KR101018029B1 - Mothod block and release for communication among network equipment - Google Patents

Abstract

PURPOSE: A method for blocking or releasing communication between network devices is provided to safely block or release a specific host device. CONSTITUTION: A host controlling device transmits a first packet to a plurality of host device(S220). The host controlling device generates a plurality of different packets to correspond a MAC(Medium Access Control) of the host controlling device to an IP address of residual host device except a blocking host device in a ARP(Address Resolution Protocol) table of the blocking host device(S130,S150,S170). The host controlling device transmits a plurality of second packets to the blocking host device(S140,S160,S180).

Description

How to block and release communication between network devices {MOTHOD BLOCK AND RELEASE FOR COMMUNICATION AMONG NETWORK EQUIPMENT}

The present invention relates to a method for blocking and releasing communication between network devices, and more particularly, to a method for safely blocking and releasing communication of a specific host device connected to a network.

In a conventional network environment, when there is a specific host device to be blocked among a plurality of host devices, the MAC (Medium Access Control, MAC) address of the host device to be blocked (hereinafter referred to as "blocking host device") is set to the MAC of the probe device. The host device was blocked by changing the address (Probe MAC).

However, after the blocking host device is isolated, there is a problem in that the blocking is released in the process of communicating between other host devices. For example, if the operating system (OS) of the blocking host device is Vista or Windows 7, the blocking host device periodically sends its MAC address to the communicating host device after it is isolated. Attempts to communicate by cast, which causes the problem of unblocking.

The technical problem to be achieved by the present invention relates to a method for blocking and releasing communication between network devices for safely blocking and releasing specific host devices.

According to an embodiment of the present disclosure, a method of blocking communication of a blocking host device in a host control device controlling a plurality of host devices is provided. The communication blocking method may include a medium access control (MAP) address of the host control device corresponding to an IP address of the blocking host device in an address resolution protocol (ARP) table of the plurality of host devices. Generating a first packet, forwarding the first packet to the plurality of host devices, MAC of the host control device at an IP address of each of the remaining host devices except the blocked host device in an ARP table of the blocked host device; Generating a plurality of different second packets for the address to correspond to, and forwarding the plurality of second packets to the blocking host device.

According to another embodiment of the present invention, a method of blocking communication in a blocking host device among a plurality of host devices is provided. The communication blocking method may include a MAC (Medium) of the host control device in an IP (Internet Protocol) address of each of the host devices other than the blocked host device among the plurality of host devices from the host control device controlling the plurality of host devices. Receiving a plurality of unicast packets to match the Access Control (Access Control) address, and the host control the MAC address of the remaining host device corresponding to the IP address of each of the remaining host device in the Address Resolution Protocol (ARP) table Updating to the MAC address of the device.

According to another embodiment of the present invention, a method for releasing a blocking of a blocked first host device in a host control device controlling a plurality of host devices is provided. The unblocking method may include a medium access control (MAC) address of the host control device mapped to an Internet Protocol (IP) address of the first host device in an address resolution protocol (ARP) table of the plurality of host devices. Generating a broadcast packet for updating to a MAC address of a host device, forwarding the broadcast packet to the plurality of host devices, and among the plurality of host devices in the ARP table of the first host device. Generating a plurality of unicast packets for updating the MAC address of the host control device mapped to the IP address of each of the remaining host devices except the first host device to the MAC address of the remaining host device, and the plurality of Forwarding the unicast packet to the first host equipment.

According to another embodiment of the present invention, a method of releasing a block from a blocked first host device among a plurality of host devices is provided. The blocking release method may further include an IP of each of the remaining host devices except the first host device among the plurality of host devices in an address resolution protocol (ARP) table of the first host device from a host control device controlling the plurality of host devices. Receiving a plurality of unicast packets for updating the MAC address of the host control device mapped to an Internet Protocol (MAC) address to a medium access control (MAC) address of the remaining host device, and in the ARP table, Updating the MAC address of the host control device mapped to the IP address of each of the remaining host devices with the MAC address of the remaining host device, respectively.

