KR100958283B1 - apparatus having Dynamic Host Configuration Protocol - Snooping function - Google Patents

Abstract

The present invention relates to a device having a Dynamic Host Configuration Protocol (DHCP) snooping function, which uses DHCP snooping to provide information including a hardware address and an IP address of each host A snooping part to acquire; And a filtering unit for passing IP packets during a predetermined period and passing or discarding IP packets based on the information for the remaining period. According to the present invention, even if a daemon is restarted or a device is re-booted in a DHCP snooping device supporting IP source guard, a normal service can be performed without a temporary service failure.

DHCP snooping, IP source guard

Description

[0001] The present invention relates to a dynamic host configuration protocol (Snooping function)

Figure 1 illustrates a DHCP snooping binding table and rule table used for IP source guard execution.

FIG. 2 is a flowchart showing a packet processing process in which the DHCP snooping device is associated with an IP source guard. FIG.

FIG. 3 illustrates a process in which a normal IP user can not perform communication due to a restart of the DHCP snooping device.

4 is a block diagram illustrating a configuration of a DHCP snooping apparatus according to an embodiment of the present invention.

5 is a flowchart illustrating an operation of a DHCP snooping apparatus according to an exemplary embodiment of the present invention.

FIG. 6 is a diagram illustrating the operation of the DHCP snooping apparatus according to the present invention over time when a reboot of the DHCP snooping apparatus occurs. FIG.

The present invention relates to a DHCP snooping device, and more particularly, to a DHCP snooping device capable of performing normal service without a temporary service failure even when a DHCP snooping binding table is deleted due to a restart of a daemon, Snooping equipment.

BACKGROUND OF THE INVENTION [0002] Personal computers (PCs) around the world are connected to the Internet through network equipment including routers and switches. Basically, the Internet is based on a protocol combination called Transmission Control Protocol / Internet Protocol (hereinafter referred to as "TCP / IP"), so that a PC has a unique IP address There is a need. Ideally, all PCs have a fixed unique IP address, but IP address resources are limited, and manually entering their IP address on each PC is cumbersome, so most PCs use DHCP IP addresses are allocated dynamically. Therefore, a host such as a PC mounts a DHCP client program and is assigned an IP address from a network device that is equipped with a DHCP server program, and is used for a predetermined lease time.

Meanwhile, the DHCP snooping device in the network supports an IP source guard function for blocking abnormal IP users.

Figure 1 illustrates a DHCP snooping binding table and rule table used for IP source guard execution.

The DHCP snooping device manages the DHCP snooping binding table shown at the top of FIG. 1 for a user who has been normally assigned an IP address from the DHCP server. The DHCP snooping binding table stores the IP address, the hardware address (for example, MAC address in the case of Ethernet), and the lease time of each host to which an IP address is assigned from the DHCP server.

When the IP source guard is started, a rule (Drop Rule) for discarding all IP packets (meaning a data packet, not a control packet such as a DHCP packet) is created in the rule table for the corresponding port. Also, whenever a client's IP address and hardware address obtained through DHCP snooping are reflected in the DHCP snooping binding table, a rule permitting the reflected IP address and hardware address is generated in the rule table.

If the IP source guard is running and the DHCP snooping binding table is in the top state of FIG. 1, then the rules table may contain rules to allow IP addresses and hardware addresses corresponding to entries in the DHCP snooping binding table, Rules for discarding IP packets, and the like. In general, the former rules are set higher than the latter rules in terms of priority. The DHCP snooping device first compares the source IP address and the source hardware address of the received IP packet with the rule having the highest priority in the rule table, and then compares the source IP address and the source hardware address with the rule having the next priority To allow or discard IP packets.

1, if the source IP address and the source hardware address of the received IP packet are 10.10.10.2 and xx: xx: xx: xx: xx: bb, the IP packet is allowed, If the source IP address of the IP packet is 10.10.10.4, it is not matched to the rule of priority 6, and the IP packet is discarded because it is matched with the discard rule which is the next priority.

When the IP packet is filtered according to the rule table, the DHCP snooping device discards the IP packet by considering a host having no IP address and hardware address that does not exist in the DHCP snooping binding table as an abnormal IP user.

FIG. 2 is a flowchart showing a packet processing process in which the DHCP snooping device is associated with an IP source guard. FIG.

Referring to FIG. 2, when the IP packet is received, the DHCP snooping device determines whether the IP source guard function is set. If the IP source guard function is disabled, the DHCP snooping device passes the received IP packet. On the other hand, if the IP source guard function is enabled, it checks whether the source hardware address and source IP address of the received IP packet match the rules of the filtering rule table. Here, the matching process with the rule of the filtering rule table is performed in order of the rule having the highest priority. This process is a process of confirming whether a host that has transmitted an IP packet has been assigned an IP address from a DHCP server. As a result of checking, if the discard rule is matched, the received IP packet is dropped, and if the acceptance rule is matched, the received IP packet is passed. The passed IP packet is forwarded to the next IP node (e.g., server, router, host, etc.).

