WO2012163215A1 - 一种DHCPSnooping绑定表生成的方法、装置、设备及系统 - Google Patents

一种DHCPSnooping绑定表生成的方法、装置、设备及系统 Download PDF

Info

Publication number
WO2012163215A1
WO2012163215A1 PCT/CN2012/075059 CN2012075059W WO2012163215A1 WO 2012163215 A1 WO2012163215 A1 WO 2012163215A1 CN 2012075059 W CN2012075059 W CN 2012075059W WO 2012163215 A1 WO2012163215 A1 WO 2012163215A1
Authority
WO
WIPO (PCT)
Prior art keywords
dhcp
user
address
user information
message
Prior art date
Application number
PCT/CN2012/075059
Other languages
English (en)
French (fr)
Inventor
韩志冲
于斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP12792507.1A priority Critical patent/EP2757743B1/en
Publication of WO2012163215A1 publication Critical patent/WO2012163215A1/zh
Priority to US14/272,613 priority patent/US9883010B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/162—Implementing security features at a particular protocol layer at the data link layer

Definitions

  • the embodiments of the present invention relate to the field of communication technologies, and in particular, to a method, a system, and a device for generating a dynamic host configuration protocol snooping (DHCP) binding table.
  • DHCP dynamic host configuration protocol snooping
  • Dynamic Host Configuration Protocol (DHCP) snooping is a security feature of DHCP.
  • the DHCP snooping binding table is established and maintained by monitoring the DHCP messages between the DHCP client and the DHCP server.
  • the device uses the binding table to check the address resolution protocol (ARP) packets and the Internet Protocol (IP) packets, and filters the illegal packets to implement network security functions.
  • ARP address resolution protocol
  • IP Internet Protocol
  • the DHCP Snooping binding table contains information such as the Internet Protocol (IP) address, Media Access Control (MAC) address, ingress port number, and virtual LAN (VLAN) number.
  • the DHCP snooping function After the DHCP snooping function is enabled on the network device, the user's IP address, MAC address, inbound port number, and VLAN number are obtained based on the DHCP interaction between the user and the server.
  • the DHCP snooping binding table is formed.
  • the Address Resolution Protocol (ARP) detection function can control the user's Internet access.
  • ARP Address Resolution Protocol
  • the DHCP snooping function is enabled after the network device starts running. After the DHCP snooping function is enabled, the DHCP snooping binding table is generated according to the monitored DHCP interaction packets. The information can only be obtained through the DHCP interaction message that the DHCP user and the DHCP server initially establish a connection to, if the DHCP part user The connection with the DHCP server has been established. After the DHCP snooping function is enabled, the DHCP snooping binding table cannot be obtained. The DHCP snooping binding table cannot be generated for these users. Missing.
  • the DHCP snooping function is enabled on the CLI and there is no time-dependent relationship between the DHCP client and the DHCP server. Therefore, before the DHCP snooping function is enabled, some users may have established a relationship with the DHCP server because these users do not generate DHCP. The Snooping binding table, so the data packets sent by these users will not be discarded through DHCP snooping detection. These users need to re-establish interaction with the DHCP server. In this process, the traffic of these users will be lost. Summary of the invention
  • the embodiment of the invention provides a method, a system and a device for generating a DHCP snooping binding table, which are used to solve the problem that part of the user traffic is lost due to the missing part of the DHCP snooping binding table during the DHCP snooping startup process of the network device.
  • the embodiment of the present invention provides a method for generating a DHCP snooping binding table, where the method includes:
  • the DHCP server Receiving, by the DHCP server, the response message corresponding to the request message, and extracting the user information in the response message, where the user information includes a user internet protocol IP address and a media access control MAC address;
  • An embodiment of the present invention provides an apparatus for generating a DHCP snooping binding table, where the apparatus includes: a message sending unit, configured to construct a request message for obtaining DHCP user information, and send the request message to a DHCP server;
  • a packet receiving unit configured to receive a response packet of the DHCP server corresponding to the request packet, and extract the user information in the response packet, where the user information includes a user internet protocol IP address and media access Control the MAC address;
  • the packet processing unit is configured to obtain a VLAN number and an inbound port number of the user virtual network by using the MAC address lookup MAC table, and generate a DHCP snooping binding table according to the user IP address, the MAC address, the VLAN number, and the inbound port number.
  • the embodiment of the present invention provides a network device, where the network device includes a device for generating a DHCP snooping binding table according to an embodiment of the present invention.
  • the embodiment of the invention provides a system for monitoring a DHCP snooping binding table generated by a dynamic host configuration protocol, which is characterized in that it comprises a network device and a DHCP server that performs information interaction with the network device;
  • the network device is configured to configure a request message for obtaining DHCP user information, and send the request message to the DHCP server, and receive the response message of the DHCP server corresponding to the request message, and extract the Responding to the user information in the message, where the user information includes a user internet protocol IP address and a media access control MAC address, and generates a DHCP snooping binding table according to the user information;
  • the DHCP server is configured to receive the request message, and construct a response message for the request message, where the response message includes the DHCP user information.
  • the embodiment of the present invention provides a DHCP snooping binding table generation method, device, device, and system.
  • a DHCP snooping binding table is generated by obtaining DHCP user information from a DHCP server to implement DHCP.
  • the Snooping function provides the necessary information support.
  • the embodiment of the present invention facilitates the real-time startup of the DHCP snooping function of the network device under the condition that the current user traffic is normal.
  • FIG. 1 is a schematic flowchart of a method for generating a DHCP snooping binding table according to the first embodiment of the present invention
  • FIG. 2 is a schematic diagram of generating a DHCP snooping binding table in the prior art
  • FIG. 3 is a schematic diagram of a format of a packet exchanged between a DHCP user and a DHCP server in the prior art
  • FIG. 4 is a schematic diagram of a format of an extended DHCP Inform message option of the first embodiment of the present invention
  • FIG. 6 is a schematic flowchart of generating and issuing a DHCP snooping binding entry according to a second embodiment of the present invention
  • FIG. 7 is a schematic diagram of a format of an extended DHCP Inform message option Options section according to a second embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a device for generating a DHCP snooping binding entry according to a third embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a DHCP snooping binding entry generation system according to a fourth embodiment of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • FIG. 1 is a flowchart of a method according to an embodiment of the present invention, including:
  • the DHCP snooping protocol listens to DHCP messages and establishes a DHCP snooping binding table.
  • the entries in the binding table include the user's IP address, MAC address, inbound port number, and virtual number.
  • the local area network (Virtual LAN, VLAN) number for example, as shown in Figure 2, the MAC address and IP address of user A are: A, 10.1.1.1; The MAC address and IP address of user B are: B, 10.1.1.2 DHCP snooping is enabled on the network through the command line.
  • the network device listens for DHCP messages in the process of interacting with the DHCP server.
  • the DHCP snooping binding table is created as follows. .
  • the DHCP snooping binding table is used to check the user packet, and the packet that does not hit the binding table is discarded. This solves the network security problem.
  • the existing DHCP snooping binding table can be generated only when the user establishes a connection with the DHCP server. If the network device uses the DHCP snooping function, some users have established a connection with the DHCP server, as shown in Figure 2. After the network device is connected to the DHCP server through the DHCP snooping command, DHCP snooping cannot generate a DHCP snooping binding table for the user N.