According to an embodiment of the present invention, a broadcast packet for generating a MAC address of a host control device to correspond to an IP address of a specific blocking host device to be blocked in a network environment is generated and delivered to a plurality of host devices, and at the same time, the blocking host device As the unicast packet is generated and transmitted to the blocking host device to match the MAC address of the host control device to the IP address of the remaining host device stored in the ARP table of the host device, regardless of the operating system (OS) of the blocking host device It can reliably block and prevent the blocking host device from communicating with the rest of the host device even after blocking.

1 is a diagram illustrating an example of a network environment according to an exemplary embodiment of the present invention.
2 is a diagram illustrating an example of an ARP packet according to an embodiment of the present invention.
3 is a block diagram schematically illustrating an internal configuration of a host control apparatus according to an exemplary embodiment of the present invention.
4 is a diagram illustrating a sequence of isolating blocked host equipment in a network environment according to an exemplary embodiment of the present invention.
FIG. 5 is a diagram illustrating a procedure of releasing an isolated blocking host device in a network environment according to an exemplary embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

1 is a diagram illustrating an example of a network environment according to an exemplary embodiment of the present invention.

1, the host control system 10 of the network environment according to an embodiment of the present invention includes a switch 100, a plurality of host devices (200 ₁ -200 _N) and the host controller 300 do.

The switch 100 is connected to the Internet or other network via a gateway (not shown).

A plurality of host devices (200 ₁ -200 _N) are connected at the same level on the attached local area network via the switch 100, and performs a host controller 300 and the ARP (Address Resolution Protocol) communications. A plurality of host devices (200 ₁ -200 _N) are provided with a respective ARP table, the operating system (OS) roneun e.g. Windows XP (XP window), Vista (vista) and Windows 7 (window 7), etc. can be used have. Table 1 shows an example of an IP (Internet Protocol, IP) address and a MAC (Medium Access Control, MAC) address for each of the plurality of host devices 200 ₁ -200 _N.

Host controller 300, for example, a probe (probe) may be a device, a plurality of host devices to perform communication with ARP plurality of host devices (200 ₁ -200 _N) policy is set on the network (200 ₁ - 200 _N ). When the host device to be blocked (hereinafter, referred to as "blocking host device") exists, the host control device 300 isolates the blocking host device from communication between the blocking host device and the remaining host device.

The host control system 10 according to an exemplary embodiment of the present invention is connected to a local area network (LAN). As such, communication between resources connected to a specific network such as a LAN is performed using ARP. ARP is a protocol used to map network layer addresses (eg, protocol layer (L3) addresses) to physical addresses (eg, datalink layer (L2) addresses). Here, the physical address means an Ethernet or 48 bit (Bits) network card address of the token ring. The ARP packet is contained in a portion of the Ethernet packet data, where the header of the Ethernet packet includes a destination Ethernet address (48 bits), a sender Ethernet address (48 bits), and an Ethernet protocol type (16 bits). This Ethernet packet header is followed by an ARP packet, which is sent to the destination Ethernet address (eg, MAC address) when the packet moves on the LAN.

For example, if Host A wants to send an IP packet to Host B, and Host A does not know Host B's MAC address, Host A uses the ARP protocol to determine the destination Host B's IP address and broadcasting physical address. Transmit the containing ARP request packet on the network. Host B responds to Host A with its physical network layer address when it receives an ARP packet whose IP address is recorded as the destination. The IP address collected in this manner and the corresponding physical network layer address information are stored in a table, ie, an ARP table, in a memory called an ARP cache of each host, and then used again in subsequent packet transmissions.

2 is a diagram illustrating an example of an ARP packet according to an embodiment of the present invention.

As shown in FIG. 2, an ARP packet 500 according to an embodiment of the present invention is represented in the form of an Ethernet header 510 and an ARP header 520. Ethernet header 510 includes fields indicating recipient MAC address 511 and sender MAC address 512, and ARP header 520 includes ARP packet type 521, sender MAC address / destination IP address 522. ) And a target MAC address / target IP address 523. Here, the receiver MAC address 511 of the Ethernet header 510 means the MAC address of the device receiving the packet, and the sender MAC address 512 means the MAC address of the device transmitting the packet.

The ARP packet type 521 of the ARP header 520 indicates whether the packet is a request or a reply. Here, the request means a packet requesting a response from the device receiving the packet, and the reply means a packet not requesting a response from the device receiving the packet.