Meanwhile, when the DHCP snooping device is restarted while a normal service is being provided, the DHCP snooping binding table is erased as described later with reference to FIG. 3, and the service is not updated until a normal IP user receives the IP address again. It may be disconnected.

FIG. 3 illustrates a process in which a normal IP user can not perform communication due to a restart of the DHCP snooping device.

Referring to FIG. 3, when a client broadcasts a DHCP discovery packet to receive an IP address, a DHCP offer packet including an IP address and a lease time to be allocated by the DHCP server, Lt; / RTI > The client receiving the DHCP-provided packet broadcasts a DHCP request packet to use the IP address. Upon receipt of the DHCP request, the DHCP server records the hardware address of the client, the assigned IP address, the lease time, and the user ID in the DHCP lease DB, and then issues a DHCP acknowledgment ACK ) Packet to the client.

In this process, the DHCP snooping device snoops DHCP packets (DHCP discovery packet, DHCP discovery packet, DHCP request packet, and DHCP consent packet) transmitted and received between the client and the server and transmits the IP address , A hardware address, and the like in the DHCP snooping binding table, and then records in the above-described rule table.

In the meantime, if the DHCP snooping device is rebooted, all entries in the DHCP snooping binding table and rules table will be lost. Also, when the equipment is rebooted, the IP source guard function starts again and a rule table is created. Since all the entries in the previous DHCP snooping binding table have been lost due to the equipment restart, only the revocation rules in which all IP packets are discarded are present in the filtering rule table generated after rebooting.

Therefore, when the DHCP snooping device receives the IP packet and performs packet filtering according to the IP source guard function after the restart, the IP address and the IP address transmitted from the client having the hardware address registered in the DHCP snooping binding table before the restart Even packets are discarded.

3, after the IP packet is discarded, the client transmits a DHCP request packet to the DHCP server for extending the use of the IP address, and the DHCP server transmits a DHCP acknowledgment packet to the client, which allows extension of the use of the IP address . In this process, the DHCP snooping device snoops the DHCP request packet and the DHCP acknowledgment packet transmitted and received between the client and the server, registers the IP address and the hardware address of the client in the DHCP snooping binding table, and reflects the IP address and the hardware address in the rule table. The IP packet transmitted from the client is then passed by the reflected rule table.

Therefore, when the DHCP snooping binding table or the like is deleted due to re-start or daemon restart, the IP packet transmitted from the client can not be normally transmitted during the period until the IP address reassignment of the client is performed. That is, even a normal IP user can not receive service temporarily due to rebooting of the DHCP snooping device using IP source guard.

Therefore, even if the DHCP snooping binding table and the rule table are deleted due to the restart of the daemons and the restart of the device in the DHCP snooping equipment supporting IP source guard, it is required to provide a normal service without temporary service failure.

An object of the present invention is to provide a device having a DHCP snooping function that ensures normal service without a temporary service failure even if a restart or daemon restart occurs.

According to an aspect of the present invention, there is provided a method of controlling a network device including a snooping unit for obtaining information including a hardware address and an IP address of each host through DHCP snooping; And a filtering unit for passing an IP packet for a predetermined period of time and for passing or discarding an IP packet based on the information for the remaining period of time.

According to a second aspect of the present invention, there is provided a method for managing a DHCP snooping binding table through DHCP snooping, And a filtering rule generator for generating a filtering rule table for packet filtering based on the DHCP snooping binding table after a predetermined period of time elapses.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In describing the present embodiment, the same designations and the same reference numerals are used for the same components, and additional description thereof will be omitted in the following.

4 is a block diagram illustrating a configuration of a DHCP snooping apparatus according to an embodiment of the present invention. 4, the DHCP server includes a snooping unit 400, a DHCP snooping binding table 402, a rule table 404, a filtering unit 410, and a forwarding unit 420. 4 is a diagram illustrating a configuration of a DHCP snooping apparatus in order to explain the concept of the present invention. It is possible to add other modules or modify the structure of the DHCP snooping apparatus according to an implementation, Is not limited to the example shown in Fig. 4, but it is understood that the person skilled in the art can understand it.

Here, the DHCP snooping device refers to a device having a DHCP snooping function. Examples of the DHCP snooping device include a multi-layer switch (L2, L3, L4, L7) A set-top box, a residential gateway, and a wireless access point (PoA), but it is not necessarily limited thereto as long as it has a DHCP snoop function.

The snooping unit 400 obtains information including a hardware address and an IP address of each host through DHCP snooping and records the information in the DHCP snooping binding table 402. If the IP source guard is being executed, To the rule table 404, as shown in FIG. As a result, the rule table 404 includes a drop rule for the port and an IP address and a permission rule for the hardware address reflected in the DHCP snooping binding table 402.