  • DHCP snooping After DHCP snooping is enabled on the network device, The data packets sent by user N will not be discarded by DHCP snooping detection.
  • the inventors of the present invention have found that before the DHCP snooping is enabled on the network device, the user information that has been connected to the DHCP server is completely stored on the DHCP server. Therefore, the request packet can be constructed. Obtain these user information from the DHCP server, and then establish a DHCP Snooping binding table for these users to ensure that these user traffic is not interrupted.
  • the request packet for obtaining the DHCP user information is sent to the DHCP server through the analog client.
  • the destination address of the packet is set to 0xFFFFFFFF by default, and is sent to all DHCP servers in broadcast mode.
  • the The destination address of the request packet may be the DHCP server address configured by the DHCP relay, so that the request packet may be sent only to the DHCP server that directly interacts with the network device.
  • the request message may be an extended DHCP Inform message, and the extended DHCP Inform message is an extension of an Option (Options) part of the DHCP Inform message.
  • the format of the DHCP Inform message is shown in Figure 3.
  • Figure 3 shows the format of the packet exchanged between the DHCP user and the DHCP server.
  • the value of the option (op) field is 1, and the identifier type is DHCP Inform.
  • the format of the Message Options is shown in Figure 4. It can include:
  • Option type A cross-type message used to identify the request and response in the embodiment of the present invention.
  • the value of the field is 1 byte, and the value may be any value from 128 to 255.
  • the embodiment of the present invention is 206.
  • Length Identifies the length of the data segment information data.
  • the length of the field is 2 bytes, and the value is 1 .
  • the data length of the identification data segment is 1 byte, and the data segment is: 1 byte subtype (subtype).
  • Subtype A field used to identify the message type.
  • the value of the field is 1 byte, and the value is 1 to 255.
  • the embodiment of the present invention is defined as 1 for the identifier 104, and the response of the DHCP server corresponding to the request message is received. Extracting the user information in the response message, where the user information includes a user internet protocol IP address, Media access control MAC address;
  • the DHCP server When the DHCP server establishes a connection, the DHCP server stores the DHCP user information, so the DHCP server can add the saved user information to the extended DHCPACK response, and the DHCPACK format is as shown in FIG. Figure 3 shows the format of the packet exchanged between the DHCP client and the DHCP server.
  • the value of the option (op) field is 2, and the identifier type is DHCPACK.
  • the format of the extended DHCP ACK message Options option is as shown in Figure 5, which may include:
  • Option type An identifier used to identify the request and response in the embodiment of the present invention.
  • the value of the field is 1 byte, and the value may be any value from 128 to 255.
  • the embodiment of the present invention is 206.
  • Length Identifies the length of the data segment information data.
  • the length of the field is 2 bytes, and the value is 10*N+1.
  • the length of the data segment information data is 10*N+1 bytes, where 10 is the sum of the user IP address and the MAC address length, and N identifies the number of users. .
  • Subtype A field used to identify the message type.
  • the value of the field is 1 byte, and the value is 1 to 255.
  • the embodiment of the present invention is defined as 2, and the identifier is used to identify the DHCPACK message. The response message of the request message.
  • IP address_A Used to identify the IP address of User A. This field is 4 bytes long.
  • IP address_N Used to identify the IP address of user N. This field is 4 bytes long.
  • User N's MAC address (mac_address_N): Used to identify the MAC address of User N. This field is 6 bytes long. Receiving the response packet sent by the DHCP server, and determining that the subtype value is 2, the packet is considered to be a response message containing the user information, and the user information can be obtained by parsing the packet.
  • the information includes the user's IP address and MAC address.
  • the IP address and MAC address are the key fields for generating the DHCP snooping binding table.
  • the MAC address of the MAC address is obtained by using the MAC address to obtain a VLAN number and an inbound port number of the user virtual network, and a DHCP snooping binding table is generated according to the user IP address, the MAC address, the VLAN number, and the inbound port number.
  • the user MAC information obtained in step 104 is further searched for the MAC address table, and the inbound port number and the VLAN number of the user are obtained, and then all the information of the DHCP snooping binding table is obtained, and the MAC address table is the second layer.
  • the forwarding table contains the user's inbound port number and VLAN number.
  • the DHCP snooping binding table can be generated based on the obtained user IP address, MAC address, ingress port number, and VLAN number.
  • a DHCP snooping binding table can be generated for a user who has established a connection with the DHCP server before the DHCP snooping is started, which can be solved by the lack of the DHCP snooping binding table of some users during the DHCP snooping startup process. Some users lost traffic.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • FIG. 6 is a flowchart of a method according to an embodiment of the present invention.
  • the DHCP snooping monitoring network segment information is further added.
  • the user information monitored by the snooping, the embodiment of the present invention includes:
  • the network segment information monitored by the DHCP snooping device can be set.
  • the monitored network segment information can be negotiated with the DHCP server in advance.
  • the DHCP server only allocates the network segment to the network device.
  • the monitored The address within the network segment.
  • the request message for obtaining the DHCP user information corresponding to the monitoring network segment information is configured, and the request packet is sent to the DHCP server.
  • the destination address of the request packet used to obtain the DHCP user information is 0xFFFFFFFF, and is sent to all DHCP servers in broadcast mode.
  • the destination address of the request packet can be DHCP configured by the DHCP relay.
  • the server address so that the request message can be sent only to the DHCP server directly interacting with the network device.
  • the request packet may be extended to the DHCP Inform, and the packet is sent to the DHCP server by using the simulated client.
  • the extended DHCP Inform message is extended by the option part of the message to indicate that the message is a request.
  • the format of the DHCP Inform message is as shown in Figure 3, where the option op field value is 1 and the identifier type is DHCP Inform.
  • Extended DHCP Inform Request Messages is shown in Figure 7, which can include:
  • Option type An identifier used to identify the request and response in the embodiment of the present invention.
  • the value of the field is 1 byte, and the value may be any value from 128 to 255.
  • the embodiment of the present invention is 206.
  • Length Identifies the length of the data segment information data.
  • the length of this field is 2 bytes, and the value is 6.
  • the identification data segment information data length is 6 bytes, including: 1 byte subtype
  • Subtype A field used to identify the message type.
  • the value of the field is 1 byte, and the value is 1 to 255.
  • the embodiment of the present invention is defined as 1 for identification.
  • Monitoring network segment address (ip) It is used to identify the network segment address monitored by DHCP snooping. This field is 4 bytes long.
  • the monitoring network segment address mask (ip mask): used to identify the mask length of the monitoring network segment address ip. This field is 1 byte in length.
  • the network device can obtain the user information monitored by DHCP snooping from the DHCP server. This prevents the redundant DHCP snooping binding table from being saved.
  • DHCP server 406. Receive, by the DHCP server, a response packet corresponding to the request packet, and extract the user information in the response message, where the user information includes a user internet protocol IP address and a media access control MAC address.
  • the response packet received from the DHCP server is generated by the DHCP server through the DHCPACK packet extension.
  • the format of the DHCPACK packet is as shown in FIG. 3, where the option op field value is 2, and the identifier packet type is a DHCPACK packet.
  • the format of the extended DHCP ACK message Options option is as shown in FIG. 5, which may include:
  • Option type A cross-type message used to identify the request and response in the embodiment of the present invention.