The sender MAC address / processing target IP address 522 represents information to be changed, that is, the processing target MAC address / IP address, and the target MAC address / target IP address 523 represents information of a device receiving a packet.

3 is a block diagram schematically illustrating an internal configuration of a host control apparatus according to an exemplary embodiment of the present invention.

1 and 3, the host control apparatus 300 according to an exemplary embodiment of the present invention includes a blocking target detector 310, a packet controller 320, and a packet transmitter 330.

Block target detection unit 310 detects the blocking device to block the host of the plurality of host devices (200 ₁ -200 _N) included in the network. The blocking target detection unit 310 transmits information of the blocking host device, for example, a MAC address / IP address, to the packet controller 320.

When the information on the blocking host device is received, the packet control unit 320 broadcasts a broadcast packet to allow the MAC address (PB_MAC) of the host control device 300 to correspond to the IP address of the blocking host device instead of the MAC address of the blocking host device. Create The packet controller 320 transmits a broadcast packet to a plurality of host devices (200 ₁ -200 _N) via a packet transmission unit 330. The broadcast packet at this time may be configured in the form shown in Table 2.

Table 2 shows one type of broadcast packet used when blocking communication. In Table 2, it is assumed that the blocking host equipment is the host equipment 200 ₁ .

In other words, a broadcast packet transmitted by a plurality of host devices (200 ₁ -200 _N) has the form of BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / 0.0.0.0]. At this time, FF means that the plurality of host devices (200 ₁ -200 _N) that the recipient is present in the network.

A plurality of host devices (200 ₁ -200 _N) are broadcast in each block host device analyzes the packet IP multicast address and a MAC address detection (PB_MAC) of the host controller 300, the blocking device from the host IP ARP table The MAC address (PB_MAC) corresponds to the address.

At the same time, the packet controller 320 is the MAC address (PB_MAC) of the host control device 300, not the MAC address of each of the remaining host devices except for the blocked host device stored in the ARP table of the blocked host device. Generates a unicast packet for matching.

The packet controller 320 transmits the unicast packet to the blocking host device through the packet transmitter 330. That is, the packet controller 320 may generate different unicast packets as much as the number of remaining host devices and deliver them to the blocking host device. At this time, the unicast packet may be configured as shown in Table 3.

Table 3 shows one type of unicast packet used when blocking communication. In Table 3, it is assumed that the blocking host equipment is the host equipment 200 ₁ .

That is, the unicast packet transmitted to the blocking host device is represented in the form of UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_i, MAC_1 / IP_1]. Here, IP_i means IP addresses of the remaining host devices except the blocked host device.

The blocking host device analyzes the unicast packet and maps and stores the MAC address (PB_MAC) of the host control device 300 to the IP address of each host device in the ARP table. At this time, the blocking host device does not reflect the information of the unicast packet for the IP of the host device which is not stored in the ARP table.

The packet transmitter 330 receives a broadcast packet and a unicast packet from the packet controller 320 and transmits the received packet to the corresponding host device.

4 is a diagram illustrating a sequence of isolating blocked host equipment in a network environment according to an exemplary embodiment of the present invention.

As shown in Figure 4, the host controller 300 according to an embodiment of the present invention detects the blocked host device among the plurality of host devices (200 ₁ -200 _N) included in the network.

As an example, the host control apparatus 300 may monitor the packet of the host device connected to the network, and then determine that the host device corresponding to the packet is the blocking host device when detecting a packet that violates the policy.

For example, a plurality of host devices (200 ₁ -200 _N) of the host device (200 ₁₎ is blocked if the host device, the host controller 300 is the IP address (IP_1), the host device block (200 ₁₎ BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / which is a broadcast packet for making the MAC address (PB_MAC) of the host control device 300 correspond to the MAC address (MAC_1) of the blocking host device 200 ₁ . 0.0.0.0] (S100). Here, the BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / 0.0.0.0] corresponds to the MAC address (PB_MAC) of the host control device 300 to the IP address (IP_1) of the blocking host device 200 ₁ . be a packet for instructing so, it transmits the host controller 300 as a whole a plurality of host devices (200 ₁ -200 _N). In other words, the host controller 300 is a plurality of host devices (200 ₁ -200 _N) block by passing the BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / 0.0.0.0] to the host device (200 ₁₎ Isolate (S110).

