros.

2. This message is delivered to the data link layer, where it is encapsulated by a frame with the sender's physical address as the source address and the physical broadcast address as the destination address.

3. Every host or router receives this frame, and the frame has a broadcast destination address, so every station forwards this message to its ARP.

4. The target system sends back an ARP message containing its physical address, which is unicast.

5. The sender receives the response message and knows the physical address of the target.

6. The IP datagram containing the data to be sent to the target is encapsulated in a frame and unicast to the destination.

The reality is that new hosts (such as the addition of new PCs / laptops / external users / network equipment) that are unknown to the administrator are always connected and used on the network. Therefore, the administrator should be able to identify the additional facts of these network devices and the IP addresses being used without permission or to control access. If you can do this, administrators will probably be able to easily manage network resources.

Therefore, the IP network manager needs to efficiently manage IP address resources for each user (host) of the network, but conventionally, it is known to which host an IP address currently being used is assigned and used. At this time, it is necessary to manage whether the IP assigned by the administrator and the host are the same as the one actually used. However, since the IP address can be changed arbitrarily in a real environment, the current management is ineffective. It is true.

Various methods have been proposed to manage and control these IPs, but specific methods have not been put into practical use.

The conventional method of detecting IP conflicts is that if a user encounters a conflict while someone is using the IP, the parties can immediately see the conflict message generated by the host system. However, there is no way for the network administrator to verify that, and in this situation, there is no way for the user to know which IP should be used without conflict. There is no way for the manager to know until the conflicting party talks to the manager.

Impure users who want to access the network and eavesdrop on network information cannot predict when and how to access the network, and there is no special way to identify this situation.

This difficulty causes the manager to lack management, and there is a problem in that IP management is not absolutely helped. And, it is absolutely necessary to collect data for performing IP management for each user, but this also has a problem that has not been achieved.

In order to solve these problems, the present invention analyzes ARP packets to monitor IP users in real time, monitor collisions, and perform access control so that network administrators can easily manage IP. The present invention relates to a system and method for managing an IP packet by interrupting and analyzing each ARP packet when an ARP packet is transmitted through a network, listing each IP address, monitoring an IP collision, and notifying an administrator. The present invention provides an IP collision detection and blocking system and method for monitoring and blocking illegal host access to the network.

As a means for achieving the above object, the IP collision detection and blocking system of the present invention includes a communication interface module that provides a communication interface and provides a kernel to control communication so that the collision IP detection system can share information with other hosts; Communication kernel modules;

A network interface driver module which transmits a packet over a network in association with a physical device which is a network interface and a higher communication module, and transmits a packet received on the network to a higher communication module;

A network interface module connected to a connection device on a network;

A packet capture driver module that collects all packets delivered on the network;

An ARP packet filtering module for filtering only ARP packets among packets collected by the packet capture driver module;

A collision IP determination module that determines whether the collected packet is a collision IP packet and delivers the result to a module listing the result if it is determined that the packet is a collision IP;

An access blocking determination module for notifying access when the ARP request packet is included in the access blocking policy list;

An access blocking module that blocks network access by transmitting an ARP response packet to a packet determined to be blocked by the access blocking determination module;

An information storage module for storing configuration information for operating the collision IP detection system, a detected collision IP list, a newly discovered host IP address and MAC address list information;

A search list logging and storage module for internally listing the detected collision IP information and periodically storing the contents of the detected collision IP information in a storage medium; And

A detection result notification module for transmitting the detected collision IP information to another system and informing the administrator of the fact;

When ARP packets are collected on the network, each ARP packet is checked and divided into request packet and response packet. Then, if a new request packet is added to the list, and if it is a response packet and exists in the input request ARP packet list, the collision is confirmed. At the same time it is characterized by blocking the access of the ARP packet.

According to the above configuration, the present invention is configured as a single system can perform the above functions in the way of the IP network stage, as a result can provide the operational convenience of the administrator, can be provided at a low price However, the burden on installation can be reduced to a minimum.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a collision IP detection and blocking system according to an embodiment of the present invention. As shown in FIG. 1, the collision IP detection and blocking system according to an exemplary embodiment of the present invention includes a processor module 41, an information storage module 42, a detection result notification module 43, and an access blocking determination module ( 44), access blocking module 45, search list logging and storage module 46, IP collision determination module 47, ARP packet filtering module 48, packet capture driver module 49, communication interface module and communication kernel Module 50, network interface driver module 51, and network interface module 52.

The processor module 41 refers to a module that provides a user interface for operating the system as an internal processor module of the IP collision detection system.

The information storage module 42 stores configuration information for operating the IP collision detection system, IP address and MAC address of the detected IP collision, and is basically operated as a memory, and the program is terminated. In a non-volatile storage space for later reuse.

The detection result notification module 43 refers to a module that transmits the detected IP collision information to another system, or informs the administrator by a method such as sound, flickering, or simple message transmission.

The access blocking determination module 44 determines whether the network can be accessed or not for the searched hosts and the newly emerging hosts, and performs access control. The information to be used by the module is information storage. Decisions are made based on the information gathered in module 42 and the policy information created to apply the block.