  • the value of the field is 1 byte, and the value may be any value from 128 to 255.
  • the embodiment of the present invention is 206.
  • Length Identifies the length of the data segment information data.
  • the length of the field is 2 bytes, and the value is 10*N+1.
  • the length of the data segment information data is 10*N+1 bytes, where 10 is the sum of the user IP address and the MAC address length, and N identifies the number of users. .
  • Subtype A field used to identify the message type.
  • the value of the field is 1 byte, and the value is 1 to 255.
  • the embodiment of the present invention is defined as 2, and the identifier is used to identify the DHCPACK message. The response message of the request message.
  • IP address_A Used to identify the IP address of User A. This field is 4 bytes long.
  • ip_address_N Used to identify the IP address of User A.
  • the field length is 4 bytes.
  • the DHCP server can obtain the network segment information of the user by parsing the request packet, where the user information includes the IP address and the MAC address of the user, and the IP address and the MAC address are key entries of the DHCP snooping binding table.
  • the MAC address of the MAC address is obtained by using the MAC address to obtain a VLAN number and an inbound port number of the user, and a DHCP snooping binding table is generated according to the user IP address, the MAC address, the VLAN number, and the inbound port number.
  • the user MAC information obtained in step 406 is further searched for the MAC address table, and the inbound port number and the VLAN number of the user are obtained, and all the information for generating the DHCP snooping binding table is obtained, according to the obtained user IP.
  • the DHCP snooping binding table of the user is generated by the address, MAC address, inbound port number, and VLAN number.
  • a DHCP snooping binding table can be generated for a user who has established a connection with the DHCP server before the DHCP snooping is started, which can be solved by the lack of the DHCP snooping binding table of some users during the DHCP snooping startup process.
  • the user traffic is lost.
  • the embodiment can accurately obtain the client information monitored by the DHCP snooping from the DHCP server, and avoid storing redundant user information.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • FIG. 8 is a schematic diagram of a device according to an embodiment of the present invention.
  • the device includes: a message sending unit 802, a message receiving unit 804, and a message. Text processing unit 806.
  • the message sending unit 802 is configured to construct a request message for obtaining the DHCP user information, and send the request message to the DHCP server, where the request message can be generated by expanding the DHCP Inform message, and the specifically extended message is generated.
  • the message receiving unit 804 receives the response message of the DHCP server corresponding to the request message, and extracts the user information in the response message, where the user information includes a user internet protocol IP address and media access control.
  • the MAC address, the response packet may be generated by using the DHCPACK extension.
  • the format of the specifically extended packet refer to step 104 of the embodiment of the present invention.
  • the processing unit 806 is configured to obtain a DHCP snooping binding table according to the user IP address, the MAC address, the VLAN number, and the inbound port number by using the MAC address to find the MAC address table to obtain the VLAN number and the inbound port number of the user virtual local area network.
  • the device may further include a network segment setting unit 808, configured to set network segment information monitored by the network device DHCP Snooping, and correspondingly, the request message for obtaining user information constructed by the packet sending unit includes the monitored
  • the request packet may be an extension of the DHCP Inform message.
  • the format of the specifically extended packet refer to step 402 of the second embodiment of the present invention.
  • the device may further include: a message requesting unit, and a message processing unit.
  • a message requesting unit configured to construct a request message, where the request message includes a dynamic host configuration protocol to advertise a DHCP Inform message, where the request message is used to obtain DHCP user information, where the user information includes a user IP address and a MAC address.
  • An address, the extension of the Options section of the DHCP Inform message may be referred to step 102 of the first embodiment of the invention;
  • a packet processing unit configured to receive a response packet for the request packet, and extract the user information, and further generate a DHCP snooping binding table according to the obtained user information, where the response message includes a dynamic host configuration protocol.
  • the specific extended message format can be referred to step 104 of the embodiment of the present invention.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • FIG. 9 is a schematic diagram of a system according to an embodiment of the present invention.
  • the system includes: a network device 902 and a DHCP server 904.
  • the network device 902 is configured to configure a request message for obtaining the DHCP user information, and send the request message to the DHCP server, and further, receive the response message of the DHCP server corresponding to the request message, and extract the response.
  • the user information is obtained in the packet, and the DHCP snooping binding table is generated according to the user information.
  • the network device 902 includes: a message transmission unit 802, a message receiving unit 804, and a message processing unit 806.
  • the message sending unit 802 is configured to construct a request for obtaining the user information, and send the request message to the DHCP server, where the request message can be generated by expanding the DHCP Inform message, and the specific extended report is generated.
  • the message receiving unit 804 is configured to receive the response packet of the DHCP server corresponding to the request packet, and the response packet of the DHCP server may be generated by using a DHCPACK extension.
  • a specific extended packet format refer to step 104 of the embodiment of the present invention.
  • the packet processing unit 806 is configured to extract the user information in the response packet, and generate DHCP snooping according to the extracted DHCP user information. Bind the table.
  • the network device may further include a network segment setting unit 808, configured to set network segment information monitored by the network device DHCP Snooping, and correspondingly, the request message for obtaining user information constructed by the packet sending unit includes the monitoring
  • the request packet may be an extension of the DHCP Inform message.
  • the specific extended packet format refer to step 402 of the second embodiment of the present invention.
  • the network device may further include: a text request unit, a text processing unit.
  • a message requesting unit configured to construct a request message, where the request message includes a dynamic host configuration protocol to advertise a DHCP Inform message, where the request message is used to obtain DHCP user information, where the user information includes a user IP address and a MAC address.
  • An address, the extension of the Options section of the DHCP Inform message may be referred to step 102 of the first embodiment of the invention;
  • a packet processing unit configured to receive a response packet for the request packet, and extract the user information, and further generate a DHCP snooping binding table according to the obtained user information, where the response message includes a dynamic host configuration protocol.
  • the response message includes a dynamic host configuration protocol.
  • the specific extended packet format can be found in step 104 of the embodiment of the present invention.
  • the DHCP server 904 is configured to receive the request packet sent by the network device, construct a response packet that includes the user information, and send the response packet to the network device.
  • the device, the network device and the system provided by the implementation of the present invention can be DHCP.
  • a user who has established a connection with the DHCP server before the Snooping is started generates a DHCP snooping binding table. This can solve the problem of user traffic loss caused by the loss of the DHCP snooping binding table of some users during the DHCP snooping startup.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Environmental & Geological Engineering (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明实施例提供一种动态主机配置协议监听DHCPSnooping绑定表生成的方法、装置、设备及系统，所述方法包括：构造用于获得DHCP用户信息的请求报文，并将所述请求报文发送给DHCP服务器；接收所述DHCP服务器对应所述请求报文的回应报文，提取所述回应报文中的所述用户信息，所述用户信息包含用户网际协议IP地址、媒体接入控制MAC地址；通过所述MAC地址获得用户虚拟局域网VLAN号和入端口号，进而生成DHCPSnooping绑定表。采用本发明实施例提供的技术方案能够为在DHCPSnooping启动前已经和DHCP服务器建立连接的用户生成DHCPSnooping绑定表，能够解决在DHCPSnooping启动过程中由于部分用户DHCPSnooping