Host devices (200 ₁ -200 _N) are received BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / 0.0.0.0] by analyzing the block host device (200 ₁₎ of the IP address (IP_1), respectively, and host control Detects the MAC address PB_MAC of the device 300. Host devices (200 ₁ -200 _N), and is stored so that the MAC address (PB_MAC) of the host controller 300 to the IP address (IP_1), the host device block (200 ₁₎ in their ARP table respectively (S120) . At this time, in the ARP table of the cut-off the host device (200 ₁₎ does not have its own IP address (IP_1) store, block the host device (200 ₁₎ is BRD [FF, PB_MAC, Reply, PB_MAC / IP_1, 00 / 0.0. also receives 0.0] does not update the ARP table. At the same time, the host controller 300 for each IP address of the host device (200 ₂ -200 _N) stored in the ARP table of the host device block (200 ₁₎ (IP_2- UNI [MAC_1, PB_MAC, Reply], which is a unicast packet for making the MAC address (PB_MAC) of the host control device 300 correspond to the MAC address (MAC_2-MAC_N) of the host device 200 ₂ -200 _N. , PB_MAC / IP_2, MAC_1 / IP_1],. , UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_N, MAC_1 / IP_1] is generated and forwarded to the blocking host device 200 ₁ . Where UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_2, MAC_1 / IP_1],... , UNI [MAC_1, PB_MAC, Reply , PB_MAC / IP_N, MAC_1 / IP_1] is the host control to the IP address (IP_2-IP_N) of blocking the host device (200 ₁₎ ARP table host device (200 ₂ -200 _N) are stored in the A packet indicating that the MAC address (PB_MAC) of the device 300 can correspond, the host control device 300 transmits to the blocking host device (200 ₁ ).

Specifically, the host control device 300 has the MAC address PB_MAC of the host control device 300 instead of the MAC address MAC_2 of the host device 200 ₂ in the IP address IP_2 of the host device 200 ₂ . UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_2, MAC_1 / IP_1] to correspond to and generate to the blocking host equipment 200 ₁ (S130, S140). The host control device 300 is UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_3, MAC_1 / so that the MAC address (PB_MAC) of the host control device 300 corresponds to the IP address IP_3 of the host device 200 ₃ . IP_1] is generated and delivered to the blocking host device 200 ₁ (S150, S160).

In the same way the host controller 300 includes a host device (200 ₄ -200 _N) each IP address (IP_4-IP_N) in the unicast packet to the MAC address (PB_MAC) of the host controller 300 so as to correspond to the UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_4, MAC_1 / IP_1],... , UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_N, MAC_1 / IP_1] are generated and forwarded to the blocking host device 200 ₁ (S170, S180).

The blocking host device 200 ₁ analyzes UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_2, MAC_1 / IP_1] transmitted from the host control device 300 to host the IP address (IP_2) and the host of the host device 200 ₂ . The MAC address PB_MAC of the control device 300 is detected, and the MAC address PB_MAC is stored corresponding to the IP address IP_2 in the ARP table. The blocking host device 200 ₁ analyzes UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_3, MAC_1 / IP_1] transmitted from the host control device 300 to host the IP address (IP_3) and the host of the host device 200 ₃ . The MAC address PB_MAC of the control device 300 is detected and stored so that the AMC address PB_MAC corresponds to the IP address IP_3 in the ARP table.

In the same manner, the blocking host device 200 ₁ may transmit UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_4, MAC_1 / IP_1],... , UNI [MAC_1, PB_MAC, Reply, PB_MAC / IP_N, MAC_1 / IP_1] to analyze the IP address (IP_4-IP_N) of the host device 200 ₄ -200 _N and the MAC address (PB_MAC) of the host control device 300. Is detected and stored in the ARP table so that the MAC address (PB_MAC) corresponds to the IP address (IP_4-IP_N) (S190).