The filtering unit 410 that performs packet verification passes IP packets during a predetermined period (hereinafter, grace period), and passes or discards IP packets based on the filtering rule table 404 during the remaining period. Preferably, the grace period includes a period from a time point at which all entries of the DHCP snooping binding table 402 and the rule table 404 are deleted due to re-start, daemon restart, etc. until a predetermined time elapses. An example of the predetermined time may be a half or more of the DHCP lease time to ensure that a DHCP request packet for extending the use of the IP address is received.

Preferably, the snooping unit 400 generates a rules table 404 based on the DHCP snooping binding table 402 immediately after the grace period has elapsed. That is, even if the DHCP snooping binding table 402 disappears due to a reboot, the DHCP snooping device allows all IP packets to pass through temporarily (i.e., during a grace period) to enable normal service, and during that time, the DHCP snooping binding table 402 are added. Next, after the grace period (after the grace period), the IP source guard is executed to generate the rule table 404, and then the access of the abnormal IP user can be blocked.

The forwarding unit 420 performs forwarding of the IP packet passed by the filtering unit 410.

5 is a flowchart illustrating an operation of a DHCP snooping apparatus according to an exemplary embodiment of the present invention. Referring to FIG. 4, the embodiment of FIG. 5 will be described as follows.

When the IP packet is received (S500), the filtering unit 410 determines whether the IP source guard blocking function is activated (S510).

If the IP source guard blocking function is disabled (S510), the filtering unit 410 passes the received IP packet without packet verification (S550). As a result, the passed IP packet is forwarded by the forwarding unit 420.

If the IP source guard blocking function is activated (S510), the filtering unit 410 determines whether the reception time of the IP packet is within the grace period (S520). If it is within the grace period (S520), the filtering unit 410 passes the received IP packet without packet verification (S550), and packet forwarding is similarly performed. Therefore, normal IP user communication is ensured even during the grace period.

If it is out of the grace period (S520), the flow goes to step S530 to perform the packet verification process. If the entry of the rule table 404 matching the source hardware address and the source IP address of the received IP packet indicates permission (S530), the filtering unit 412 passes the received IP packet (S550) Is performed.

If the entry of the rule table 404 matching the source hardware address and the source IP address of the received IP packet indicates discarding (S530), the filtering unit 412 discards the received IP packet (S540). As a result, packet forwarding is not performed, and communication of abnormal IP users is blocked.

FIG. 6 is a diagram illustrating the operation of the DHCP snooping apparatus according to the present invention over time when a reboot of the DHCP snooping apparatus occurs. FIG.

In FIG. 6, the information of the host to which the IP address contained in the DHCP snooping binding table and the filtering rule table are all deleted due to the rebooting of the DHCP snooping equipment. At this time, since the IP packet is transmitted from the client and the reception time is within the grace period, the packet is passed without packet verification and packet forwarding is performed. That is, since the IP source guard is not executed during the grace period, unlike FIG. 3, all IP packets are passed and the service is guaranteed.

Also, during the grace period, each host sends a DHCP request packet to extend the use of the IP address to the DHCP server, and as a result, the DHCP server transmits a DHCP accept packet allowing the extension of the use of the IP address. In this process, the DHCP snooping device snoops the DHCP packet and reflects it in the DHCP snooping binding table.

At the end of the grace period, the DHCP snooping device starts to execute the IP source guard to create the rules table. As a result, this rule table includes rules for allowing the IP address and the hardware address of the DHCP snooping binding table reflected during the above-mentioned discard rule and the grace period.

After the grace period, the DHCP snooping device performs packet filtering based on the generated rule table according to the IP source guard. As a result, after the grace period, unauthorized IP access is blocked.

The present invention can also be implemented as a machine readable code on a machine readable recording medium such as a computer. Here, an example of the machine is an apparatus capable of performing 2-layer switching. A machine readable recording medium includes all kinds of recording apparatuses in which data that can be read by a machine is stored. Examples of the recording medium on which the machine can read are ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, etc., and also implemented in the form of a carrier wave (for example, transmission over the Internet) . In addition, the machine-readable recording medium may be distributed over networked machine systems so that machine readable code in a distributed manner can be stored and executed. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers of the technical field to which the present invention belongs.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. I will understand that. Accordingly, the true scope of the present invention should be determined by the appended claims.

According to the present invention, even when the daemon is restarted and the equipment is restarted in the DHCP snooping device supporting IP source guard, normal service is possible without temporary service failure.

Claims (7)

delete A snooping unit for obtaining information including a hardware address and an IP address of each host through DHCP snooping; And Wherein the packet verification is performed for a predetermined period when an event occurs in which the IP packet is passed or discarded by performing packet verification based on the information obtained in the snooping unit, And a filtering unit for passing the IP packet without the DHCP snooping function. 3. The method of claim 2, wherein the predetermined time is Wherein the DHCP lease time is at least half of the DHCP lease time. 3. The method of claim 2, The information is included in the DHCP snooping binding table, Wherein the filtering unit performs filtering according to a rule table generated based on the DHCP snooping binding table. 3. The method of claim 2, Further comprising a forwarding unit for forwarding the passed IP packet. delete delete

Images