Description

一种 DHCP Snooping绑定表生成的方法、 装置、 设备及系统 本申请要求于 2011年 11月 16 日提交中国专利局、 申请号为
201110362774. 5 , 发明名称为 "一种 DHCP Snooping绑定表生成的方法、 装置、 设备及系统" 的中国专利申请的优先权， 其全部内容通过引用结合 在本申请中。 技术领域
本发明实施例涉及通信技术领域， 尤其涉及一种动态主机配置协议监听 ( Dynamic Host Configuration Protocol Snooping, DHCP Snooping )绑定表生 成的方法、 系统及设备。
背景技术
动态主机配置协议 ( Dynamic Host Configuration Protocol, DHCP )监听 ( Snooping )技术是 DHCP的安全特性， 通过监控 DHCP用户和 DHCP服务 器之间的 DHCP报文， 建立和维护 DHCP Snooping绑定表， 在转发报文时， 利用绑定表对地址解析协议（ Address Resolution Protocol, ARP )报文、 网际 协议 (Internet Protocol , IP)报文进行检查，过滤非法报文，实现网络安全功能。 DHCP Snooping绑定表包含用户网际协议（ Internet Protocol, IP )地址、 媒体 接入控制（ Media Access Control, MAC )地址、入端口号和虚拟局域网（ Virtual LAN, VLAN )号等信息。 网络设备 DHCP Snooping功能启动后会根据用户 和服务器之间的 DHCP交互 4艮文获得用户的 IP地址、 MAC地址、 入端口号 和 VLAN号， 进而形成 DHCP Snooping绑定表， 该绑定表配合地址解析协议 ( Address Resolution Protocol , ARP )检测功能即可实现控制用户上网的目的。
现有技术中 DHCP Snooping功能是在网络设备开始运行后通过配置命令 来启动的， DHCP Snooping功能启动后会根据监听到的 DHCP交互报文生成 DHCP Snooping绑定表， 生成该绑定表所需要的信息只能通过 DHCP用户与 DHCP服务器最开始建立连接的 DHCP交互报文获得， 如果 DHCP部分用户 已经与 DHCP服务端连接已经建立完成，再启动 DHCP Snooping功能就不能 获得建立 DHCP Snooping表所需要的信息， 也就无法为这些用户生成 DHCP Snooping绑定表， 会造成这部分用户 DHCP Snooping绑定表缺失。 由于通过 命令行启动 DHCP Snooping功能与 DHCP用户与 DHCP服务器建立连接没有 必然的时间先后依赖关系， 所以在 DHCP Snooping功能启动之前， 可能会有 些用户已经与 DHCP服务器完成关系建立， 由于这些用户没有生成 DHCP Snooping 绑定表， 所以这些用户发送来的数据报文将不会通过 DHCP Snooping的检测而被丟弃，这些用户需要与 DHCP服务器重新建立交互关系， 在这个过程会导致这些用户的流量丟失。 发明内容
本发明实施例提供了一种 DHCP Snooping绑定表生成的方法、 系统及设 备， 以解决在网络设备 DHCP Snooping启动过程中部分 DHCP Snooping绑 定表缺失造成部分用户流量丟失的问题。
为达到上述目的， 本发明实施例提供了一种 DHCP Snooping绑定表生成 的方法， 所述方法包括：
构造用于获得 DHCP用户信息的请求报文， 并将所述请求报文发送给 DHCP服务器；
接收所述 DHCP服务器对应所述请求 文的回应^艮文， 提取所述回应 报文中的所述用户信息， 所述用户信息包含用户网际协议 IP地址、 媒体 接入控制 MAC地址；
通过所述 MAC地址查找 MAC表获得用户虚拟局域网 VLAN号和入 端口号， 根据所述用户 IP地址、 MAC地址、 VLAN号及入端口号生成
DHCP Snooping绑定表。
本发明实施例提供了一种 DHCP Snooping绑定表生成的装置，所述装 置包括： 报文发送单元， 用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给 DHCP 服务器；
报文接收单元， 用于接收所述 DHCP服务器对应所述请求报文的回应 报文， 提取所述回应报文中的所述用户信息， 所述用户信息包含用户网际 协议 IP地址、 媒体接入控制 MAC地址；
报文处理单元， 用于通过所述 MAC地址查找 MAC表获得用户虚拟 局域网 VLAN号和入端口号， 根据所述用户 IP地址、 MAC地址、 VLAN 号及入端口号生成 DHCP Snooping绑定表。
本发明实施例提供了一种网络设备， 所述网络设备包括本发明实施例 提供的一种 DHCP Snooping绑定表生成的装置。
本发明实施例提供了一种动态主机配置协议监听 DHCP Snooping绑定 表生成的系统， 其特征在于， 包括网络设备和与网络设备进行信息交互的 DHCP服务器；
所述网络设备， 用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给所述 DHCP服务器；接收所述 DHCP服务器对应所述请求 报文的回应报文， 提取所述回应报文中的所述用户信息， 所述用户信息包 含用户网际协议 IP地址、 媒体接入控制 MAC地址， 根据所述用户信息生 成 DHCP Snooping绑定表；
所述 DHCP服务器， 用于接收所述请求报文， 并构造针对所述请求报 文的回应报文， 所述回应报文包含了所述 DHCP用户信息。
综上， 本发明实施例提出了一种 DHCP Snooping绑定表生成的方法、 装置、 设备及系统， 在 DHCP Snooping启动过程中， 通过从 DHCP服务 器获得 DHCP用户信息生成 DHCP Snooping绑定表为实现 DHCP Snooping 功能提供必要的信息支持， 通过本发明实施例有利于在现有用户流量正常 运行情况下， 实现网络设备的 DHCP Snooping功能实时启动。 附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对实 施例或现有技术描述中所需要使用的附图作简单地介绍， 显而易见地， 下面 描述中的附图是本发明的一些实施例， 对于本领域普通技术人员来讲， 在不 付出创造性劳动的前提下， 还可以根据这些附图获得其他的附图。
图 1是本发明第一实施例提供的一种 DHCP Snooping绑定表生成方法的 流程示意图；
图 2是现有技术中 DHCP Snooping绑定表生成示意图；
图 3是现有技术中 DHCP用户与 DHCP服务器交互的报文格式示意图； 图 4是本发明第一实施例提供的扩展的 DHCP Inform报文选项 Options 部分格式示意图； 式示意图；
图 6是本发明第二实施例提供的一种 DHCP Snooping绑定表项生成发放 的流程示意图；
图 7是本发明第二实施例提供的扩展的 DHCP Inform报文选项 Options 部分格式示意图；
图 8是本发明第三实施例提供的一种 DHCP Snooping绑定表项生成装置 的示意图。
图 9是本发明第四实施例提供的一种 DHCP Snooping绑定表项生成系统 的示意图。
具体实施方式
为使本发明实施例的目的、 技术方案和优点更加清楚， 下面将结合本发 明实施例中的附图， 对本发明实施例中的技术方案进行清楚、 完整地描述， 显然， 所描述的实施例是本发明一部分实施例， 而不是全部的实施例。 基于 本发明中的实施例， 本领域普通技术人员在没有做出创造性劳动前提下所获 得的所有其他实施例， 都属于本发明保护的范围。
实施例一：
本发明实施例提供了一种 DHCP Snooping绑定表生成的方法，参见图 1 , 图 1为本发明实施例的方法流程图， 包括：
102 , 构造用于获得 DHCP用户信息的请求报文， 并将所述请求报文 发送给 DHCP服务器；
在网络设备通过命令行启动 DHCP Snooping功能之后， DHCP Snooping 协议通过监听 DHCP报文， 建立 DHCP Snooping绑定表， 该绑定表的表项包 括：用户的 IP地址、 MAC地址、入端口号和虚拟局域网（ Virtual LAN, VLAN ) 号，举例来说，如图 2所示，用户 A的 MAC地址及 IP地址为： A, 10.1.1.1 ; 用户 B的 MAC地址及 IP地址为： B, 10.1.1.2, 在网络设备上通过命令行启 动 DHCP Snooping功能， 网络设备监听用户 A、 B同 DHCP服务器交互过程 中的 DHCP报文， 通过分析这些往来的 DHCP报文， 建立如下所示的 DHCP Snooping绑定表。
表 1 DHCP Snooping绑定表
Figure imgf000007_0001