Thus, the host device block (200 ₁₎ is isolated after ten thousand and one other than the host device block (200 ₁₎ other host equipment (200 ₂ -200 _N) of the host device (200 ₂₎ is cut off the host device (200 ₁₎ and the communication When attempted, the host device 200 ₂ generates and forwards a packet for communication with the blocking host device 200 ₁ . At this time, since the rest of the host device (200 ₂ -200 _N) in the ARP table, the MAC address (PB_MAC) of the host controller 300 to the IP address (IP_1), the host device block (200 ₁₎ is response, the host device block The packet delivered to 200 ₁ is delivered to the host control device 300. Therefore, communication between the host device 200 ₂ and the blocking host device 200 ₁ may be prevented.

Meanwhile, in the embodiment of the present invention, an example of blocking a specific host device among a plurality of host devices has been described, but the present invention is not limited thereto, and the specific host is blocked by performing a reverse process for blocking a specific host device. The equipment may be released, for example as shown in FIG.

Referring to FIG. 5, in a network environment according to an embodiment of the present invention, turning off the shut-off the host device (200 ₁₎ of the plurality of host devices (200 ₁ -200 _N), the host controller 300 to unblock In order for the MAC address (MAC_1) of the host control device 300 to correspond to the IP address (IP_1) of the host device (hereinafter, referred to as an unblocking host device) 200 ₁ instead of the MAC address (PB_MAC) of the host control device 300 generating a broadcast packet, it transmits the broadcast packet to the host device (200 ₁ -200 _N). At this time, the broadcast packet may be configured as shown in Table 4.

Table 4 shows one type of broadcast packet used for unblocking communication.

In other words, a broadcast packet transmitted by a plurality of host devices (200 ₁ -200 _N) has the form of BRD [FF, PB_MAC, Request, MAC_1 / IP_1, 00 / IP_1].

BRD [FF, PB_MAC, Request, MAC_1 / IP_1, 00 / IP_1] is a packet indicating that the MAC address (MAC_1) of the host device 200 ₁ corresponds to the IP address (IP_1) of the unblocking host device. The control device 300 delivers to the entire plurality of host equipment 200 ₁ -200 _N.

Unblock a host controller 300 by passing the BRD [FF, PB_MAC, Request, MAC_1 / IP_1, 00 / IP_1] plurality of host devices (200 ₁ -200 _N) unblocking the host device (200 ₁₎ (S210).

Host devices (200 ₁ -200 _N) each receiving one BRD [FF, PB_MAC, Request, MAC_1 / IP_1, 00 / IP_1] IP address (IP_1) of the analysis by unblocking the host device (200 ₁₎ and the MAC address ( MAC_1). Host devices (200 ₁ -200 _N) and is mapped to store the MAC address (MAC_1) the IP address (IP_1) in their ARP table, respectively (S220). At this time, ARP table of unblocking the host device (200 ₁₎ has its own IP address (IP_1) is because it is not stored, unblocking the host device (200 ₁₎ is BRD [FF, PB_MAC, Request, MAC_1 / IP_1, 00 / IP_1] does not update the ARP table.

At the same time, the host controller 300 of unblocking the host equipment (200 ₁₎ stored in the host equipment to the ARP table of (200 ₂ -200 _N), IP address (IP_2-IP_N) host controller 300 to the MAC address ( PB_MAC) is not originally generated by the unicast packets to map the MAC address (MAC_2-MAC_N) of the host device (200 ₂ -200 _N) will be delivered to unblock the host equipment (200 _1). At this time, the unicast packet may be configured as shown in Table 5.

Table 5 shows one type of unicast packet used for unblocking communication.

That is, the unicast packet transmitted to the unblocking host device 200 ₁ is expressed in the form of UNI [MAC_1, PB_MAC, Reply, MAC_i / IP_i, MAC_1 / IP_1]. Here, MAC_i / IP_i refers to the MAC address / IP address of the other host equipment, except for unblocking the host device _{(200 1) (200 2 -200} N).

UNI [MAC_1, PB_MAC, Reply, MAC_2 / IP_2, MAC_1 / IP_1],... , Corresponding to the UNI [MAC_1, PB_MAC, Reply, MAC_N / IP_N, MAC_1 / IP_1] is the IP address (IP_2-IP_N) for unblocking the host devices stored in the ARP table of the host _{(200: 1)} devices (200 ₂ -200 _N) A packet indicating that the MAC addresses MAC_2-MAC_N correspond to each other, the host control device 300 transmits to the unblocking host device 200 ₁ .