The access blocking module 45 transmits a unicast or broadcast ARP response packet to the corresponding host according to the determination of the access blocking determining module 44 to cause a collision or to transmit using a second MAC. Change the ARP table MAC address. As a result, the host attempting to connect can perform blocking by preventing the connection.

The search list logging and storage module 46 internally lists the detected IP collision information and periodically stores the contents in another storage medium.

The IP collision determination module 47 determines whether the collected ARP packets are IP collision packets. If the collected ARP packets are determined to be IP collision packets, the IP collision determination module 47 determines whether the collected ARP packets are IP collision packets. Transfer to storage module 46 to be stored.

The ARP packet filtering module 48 does not process all collected packets, but uses only ARP packets. Therefore, all non-packets are discarded. Then, all ARP packets are transmitted to the information storage module 42.

The packet capture driver module 49 collects all packets transmitted on the network and delivers them to the ARP packet filtering module 48. The filtering module 48 filters only the ARP packets among the collected packets and stores the information storage module ( 42).

The communication interface module and the communication kernel module 50 provide a kernel for controlling communication when the IP collision detection and blocking system provides a communication interface for exchanging information with another host. .

The network interface driver module 51 transmits a packet over a network in association with a physical device which is a network interface and a higher communication module, and delivers a packet received on the network to a higher communication module.

The network interface module 52 is a connector connected to a connection device on a network.

The present invention configured as described above, when operation information is input from the user through the internal processor module 41 of the IP (IP) collision detection system, the operation information, that is, the setting information and the conflict IP list to the information storage module 42 At the same time as the determination setting information is transmitted to the detection result notification module 43, the control information on whether to notify the detection system to other systems.

The information storage module 42 receives and stores the information for listing the information determined as the IP collision from the search list logging and storage module 46 and simultaneously notifies the detection result of the operation information transmitted from the processor module 41. When the module 43 requests the stored information, it sends the requested information.

The IP collision determination module 45 determines an IP collision by inputting the ARP packet filtered from the ARP packet filtering module 48. In addition, the access blocking determination module 44 determines whether or not to block the current incoming ARP packet based on the access blocking policy for the MAC address list for each IP that the information storage module 42 has. The ARP packet is then blocked by passing the information on.

In addition, the packet capture driver module 49 transfers all packets received from the network interface driver module 51 to the network to the ARP packet filtering module 48, and the network interface driver module 51 communicates with the communication interface module and the communication module. The upper packet down through the kernel module 50 and the lower packet up through the network interface module 51 are transmitted and received.

2 is a conceptual diagram showing the flow of ARP packets to detect IP collisions and perform access blocking. FIG. 2 illustrates how to collect ARP packets in a general IP network environment, how to detect IP collisions, and block access. It explains how.

Referring to FIG. 2, the IP collision detection and blocking method according to an embodiment of the present invention may capture and analyze all packets in an IP network environment in the packet capture driver module 49 as in step S61. All packets transmitted on the network are collected and transmitted to the ARP packet filtration module 48 so that only the ARP packets are collected from the collected packets and the information is transmitted to the information storage module 42.

In step S62, the IP collision is performed by searching for a host existing on the IP network using the ARP packet by performing filtering the ARP packet only through the ARP packet filtering module 48 among all the packets collected in step S61. Detect basic information and obtain basic information to perform blocking. The filtered packet is passed to the next step.

That is, in step S62, a packet for searching for a target physical address according to the ARP protocol is generated in order to determine the physical address (MAC) of the destination host when starting communication of the host in the internal segment among the user's packets, and filtering only the ARP packet at this time. As a result, IP collision determination information of the internal user host is used.

In step S63, a request packet is extracted from the ARP packets collected in step S62, that is, the ARP packet filtering module 48, and the IP address and MAC address of the requesting host are found, listed, and stored. do. This list detects IP conflicts and acts as the underlying database for access control.

In step S64, the IP collision determination module 47 detects the collision IP based on the ARP packet list filtered through the ARP packet filtering module 48. In the embodiment of the present invention, if the next ARP response message added to the list occurs more than three times within a given time (1 second to 2 seconds timeout), it is determined that a host having the same IP exists on the same network. do.

In step S65, access is blocked by the access blocking module 45 centering on the list made in step S63. A policy on access control is established for each host on the collected network to perform control on each host. Can be. If the policy for access control is to be made in a range of groups, it can be made in individual units.

That is, the access blocking module 45 transmits a unicast or broadcast ARP response packet to the corresponding host according to the determination of the access blocking determining module 44 to cause a collision or to transmit using a second MAC. Change the ARP table MAC address. As a result, the host attempting to connect can perform blocking by preventing the connection.

3 is a flowchart illustrating a method for detecting an IP collision according to an embodiment of the present invention.

Referring to FIG. 3, the present invention collects all packets passing through the IP collision detection system 40 through the packet capture drive module 49 (S71), where only ARP packets are filtered out of the collected packets. The operation of filtering in the module 48 is performed (S72), and the access blocking determination module 44 determines whether it is an ARP packet (S73).