在转发报文时， 利用 DHCP Snooping绑定表对用户报文进行检查， 对于 没有命中绑定表的报文进行丟弃处理， 从而解决网络安全问题。 由于现有的 DHCP Snooping绑定表只能在用户与 DHCP服务器建立连接过程中生成， 如 果在网络设备通过命令行使能 DHCP Snooping功能前某些用户已经与 DHCP 服务器建立起连接， 如图 2, 假设用户 N在网络设备通过命令行使能 DHCP Snooping之前已经与 DHCP服务器建立连接，则 DHCP Snooping不能为用户 N生成 DHCP Snooping绑定表，那么在网络设备使能 DHCP Snooping功能后， 用户 N发送来的数据报文将不会通过 DHCP Snooping的检测而被丟弃。为解 决这个问题，本发明发明人经过研究发现在网络设备使能 DHCP Snooping前， 已经和 DHCP服务器建立连接的用户信息会被完整的存储在 DHCP服务器上, 因此， 可以通过构造请求报文的方式到 DHCP服务器获取这些用户信息， 进 而为这些用户建立 DHCP Snooping绑定表， 保证这些用户流量不中断。
用于获得 DHCP用户信息的请求报文通过模拟用户端发送给 DHCP服务 器， 其报文目的地址默认设置为 0XFFFFFFFF , 以广播的形式发送给所有 DHCP服务器， 当网络设备配置了 DHCP Relay时， 所述请求报文的目的地址 可以为 DHCP Relay配置的 DHCP服务器地址， 这样可以只向与所述网络设 备直接进行交互的 DHCP服务器进行发送所述请求报文。 所述请求报文可以 是扩展的 DHCP Inform报文，所述扩展的 DHCP Inform报文是对 DHCP Inform 报文的选项 （Options )部分进行了扩展。 所述 DHCP Inform报文消息格式如 图 3所示，图 3为 DHCP用户与 DHCP服务器交互的报文格式，其中选项（op ) 字段值为 1 ,标识报文类型为 DHCP Inform„扩展的 DHCP Inform报文 Options (选项）格式如图 4, 可以包括：
1 )选项类型（ option type ): 用于标识本发明实施例所述请求及应答的交 互报文。 该字段长度为 1字节， 取值可以为 128到 255任一值， 优选的， 本 发明实施例定为 206。
2 )长度（ length ): 标识数据段信息数据长度。 该字段长度为 2字节， 取 值为 1 , 标识数据段信息数据长度为 1字节， 其中数据段为： 1个字节的子类 型 ( subtype )。
3 )子类型 （subtype ): 用于标识所述报文类型的字段。 该字段长度为 1 字节， 取值为 1到 255任一值， 优选的， 本发明实施例定义为 1 , 用于标识 104 , 接收所述 DHCP服务器对应所述请求 文的回应^艮文， 提取所 述回应 4艮文中的所述用户信息，所述用户信息包含用户网际协议 IP地址、 媒体接入控制 MAC地址；
DHCP服务器建立连接时， DHCP服务器会存储 DHCP用户信息， 所以 DHCP服务器可以把其保存的所述用户信息添加到所述扩展的 DHCPACK 回应 ^艮文中， 所述 DHCPACK ^艮文格式如图 3所示， 图 3为 DHCP用户 与 DHCP服务器交互的报文格式， 其中选项 （op ) 字段值为 2 , 标识报文 类型为 DHCPACK报文。所述扩展的 DHCPACK报文 Options选项格式如 图 5 , 可以包括：
1 )选项类型（ option type ): 用于标识本发明实施例所述请求及应答的交 互 ^艮文。 该字段长度为 1字节， 取值可以为 128到 255任一值， 优选的， 本 发明实施例定为 206。
2 )长度（ length ): 标识数据段信息数据长度。 该字段长度为 2字节， 取 值为 10*N+1 , 标识数据段信息数据长度为 10*N+1字节， 其中 10为用户 IP 地址和 MAC地址长度之和 , N标识用户个数。
3 )子类型 （subtype ): 用于标识所述报文类型的字段。 该字段长度为 1 字节， 取值为 1到 255任一值， 为了标识与请求报文类型的区别， 优选本发 明实施例定义为 2 , 用于标识所述 DHCPACK报文为对应于所述请求报文的 回应报文。
4 )用户 A的 IP地址（ ip_address_A ): 用于标识用户 A的 IP地址。 该 字段长度为 4字节。
5 )用户 A的 MAC地址（ mac— address— A ): 用于标识用户 A的 MAC地 址。 该字段长度为 6个字节。
6 )用户 N的 IP地址（ ip_address_N ): 用于标识用户 N的 IP地址。 该 字段长度为 4字节。
7 )用户 N的 MAC地址（ mac— address— N ): 用于标识用户 N的 MAC地 址。 该字段长度为 6个字节。 通过接收所述 DHCP服务器发送来的回应报文， 解析判断 subtype值 为 2 , 则认为此报文为 DHCP回应的包含用户信息的响应报文， 通过解析 此报文可以获得用户信息，所述用户信息包含用户的 IP地址、 MAC地址， 其中 IP地址、 MAC地址是生成 DHCP Snooping绑定表的关键字段。
106 ,通过所述 MAC地址查找 MAC表获得用户虚拟局域网 VLAN号 和入端口号， 根据所述用户 IP地址、 MAC地址、 VLAN号及入端口号生 成 DHCP Snooping绑定表。
通过步骤 104获得的所述用户 MAC信息进一步查找 MAC地址表， 可以获得所述用户的入端口号和 VLAN号， 进而得到了生成 DHCP Snooping绑定表的所有信息， 所述 MAC地址表是二层转发表， 其中包含 了用户的入端口号、 VLAN号等信息，根据获得的所述用户 IP地址、 MAC 地址、 入端口号、 VLAN号即可生成 DHCP Snooping绑定表。
可见， 通过本发明实施提供的方法， 可以为 DHCP Snooping启动之前 已经和 DHCP服务器建立连接的用户生成 DHCP Snooping绑定表， 从而 可以解决 DHCP Snooping启动过程中由于部分用户 DHCP Snooping绑定 表缺失导致的部分用户流量丟失的问题。
实施例二：
本发明实施例提供了一种 DHCP Snooping绑定表生成的方法，参见图 6, 图 6为本发明实施例的方法流程图， 与实施例一相比， 本发明实施例 在实施例一 102步骤之前进一步增加了设置 DHCP Snooping监控网段信息
Snooping所监控的用户信息， 本发明实施例包括：
402 , 确定 DHCP Snooping监控的网段信息；
在网络设备通过命令行启动 DHCP Snooping功能之前， 进一步， 可以 设置所述 DHCP Snooping所监控的网段信息，所述监控的网段信息可以提 前和 DHCP服务器协商， DHCP服务器只向所述网络设备分配所述监控的 网段内的地址。
404 , 构造用于获得所述监控网段信息对应的 DHCP用户信息的请求 报文， 并将所述请求报文发送给 DHCP服务器；
用于获得 DHCP用户信息的请求报文目的地址默认为 0XFFFFFFFF, 以 广播的形式发送给所有 DHCP服务器， 当网络设备配置了 DHCP Relay时， 所述请求报文的目的地址可以为 DHCP Relay配置的 DHCP服务器地址， 这 样可以只向所述网络设备直接进行交互的 DHCP服务器进行发送所述请求报 文。 所述请求报文可以对 DHCP Inform进行扩展， 该报文通过模拟用户端发 送给 DHCP服务器， 所述扩展的 DHCP Inform 艮文是通过对艮文的选项 Options部分进行扩展来表示该报文为请求获得用户信息的报文。 所述 DHCP Inform报文消息格式如图 3所示， 其中选项 op字段值为 1 , 标识报文类型为 DHCP Inform。 扩展的 DHCP Inform请求报文 Options选项格式如图 7, 可以 包括：
1 )选项类型（ option type ): 用于标识本发明实施例所述请求及应答的交 互 ^艮文。 该字段长度为 1字节， 取值可以为 128到 255任一值， 优选的， 本 发明实施例定为 206。
2 )长度（ length ): 标识数据段信息数据长度。 该字段长度为 2字节， 取 值为 6, 标识数据段信息数据长度为 6字节， 其中包括： 1 个字节的子类型
( subtype ), 4个字节长度的监控网段地址（ ip ), 1个字节长度的监控网段地 址掩码 ( ip mask )„
3 )子类型 （subtype ): 用于标识所述报文类型的字段。 该字段长度为 1 字节， 取值为 1到 255任一值， 优选的， 本发明实施例定义为 1 , 用于标识
4 )监控网段地址（ip ): 用于标识 DHCP Snooping所监控的网段地址。 该字段长度为 4字节。
5 )监控网段地址掩码（ ip mask ):用于标识监控网段地址 ip的掩码长度。 该字段长度为 1个字节。
通过发送包含 DHCP Snooping监控网段信息的请求报文，从而使得网 络设备可以更精确的从 DHCP服务器获取 DHCP Snooping所监控的用户 信息， 避免保存冗余的 DHCP Snooping绑定表。
406 , 接收所述 DHCP服务器对应所述请求报文的回应报文， 提取所 述回应 4艮文中的所述用户信息，所述用户信息包含用户网际协议 IP地址、 媒体接入控制 MAC地址；