Specifically, the host controller 300 includes a host device (200 ₂₎ of the IP address of the host device (200 ₂₎ other than the MAC address (PB_MAC) of the host controller 300 to (IP_2) MAC address (MAC_2) is In order to correspond, UNI [MAC_1, PB_MAC, Reply, MAC_2 / IP_2, MAC_1 / IP_1] is generated and transmitted to the host device 200 ₁ (S230, S240). Host controller 300 is such that the MAC address (MAC_3) of the host device (200 ₃₎ than the MAC address (PB_MAC) of the host control unit 300 corresponds to the IP address (IP_3) of the host device (200 ₃₎ UNI [MAC_1, PB_MAC, MAC_3 / IP_3, Reply, MAC_1 / IP_1] is generated and transmitted to the host device 200 ₁ (S250, S260).

Host device and not the MAC address (PB_MAC) in the same way the host controller 300 includes a host device (200 ₄ -200 _N) IP address, the host controller 300 to (IP_4-IP_N) of the (200 ₄ -200 _N UNI [MAC_1, PB_MAC, Reply, MAC_4 / IP_4, MAC_1 / IP_1],..., To match the MAC address (MAC_4-MAC_N) , UNI [MAC_1, PB_MAC, Reply, MAC_N / IP_N, MAC_1 / IP_1] are generated and transmitted to the host device 200 ₁ (S270, S280).

The host device 200 ₁ analyzes UNI [MAC_1, PB_MAC, Reply, MAC_2 / IP_2, MAC_1 / IP_1] transmitted from the host control device 300, and then analyzes the IP address (IP_2) and the MAC address of the host device 200 ₂ . (MAC_2) is detected and stored so that the MAC address (MAC_2) corresponds to the IP address (IP_2) in the ARP table. The host device 200 ₁ analyzes the UNI [MAC_1, PB_MAC, Reply, MAC_3 / IP_3, MAC_1 / IP_1] transmitted from the host control device 300 to determine the IP address (IP_3) and the MAC address of the host device 200 ₃ . The MAC_3 is detected, and the MAC address MAC_3 corresponds to the IP address IP_3 in the ARP table.

In the same way, the host equipment 200 ₁ transmits UNI [MAC_1, PB_MAC, Reply, MAC_4 / IP_4, MAC_1 / IP_1],..., Respectively transmitted from the host control device 300. , UNI [MAC_1, PB_MAC, Reply , MAC_N / IP_N, MAC_1 / IP_1] by analyzing and detecting a host device (200 ₄ -200 _N) of IP addresses (IP_4-IP_N) and MAC address (MAC_4-MAC_N), ARP The MAC address (MAC_4-MAC_N) corresponding to the IP address (IP_4-IP_N) in the table is stored to correspond (S290).

As such, in order to block a specific blocking host device in a network environment according to an embodiment of the present invention, a broadcast packet for mapping a MAC address of the host control device to an IP address of the blocking host device is generated and delivered to a plurality of host devices. At the same time, a specific unicast host device is reliably isolated by generating a unicast packet for mapping the host control device's MAC address to the IP address of the remaining host device stored in the ARP table of the blocked host device. It is possible to prevent the communication with the other host device by unblocking the isolated host device.

In addition, when another host device attempts to communicate with the blocked host device while the host device is blocked, the packet sent by the host device attempting to communicate is transmitted because the MAC address of the host control device corresponds to the IP address of the blocked host device. It can be delivered to the host control device to prevent communication between the blocking host device and other host devices.