In step S73, it is checked whether or not the collected ARP packet is discarded. At this time, all packets other than the ARP packet are discarded and the next packet is read. If the ARP packet is confirmed, it is checked whether the filtered ARP packet is an ARP request packet or an ARP response packet (S74). If the request is an ARP packet, the MAC address is found in the newly discovered ARP request packet for each IP and stored in the host list with time. If the IP already exists, the MAC and time are updated and stored. Then, the next packet is read (S75).

In contrast, if the filtered packet is an ARP packet and a response packet, the step S76 is performed. Step S76 is a step of processing an ARP response message. If a host generates a broadcast packet for an ARP request, the corresponding host generates a response ARP packet. This means that there is already a host using IP on the network.

The detection system of the present invention is designed to check whether the response ARP packet occurs more than three times within a given time based on this fact. Therefore, in this step, when an ARP response packet is generated, each IP has a response ARP packet generation counter and is incremented by one each time this packet is generated.

Step S77 is a step of judging an IP collision in the collision determination module 47, and it is determined whether the response ARP packet has occurred more than three times within a given time (for example, a timeout of 1 second to 2 seconds) for each IP. Check it. That is, if the response ARP counter is checked more than three times, it is determined that the IP has collided, and the IP determined as the collision and its additional information are additionally stored in the collision list (S78). If not, the response ARP counter for each IP (IP) is set to 0, and the next packet is read (S79).

4 is a flowchart illustrating a method for blocking access according to an embodiment of the present invention.

Referring to FIG. 4, the present invention collects all packets passing through the IP collision detection system 40 (S81), and performs filtering of only ARP packets among the collected packets (S82). It is determined whether the packet (S83).

That is, in step S83, it is checked whether or not the collected ARP packet is found. At this time, all the non-ARP packets are discarded and the next packet is read. If it is confirmed as an ARP packet, it is checked whether the ARP packet is a request ARP packet or a response ARP packet (S84).

As a result of the determination in step 84, if the collected ARP packet is the requested ARP packet, the IP or MAC address blocking policy list is searched with the ARP request packet (S85), and it is determined whether or not blocking is applied (S86).

As a result of the determination in step S86, if the ARP packet does not exist in the policy block list, the next packet is collected; conversely, if the ARP packet exists in the policy block list, after unicasting the ARP response packet to the IP host ( S87) Block the packet by broadcasting the response ARP packet (S88).

As described above, the present invention not only enables centralized IP address management for network administrators in IP network environment, but also enables powerful network access control, and enables rapid IP collision failure detection and Solution, and as a result, administrators can provide users with better quality of service.

1 is a block diagram of an IP collision detection and access blocking system according to an embodiment of the present invention.

2 is a flowchart illustrating a concept of an IP collision detection and blocking method according to an embodiment of the present invention.

3 is a flowchart illustrating an IP collision detection method according to an embodiment of the present invention.

4 is a flowchart illustrating an access blocking method according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

41; processor module 42; information storage module

43; detection result notification module 44; access blocking determination module

45; access blocking module 46; search list logging and storage module

47; IP collision determination module 48; ARP packet filtering module

49; packet capture driver module 50; communication interface and communication kernel module

51; network interface driver module

52; network interface module

Claims (3)

(Correction) a communication interface module and a communication kernel module providing a kernel for controlling communication and providing a communication interface so that the collision IP detection system can share information with other hosts; A network interface driver module which transmits a packet over a network in association with a physical device which is a network interface and a higher communication module, and transmits a packet received on the network to a higher communication module; A network interface module connected to a connection device on a network; A packet capture driver module that collects all packets delivered on the network; An ARP packet filtering module for filtering only ARP packets among packets collected by the packet capture driver module; A collision IP determination module that determines whether the collected packet is a collision IP packet and delivers the result to a module listing the result if it is determined that the packet is a collision IP; An access blocking determination module for notifying access when the ARP request packet is included in the access blocking policy list; An access blocking module that blocks network access by transmitting an ARP response packet to a packet determined to be blocked by the access blocking determination module; An information storage module for storing configuration information for operating the collision IP detection system, a detected collision IP list, a newly discovered host IP address and MAC address list information; A search list logging and storage module which internally lists the detected collision IP information and periodically stores the contents in the storage medium; And Including the detection result notification module for transmitting the detected collision IP (IP) information to another system, and informs the administrator of the fact, When ARP packets are collected on the network, each ARP packet is checked and divided into request packet and response packet. Then, if a new request packet is added to the list, and if it is a response packet and exists in the input request ARP packet list, the collision is confirmed. And at the same time blocking access to the ARP packet. (Correction) In detecting an IP collision through an IP collision detection and blocking system interposed between a client and a server, Collecting all packets that access through the network; Filtering only ARP packets among the collected packets; Determining whether the collected ARP packet is an ARP request packet or an ARP response packet; Adding the MAC address to the list for each IP address if the collected packet is an ARP request packet; Incrementing the count by one if the ARP packet is an ARP response packet; Determining whether the ARP response packet is equal to or greater than the set number of times within the timeout period for each IP, and determining that the ARP response packet is equal to or greater than the set number of times by the IP collision; And And resetting a counter for each IP when the ARP response packet is less than or equal to a predetermined number of times within the timeout period. delete