所述从 DHCP服务器接收的回应报文是 DHCP服务器通过 DHCPACK 报文扩展生成的， 所述 DHCPACK报文格式如图 3所示， 其中选项 op字 段值为 2 , 标识报文类型为 DHCPACK报文。 所述扩展的 DHCPACK报文 Options选项格式如图 5 , 可以包括：
1 )选项类型（ option type ): 用于标识本发明实施例所述请求及应答的交 互报文。 该字段长度为 1字节， 取值可以为 128到 255任一值， 优选的， 本 发明实施例定为 206。
2 )长度（ length ): 标识数据段信息数据长度。 该字段长度为 2字节， 取 值为 10*N+1 , 标识数据段信息数据长度为 10*N+1字节， 其中 10为用户 IP 地址和 MAC地址长度之和 , N标识用户个数。
3 )子类型 （subtype ): 用于标识所述报文类型的字段。 该字段长度为 1 字节， 取值为 1到 255任一值， 为了标识与请求报文类型的区别， 优选本发 明实施例定义为 2 , 用于标识所述 DHCPACK报文为对应于所述请求报文的 回应报文。
4 )用户 A的 IP地址（ ip_address_A ): 用于标识用户 A的 IP地址。 该 字段长度为 4字节。
5 )用户 A的 MAC地址（ mac— address— A ): 用于标识用户 A的 MAC地 址。 该字段长度为 6个字节。
6 )用户 N的 IP地址（ ip_address_N ): 用于标识用户 A的 IP地址。 该 字段长度为 4字节。
7 )用户 N的 MAC地址（ mac— address— N ): 用于标识用户 A的 MAC地 址。 该字段长度为 6个字节。
所述 DHCP服务器通过解析所述请求报文可以获得用户的网段信息， 所述用户信息包含用户的 IP地址、 MAC地址， 其中 IP地址、 MAC地址 是 DHCP Snooping绑定表的关键表项。
408 ,通过所述 MAC地址查找 MAC表获得用户虚拟局域网 VLAN号 和入端口号， 根据所述用户 IP地址、 MAC地址、 VLAN号及入端口号生 成 DHCP Snooping绑定表。
通过步骤 406获得的所述用户 MAC信息进一步查找 MAC地址表， 可以获得所述用用户的入端口号和 VLAN号， 进而得到了生成 DHCP Snooping绑定表的所有信息， 根据获得的所述用户 IP地址、 MAC地址、 入端口号、 VLAN号生成用户的 DHCP Snooping绑定表。
可见， 通过本发明实施提供的方法， 可以为 DHCP Snooping启动之前 已经和 DHCP服务器建立连接的用户生成 DHCP Snooping绑定表， 从而 可以解决 DHCP Snooping启动过程中由于部分用户 DHCP Snooping绑定 表缺失导致的用户流量丟失的问题， 同时， 相对于实施例一， 本实施例可 以精确的的从 DHCP服务器获得 DHCP Snooping所监控的客户信息， 避 免存储冗余的用户信息。
实施例三：
本发明实施例提供了一种 DHCP Snooping表项生成的装置， 参见图 8 , 图 8为本发明实施的装置示意图，优选的， 该装置包括： 报文发送单元 802 , 报文接收单元 804 , 报文处理单元 806。
报文发送单元 802,用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给 DHCP服务器， 所述请求报文可以通过对 DHCP Inform报文 扩展生成， 具体扩展的报文格式可以参见本发明实施例一步骤 102; 报文接收单元 804, 接收所述 DHCP服务器对应所述请求报文的回应报 文， 提取所述回应报文中的所述用户信息， 所述用户信息包含用户网际协议 IP地址、 媒体接入控制 MAC地址， 所述回应报文可以通过对 DHCPACK扩 展生成， 具体扩展的报文格式可以参见本发明实施例一步骤 104;
^艮文处理单元 806 ,通过所述 MAC地址查找 MAC表获得用户虚拟局 域网 VLAN号和入端口号， 根据所述用户 IP地址、 MAC地址、 VLAN号 及入端口号生成 DHCP Snooping绑定表。
进一步， 所述装置还可以包括网段设置单元 808 , 用于设置网络设备 DHCP Snooping监控的网段信息， 相应地， 所述报文发送单元构造的获得 用户信息的请求报文包含所述监控的网段信息， 所述请求报文可以是对 DHCP Inform报文的扩展， 具体扩展的报文格式可以参见本发明实施例二 步骤 402。
可选的， 所述装置还可以包括： 报文请求单元， 报文处理单元。
报文请求单元， 用于构造请求报文， 所述请求报文包括动态主机配置协 议通告 DHCP Inform报文， 所述请求报文用于获得 DHCP用户信息， 所述 用户信息包括用户 IP地址、 MAC地址， 所述 DHCP Inform 4艮文的选项 Options部分的扩展可以参见发明实施例一步骤 102;
报文处理单元， 用于接收针对所述请求报文的回应报文， 提取所述用 户信息， 进一步， 根据所述获得的用户信息生成 DHCP Snooping绑定表， 所述回应 文包括动态主机配置协议响应 DHCPACK ^艮文， 并且对所述 DHCPACK选项部分的扩展生成， 具体扩展的报文格式可以参见本发明实 施例一步骤 104。
实施例四：
本发明实施例提供了一种 DHCP Snooping表项生成的系统， 参见图 9, 图 9为本发明实施例的系统示意图， 该系统包括： 网络设备 902、 DHCP服务 器 904。 网络设备 902 , 用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给 DHCP 服务器， 进一步， 接收所述 DHCP 服务器对应所 述请求报文的回应报文， 提取所述回应报文中得所述用户信息， 根据所述 用户信息生成 DHCP Snooping绑定表；
优选的， 网络设备 902包括： ^艮文发送单元 802, ^艮文接收单元 804 , 才艮文处理单元 806。 ^艮文发送单元 802 , 用于构造获得用户信息的请求才艮 文， 并将所述请求报文发送给 DHCP 服务器， 所述请求报文可以通过对 DHCP Inform报文扩展生成， 具体扩展的报文格式可以参见本发明实施例 一步骤 102; 报文接收单元 804 , 用于接收所述 DHCP 服务器对应所述请 求报文的回应报文，所述 DHCP服务器的回应报文可以通过对 DHCPACK 扩展生成， 具体扩展的报文格式可以参见本发明实施例一步骤 104; 报文 处理单元 806 , 用于提取所述回应报文中的所述用户信息， 并根据所述提 取的 DHCP用户信息生成 DHCP Snooping绑定表。
进一步， 所述网络设备还可以包括网段设置单元 808, 用于设置网络 设备 DHCP Snooping监控的网段信息， 相应地， 所述报文发送单元构造的 获得用户信息的请求报文包含所述监控的网段信息， 所述请求报文可以是 对 DHCP Inform报文的扩展，具体扩展的报文格式可以参见本发明实施例 二步骤 402。
可选的， 所述网络设备还可以包括： 文请求单元， 文处理单元。 报文请求单元， 用于构造请求报文， 所述请求报文包括动态主机配置协 议通告 DHCP Inform报文， 所述请求报文用于获得 DHCP用户信息， 所述 用户信息包括用户 IP地址、 MAC地址， 所述 DHCP Inform 4艮文的选项 Options部分的扩展可以参见发明实施例一步骤 102;
报文处理单元， 用于接收针对所述请求报文的回应报文， 提取所述用 户信息， 进一步， 根据所述获得的用户信息生成 DHCP Snooping绑定表， 所述回应 文包括动态主机配置协议响应 DHCPACK ^艮文， 并且对所述 DHCPACK选项部分的扩展生成， 具体扩展的报文格式可以参见本发明实 施例一步骤 104。
DHCP 服务器 904 , 用于接收网络设备发送来的所述请求报文， 构造 包含用户信息的回应报文， 并将所述回应报文发送给网络设备。
可见， 通过本发明实施提供的装置、 网络设备及系统， 可以为 DHCP
Snooping启动之前已经和 DHCP服务器建立连接的用户生成 DHCP Snooping绑定表，从而可以解决 DHCP Snooping启动过程中由于部分用户 DHCP Snooping绑定表缺失导致的用户流量丟失的问题。
本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步 骤可以通过程序指令相关的硬件来完成， 前述程序可以存储于一计算机可 读取存储介质中， 该程序在执行时， 执行包括上述方法实施例的步骤； 而 前述的存储介质包括： ROM、 RAM, 磁碟或者光盘等各种可以存储程序 代码的介质。
最后应说明的是： 以上实施例仅用以说明本发明的技术方案， 而非对其 限制； 尽管参照前述实施例对本发明进行了详细的说明， 本领域的普通技 术人员应当理解： 其依然可以对前述各实施例所记载的技术方案进行修改， 或者对其中部分技术特征进行等同替换； 而这些修改或者替换， 并不使相应 技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims

权 利 要 求 书
1、 一种动态主机配置协议监听 DHCP Snooping绑定表生成的方法， 其特征在于， 包括：
构造用于获得 DHCP用户信息的请求报文， 并将所述请求报文发送给 DHCP服务器；
接收所述 DHCP服务器对应所述请求 文的回应^艮文， 提取所述回应 报文中的所述用户信息， 所述用户信息包含用户网际协议 IP地址、 媒体 接入控制 MAC地址；
通过所述 MAC地址查找 MAC表获得用户虚拟局域网 VLAN号和入 端口号， 根据所述用户 IP地址、 MAC地址、 VLAN号及入端口号生成 DHCP Snooping绑定表。
2、 根据权利要求 1所述的方法， 其特征在于， 所述用户信息为 DHCP Snooping启动前已经与所述 DHCP服务器建立连接的用户的用户信息。
3、 根据权利要求 1或 2所述的方法， 其特征在于， 所述构造用于获 得 DHCP用户信息的请求报文之前， 还包括：
确定 DHCP Snooping监控的网段信息；
相应地， 所述请求报文包含所述监控的网段信息， 进而所述回应报文 中的所述用户信息为所述监控网段内的用户信息。
4、根据权利要求 1或 2所述的方法，其特征在于，所述请求报文包括： 所述请求报文为动态主机配置协议通告 DHCP Inform报文， 所述
DHCP Inform才艮文的选项 Options部分包括：
报文类型字段， 标识所述请求报文为用于获得所述用户信息的请求报 文。
5、 根据权利要求 3所述的方法， 其特征在于， 所述请求报文包括： 所述请求报文为动态主机配置协议通告 DHCP Inform报文， 所述
DHCP Inform才艮文的选项 Options部分包括： 报文类型字段， 标识所述请求报文为用于获得所述用户信息的请求报 文；
网段信息字段， 标识所述监控网段信息的字段。
6、 根据权利要求 4或 5所述的方法， 其特征在于， 所述回应 ^艮文包 括：
所述回应报文为动态主机配置协议响应 DHCPACK报文， 所述
DHCPACK ^艮文的选项 Options部分包括：
才艮文类型字段， 标识所述回应 ^艮文为对应所述请求 ^艮文的回应 ^艮文； 用户 IP地址字段， 标识所述用户 IP地址的字段；
用户 MAC地址字段， 标识所述用户的 MAC地址字段。
7、 根据权利要求 1-3任一权利要求所述的方法， 其特征在于， 所述请 求报文的目的地址默认为 0XFFFFFFFF , 当配置了动态主机配置协议中继 DHCP Relay时候， 所述请求 4艮文的目的地址为 DHCP Relay配置的 DHCP 服务器地址。
8、 一种动态主机配置协议监听 DHCP Snooping绑定表生成的装置， 其特征在于， 所述装置包括：
报文发送单元， 用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给 DHCP 服务器；
报文接收单元， 用于接收所述 DHCP服务器对应所述请求报文的回应 报文， 提取所述回应报文中的所述用户信息， 所述用户信息包含用户网际 协议 IP地址、 媒体接入控制 MAC地址；
报文处理单元， 用于通过所述 MAC地址查找 MAC表获得用户虚拟 局域网 VLAN号和入端口号， 根据所述用户 IP地址、 MAC地址、 VLAN 号及入端口号生成 DHCP Snooping绑定表。
9、 根据权利要求 8所述的装置， 其特征在于， 进一步包括：
网段确定单元， 用于确定 DHCP Snooping监控的网段信息， 相应地， 所述请求报文包含所述监控的网段信息， 进而所述回应报文中的所述用户 信息为所述监控网段内的用户信息。
10、 一种网络设备， 其特征在于， 所述网络设备包括权利要求 8或 9 所述的装置。
11、 一种动态主机配置协议监听 DHCP Snooping绑定表生成的系统， 其特征在于， 包括网络设备和与网络设备进行信息交互的 DHCP服务器； 所述网络设备， 用于构造获得 DHCP用户信息的请求报文， 并将所述 请求报文发送给所述 DHCP服务器；接收所述 DHCP服务器对应所述请求 报文的回应报文， 提取所述回应报文中的所述用户信息， 所述用户信息包 含用户网际协议 IP地址、 媒体接入控制 MAC地址， 根据所述用户信息生 成 DHCP Snooping绑定表；
所述 DHCP服务器， 用于接收所述请求报文， 并构造针对所述请求报 文的回应报文， 所述回应报文包含了所述 DHCP用户信息。
PCT/CN2012/075059 2011-11-16 2012-05-04 一种DHCPSnooping绑定表生成的方法、装置、设备及系统 WO2012163215A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP12792507.1A EP2757743B1 (en) 2011-11-16 2012-05-04 Method, device, apparatus and system for generation of dhcp snooping binding table
US14/272,613 US9883010B2 (en) 2011-11-16 2014-05-08 Method, apparatus, device and system for generating DHCP snooping binding table