The embodiments of the present invention described above are not only implemented through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (17)

In the method for blocking communication of the blocking host device in the host control device for controlling a plurality of host equipment,
Generating a first packet to allow a medium access control (MAC) address of the host control device to correspond to an Internet Protocol (IP) address of the blocked host device in an address resolution protocol (ARP) table of the plurality of host devices; ,
Forwarding the first packet to the plurality of host equipment;
Generating a plurality of second packets different from each other so that the MAC address of the host control apparatus corresponds to an IP address of each of the remaining host devices except the blocked host device in the ARP table of the blocked host device; and
Forwarding the plurality of second packets to the blocking host device
Communication blocking method comprising a. The method of claim 1,
The plurality of second packets respectively correspond to the remaining host equipment.
And the plurality of second packets each include an IP address of a corresponding host device and a MAC address of the host control device. The method of claim 1,
The first packet includes an Ethernet header and an ARP header,
The ARP header is,
And a MAC address of the host control device and an IP address of the blocking host device. The method of claim 1,
The plurality of second packets each include an Ethernet header and an ARP header,
The ARP header is,
Communication blocking method comprising the IP address of the host device and the MAC address of the host control device of the remaining host device. The method of claim 1,
Delivering the first packet to the plurality of host equipment,
Broadcasting the first packet to the plurality of host equipment;
Delivering the plurality of second packets to the blocking host device,
Unicasting the plurality of second packets to the blocking host device. The method according to any one of claims 1 to 5,
And the plurality of host devices communicate using the ARP table. In the method of blocking communication in the blocking host device of the plurality of host devices,
A medium access control (MAC) address of the host control device corresponds to an IP (Internet Protocol) address of each of the host devices other than the blocked host device among the plurality of host devices from the host control device controlling the plurality of host devices. Receiving a plurality of unicast packets to enable, and
Updating the MAC address of the remaining host device with the MAC address of the host control device in response to an IP address of each of the remaining host devices in an address resolution protocol (ARP) table;
Communication blocking method comprising a. The method of claim 7, wherein
Receiving the plurality of unicast packets,
Detecting the IP address of each of the remaining host equipment and the MAC address of the host control device using the plurality of unicast packets. The method of claim 7, wherein
The plurality of unicast packets respectively correspond to the remaining host equipment,
And the plurality of unicast packets each include an IP address of a corresponding host device and a MAC address of the host control device. In the method for releasing the blocking of the first host device blocked in the host control device for controlling a plurality of host equipment,
The MAC (Medium Access Control) address of the host control device mapped to the IP (Internet Protocol) address of the first host device in the Address Resolution Protocol (ARP) table of the plurality of host devices is the MAC of the first host device. Generating a broadcast packet for updating with an address,
Forwarding the broadcast packet to the plurality of host equipment;
Update the MAC address of the host control device mapped to the IP address of each of the remaining host devices except the first host device among the plurality of host devices in the ARP table of the first host device with the MAC address of the remaining host device. Generating a plurality of unicast packets for the purpose of, and
Forwarding the plurality of unicast packets to the first host equipment
Unblocking method comprising a. The method of claim 10,
The plurality of unicast packets respectively correspond to the remaining host equipment,
And the plurality of unicast packets each include an IP address and a MAC address of a corresponding host device. The method of claim 10,
The broadcast packet includes an Ethernet header and an ARP header,
The ARP header is,
And a method of unblocking an IP address of the first host device and a MAC address of the first host device. The method of claim 10,
Each of the plurality of unicast packets includes an Ethernet header and an ARP header,
The ARP header is,
Block release method comprising the IP address and MAC address of the host device of the remaining host device. 14. The method according to any one of claims 10 to 13,
And the plurality of host devices communicate using the ARP table. In the method of releasing the blocking from the blocked first host device of the plurality of host devices,
An IP (Internet Protocol) address of each of the host devices other than the first host device among the plurality of host devices in an address resolution protocol (ARP) table of the first host device from a host control device controlling the plurality of host devices. Receiving a plurality of unicast packets for updating the MAC address of the host control device mapped to the medium access control (MAC) address of the remaining host device; and
Updating the MAC address of the host control device mapped to the IP address of each of the remaining host devices to the MAC address of the remaining host device in the ARP table.
Unblocking method comprising a. 16. The method of claim 15,
Receiving the plurality of unicast packets,
Detecting the IP address of each of the remaining host devices and the MAC address of each of the remaining host devices using the plurality of unicast packets. 16. The method of claim 15,
The plurality of unicast packets respectively correspond to the remaining host equipment,
And the plurality of unicast packets each include an IP address and a MAC address of a corresponding host device.

Images