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110362774.5A CN102413044B (zh) 2011-11-16 2011-11-16 一种DHCP Snooping绑定表生成的方法、装置、设备及系统
CN201110362774.5 2011-11-16

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/272,613 Continuation US9883010B2 (en) 2011-11-16 2014-05-08 Method, apparatus, device and system for generating DHCP snooping binding table

Publications (1)

Publication Number Publication Date
WO2012163215A1 true WO2012163215A1 (zh) 2012-12-06

Family

ID=45914903

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/075059 WO2012163215A1 (zh) 2011-11-16 2012-05-04 一种DHCPSnooping绑定表生成的方法、装置、设备及系统

Country Status (4)

Country Link
US (1) US9883010B2 (zh)
EP (1) EP2757743B1 (zh)
CN (1) CN102413044B (zh)
WO (1) WO2012163215A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102413044B (zh) * 2011-11-16 2015-02-25 华为技术有限公司 一种DHCP Snooping绑定表生成的方法、装置、设备及系统
CN105991791A (zh) * 2015-05-12 2016-10-05 杭州迪普科技有限公司 报文转发方法及装置
US10200342B2 (en) * 2015-07-31 2019-02-05 Nicira, Inc. Dynamic configurations based on the dynamic host configuration protocol
CN106487742B (zh) * 2015-08-24 2020-01-03 阿里巴巴集团控股有限公司 用于验证源地址有效性的方法及装置
CN105592057B (zh) * 2015-09-28 2018-10-09 新华三技术有限公司 轻量级双协议栈组网下的安全增强方法及装置
CN106603348B (zh) * 2017-02-14 2019-10-11 上海斐讯数据通信技术有限公司 一种模拟DHCP Offer泛洪的方法及系统
CN108667638B (zh) * 2017-03-28 2020-11-06 华为技术有限公司 一种网络业务配置方法及网络管理设备
CN113973101A (zh) * 2020-07-25 2022-01-25 华为技术有限公司 一种表项信息处理方法及装置
CN112383646B (zh) * 2020-11-13 2022-04-22 新华三大数据技术有限公司 一种安全表项的配置方法、装置、sdn控制器及介质
US12069098B2 (en) 2021-10-22 2024-08-20 Cisco Technology, Inc. Security policy enforcement for resources in bridge mode
US11606333B1 (en) 2022-03-04 2023-03-14 Cisco Technology, Inc. Synchronizing dynamic host configuration protocol snoop information

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101039176A (zh) * 2007-04-25 2007-09-19 华为技术有限公司 一种dhcp监听方法及其装置
CN101150582A (zh) * 2007-10-22 2008-03-26 华为技术有限公司 分配配置信息的方法和设备
CN101227407A (zh) * 2008-01-25 2008-07-23 华为技术有限公司 基于二层隧道协议的报文发送方法及装置
CN102413044A (zh) * 2011-11-16 2012-04-11 华为技术有限公司 一种DHCP Snooping绑定表生成的方法、装置、设备及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080095114A1 (en) * 2006-10-21 2008-04-24 Toshiba America Research, Inc. Key Caching, QoS and Multicast Extensions to Media-Independent Pre-Authentication
US7653063B2 (en) * 2007-01-05 2010-01-26 Cisco Technology, Inc. Source address binding check
US8089967B2 (en) * 2007-04-06 2012-01-03 International Business Machines Corporation Modification of a switching table of an internet protocol switch
CN101610206B (zh) * 2008-06-17 2012-04-18 华为技术有限公司 一种绑定/解绑定的处理方法、系统和装置
US8285875B2 (en) * 2009-01-28 2012-10-09 Juniper Networks, Inc. Synchronizing resource bindings within computer network
US8918531B2 (en) * 2009-05-07 2014-12-23 Cisco Technology, Inc. Automated network device provisioning using dynamic host configuration protocol
US8732281B2 (en) * 2009-05-13 2014-05-20 Cisco Technology, Inc. Actively updating clients with selected data
US8380819B2 (en) * 2009-05-14 2013-02-19 Avaya Inc. Method to allow seamless connectivity for wireless devices in DHCP snooping/dynamic ARP inspection/IP source guard enabled unified network
US8509244B2 (en) * 2009-08-14 2013-08-13 Telefonaktiebolaget L M Ericsson (Publ) Method and apparatus for providing host node awareness for multiple NAT64 environments
CN102594652B (zh) * 2011-01-13 2015-04-08 华为技术有限公司 一种虚拟机迁移方法、交换机、虚拟机系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101039176A (zh) * 2007-04-25 2007-09-19 华为技术有限公司 一种dhcp监听方法及其装置
CN101150582A (zh) * 2007-10-22 2008-03-26 华为技术有限公司 分配配置信息的方法和设备
CN101227407A (zh) * 2008-01-25 2008-07-23 华为技术有限公司 基于二层隧道协议的报文发送方法及装置
CN102413044A (zh) * 2011-11-16 2012-04-11 华为技术有限公司 一种DHCP Snooping绑定表生成的方法、装置、设备及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2757743A4 *

Also Published As

Publication number Publication date
CN102413044A (zh) 2012-04-11
US9883010B2 (en) 2018-01-30
US20140244733A1 (en) 2014-08-28
EP2757743A4 (en) 2015-03-25
CN102413044B (zh) 2015-02-25
EP2757743B1 (en) 2016-07-06
EP2757743A1 (en) 2014-07-23

Similar Documents

Publication Publication Date Title
WO2012163215A1 (zh) 一种DHCPSnooping绑定表生成的方法、装置、设备及系统
JP4794312B2 (ja) イーサネット・ベースのネットワーク内の擬似ワイヤ・ピア・アドレスの自動検出
WO2012094898A1 (zh) 一种虚拟机迁移方法、交换机、虚拟机系统
WO2014101394A1 (zh) 可扩展虚拟局域网报文的传输方法及装置、系统
WO2016192608A2 (zh) 身份认证方法、身份认证系统和相关设备
WO2009094928A1 (fr) Procédé et équipement de transmission d'un message basé sur le protocole de tunnel de niveau 2
WO2011140795A1 (zh) 一种防止介质访问控制地址欺骗攻击的方法和交换设备
EP2782309A1 (en) Bidirectional forwarding detection (bfd) session negotiation method, device and system
WO2014019451A1 (zh) 一种快速通知cgn异常的方法、设备及系统
WO2010060246A1 (zh) 实现arp请求广播限制的方法和装置
EP2346217A1 (en) Method, device and system for identifying ip session
WO2009030173A1 (fr) Procédé de traitement et dispositif pour la configuration de raccordement qinq
WO2014019348A1 (zh) 操作、管理和维护oam配置的方法、设备及系统
CN100561969C (zh) 一种基于PPPoE的宽带接入方法
WO2011144152A1 (zh) 信息提供方法及家庭网关、家庭网络系统
WO2008151548A1 (fr) Procédé et appareil pour empêcher l'usurpation de l'adresse de commande d'accès au support (mac) côté réseau
WO2012006888A1 (zh) 一种实现虚拟媒体访问控制地址的方法及装置
US10742751B2 (en) User based mDNS service discovery
WO2015081551A1 (zh) 一种网络中实现报文路由的方法、设备和系统
WO2008058477A1 (fr) Procédé, appareil et système de gestion d'informations de localisation
WO2020098435A1 (zh) 一种数据报文发送和接收方法、存储介质及处理器
WO2011144138A1 (zh) 实现路由聚合的方法、装置和系统
WO2015127736A1 (zh) 一种用户隐私保护的方法、设备和系统
WO2009135422A1 (zh) 一种QinQ内广播的实现方法和装置
WO2015024373A1 (zh) 一种虚拟机通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12792507

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2012792507

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2012792507

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE