WO2013020501A1

WO2013020501A1 - Method and device for verifying address resolution protocol (arp) request message

Info

Publication number: WO2013020501A1
Application number: PCT/CN2012/079794
Authority: WO
Inventors: 李振海
Original assignee: 华为技术有限公司
Priority date: 2011-08-08
Filing date: 2012-08-08
Publication date: 2013-02-14
Also published as: CN102255984B; CN102255984A

Abstract

The embodiments of the present invention provide a method for verifying an ARP request message, the method comprises the following step: a gateway receives an ARP request message; if the gateway does not find a matching item for the ARP request message in an ARP cache list, the gateway sends an ARP verifying message of which source internet protocol (IP) address and media access control (MAC) address are a verification IP address and a verification MAC address respectively, wherein the verification IP address and the IP address of the gateway belong to the same network segment and the verification IP address is different from the IP address of the gateway; the gateway receives the first message; if the first message is a response message corresponding to the ARP verifying message, the first message is uploaded to the control plane of the gateway. In addition, the embodiments of the present invention also provide a corresponding device for verifying an ARP request message. The method and device for ARP request message verification provided by the embodiments of the present invention can resolve the problem of some network equipment being unable to access an external network due to ARP request message responses being only in the data plane.

Description

Method and device for verifying ARP request message

The embodiments of the present invention relate to communication technologies, and in particular, to an address resolution protocol (ARP) request packet verification method and apparatus.

Background technique

Currently, ARP is widely used in Internet Protocol (IP) networks. To implement communication with the external network, the local area network host needs to send an ARP request packet to the gateway to obtain the Media Access Control (MAC) address of the device of the gateway, so as to implement communication between the network devices. If the gateway fails to respond to the ARP request packet correctly and in time, the LAN host will not be able to communicate with the external network. An ARP attack on the gateway may affect the gateway's response to ARP request packets.

In response to ARP attacks, the industry has proposed corresponding solutions. For example, after receiving the ARP request packet, the data plane of the gateway responds only to the ARP request packet in the data plane, and does not send it to the control plane of the gateway. The data plane of the gateway has a strong ability to process ARP request packets, so it can better deal with ARP attacks.

However, the data plane of the gateway cannot effectively process all types of ARP request packets. For example, some ARP request packets contain two layers of Virtual Local Area Network (VLAN) tags (hereinafter referred to as Q pairs, refer to IEEE802.1ad for details). After receiving the ARP request packet containing the Q pair, the gateway needs to generate an index according to the Q pair included in the ARP request packet. The index range of the Q pair is very large (about 2 to the 24th power), and it is costly to establish a user session table containing 2 ²⁴ entries in the data plane. In practical applications, the user plane table of the data plane has fewer entries, generally tens of K. Therefore, the value of the index ranges from 0 to tens of 。. The control plane of the gateway triggers the dynamic learning Q pair and allocates the user session table index by using the ARP request packet of the user host to establish a mapping relationship between the Q pairs of the larger value range and the user session table of the smaller value range. Establish mappings and deliver data to the gateway The plane establishes a talk session. If the ARP request packet is not sent to the control plane for processing, the user session table cannot be established, and the user host cannot communicate with the external network.

Therefore, responding to ARP request packets only on the data plane may cause some network devices to be unable to access the external network.

Summary of the invention

The embodiment of the invention provides a method for verifying an ARP request packet, which can solve the problem that only the network device can respond to the ARP request packet, which may cause some network devices to fail to access the external network.

In one aspect, an ARP request packet verification method for an address resolution protocol provided by an embodiment of the present invention includes:

The gateway receives the ARP request packet.

If the gateway does not query the ARP request packet in the ARP cache table, the gateway sends an ARP authentication packet. The destination Internet Protocol IP address of the ARP authentication packet is the source IP address of the ARP request packet. The source IP address and the source media access control MAC address of the ARP authentication packet are respectively a verification IP address and a risk MAC address, and the verification IP address and the IP address of the gateway are addresses of the same network segment, and the verification IP address The address is different from the IP address of the gateway;

The gateway receives the first packet, and determines whether the first packet is a response corresponding to the ARP verification packet.

If the first packet is a response packet corresponding to the ARP authentication packet, the first packet is sent to the control plane of the gateway.

On the other hand, an ARP request packet verification apparatus provided by the embodiment of the present invention includes: a receiver, where the gateway is configured to receive an ARP request packet;

a sender, if the gateway does not query an entry matching the ARP request packet in the ARP cache table, the gateway sends an ARP verification packet, where the destination Internet Protocol IP address of the ARP verification packet is the ARP request Source IP address of the packet, the source IP address of the ARP authentication packet. The address and the source media access control MAC address are respectively a risk certificate IP address and a risk certificate MAC address, and the verification IP address is an address of the same network segment as the IP address of the gateway, and the verification IP address is different from the IP address of the gateway;

a judging unit, the gateway is configured to receive the first packet, and determine whether the first packet is a response corresponding to the ARP certificate.

The sending unit is configured to send the first packet to the control plane of the gateway if the first packet is a response packet corresponding to the ARP verification packet.

It can be seen that the ARP request packet verification method and device provided by the embodiment of the present invention can solve the problem that only the data plane responds to the ARP request packet, which may cause some network devices to fail to access the external network.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments or the description of the prior art will be briefly described below, and obviously, the attached in the following description The drawings are some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

FIG. 1 is a structural diagram of a network for providing an ARP request packet verification method and apparatus for applying to a certain scene;

2 is a flowchart of a method for verifying an ARP request packet according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of an ARP request packet verification apparatus according to an embodiment of the present invention.

Specific lung

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the invention provides an ARP request packet verification method and device, which can solve only Responding to the ARP request packet on the data plane may cause some network devices to fail to access the external network. FIG. 1 is a structural diagram of networking of an application scenario according to an embodiment of the present invention.

The network diagram of Figure 1 consists of seven PCs, a switch, a router, and the Internet. The seven personal computers are Personal Computer (PC) 1, PC2, PC3, PC4, PC5, PC6 and PC7. PC 1 to PC7 form the office i or network; one switch is the switch (Switch, SW) 1; One router is a router (Router, R) 1 , R1 is the gateway of the local area network, and PC1 to PC7 are connected to R1 through SW1, respectively, and R1 is connected to the Internet. Since seven PCs are in the LAN, when accessing the Internet, they need to pass through the gateway Rl. In response to R1, an ARP attack may be initiated by a host on the LAN. R1 responds to the ARP request packet sent by the LAN host only on the data plane. As the ARP request packet sent by PC1 contains two VLAN tags, R1 can only respond to ARP request packets on the data plane, which may result in PC1 being unable to access the Internet.

Embodiment 1:

The embodiment of the present invention provides an ARP request packet verification method, which can be used in the networking structure shown in FIG. 1 , and FIG. 2 is a flowchart of an ARP request packet verification method according to an embodiment of the present invention. The method includes:

201: The gateway receives the ARP request packet.

In a specific implementation, the foregoing ARP request packet may be sent by a host in a local area network. The host can be connected to the gateway through a twisted pair cable or through a fiber to the gateway. The host can be directly connected to the gateway or connected to the gateway through a network device.

Taking the scenario shown in Figure 1 as an example, PC1 sends an ARP Request message to R1.

202: If the gateway does not query the entry matching the ARP request packet in the ARP cache table, the gateway sends an ARP verification packet. The destination Internet Protocol IP address of the ARP authentication packet is the source IP address of the ARP request packet. The source IP address and the source media access control MAC address of the ARP authentication packet are a verification IP address and a risk MAC address, respectively. The verification IP address is the same network address as the IP address of the gateway. The insurance certificate IP address is different from the IP address of the gateway. The ARP cache table is located on the data plane of the gateway and is used to verify ARP request packets. The ARP cache table may include multiple entries, each of which includes an IP address and a MAC address corresponding to the IP address. If the gateway does not query the entry matching the source IP address and the source MAC address of the ARP request packet in the ARP cache table, the gateway sends an ARP authentication packet. The address of the ARP authentication packet and the IP address of the gateway are the same network segment. This ensures that the response packet sent by the host to the ARP authentication packet can reach the gateway. The destination IP address of the ARP authentication packet is the source IP address of the ARP request packet. This ensures that the host that sends the real ARP request packet to the local area network receives the ARP authentication packet sent by the gateway.

Referring to Figure 1, R1 receives the ARP request packet from PC1. Because the ARP request packet contains the Q pair, the user session table of the data plane of R1 does not have enough space to store the Q-to-ARP request packet sent by PC1. Respond to and generate an entry for the corresponding index. Therefore, R1 needs to access the PC1 at the control plane. R1 sends an ARP verification packet to PC1. The destination IP address of the ARP authentication packet is the IP address of the PC1. The source IP address and source MAC address of the ARP authentication packet are the IP address and the insurance card MAC address randomly generated by the R1 control plane. The verification IP address and the IP address of R1 are on the same network segment, and the verification IP address is different from the IP address of R1.

203: The gateway receives the first packet. Determine whether the first packet is a response corresponding to the ARP verification packet.

The gateway can receive the first packet and determine whether the first packet is a response packet corresponding to the ARP authentication packet. For example, the data plane of the gateway is provided with an ARP verification response table, and the ARP verification response table may include multiple entries, each of which includes a verification IP address and a verification MAC address, if the destination IP address and destination MAC address of the first message The first packet is a response packet corresponding to the ARP authentication packet, and is matched with an entry in the ARP certificate response table.

Referring to FIG. 1, the data plane of R1 is provided with an ARP verification response table, and the ARP verification response table includes a plurality of entries, each of which includes a risk IP address and a risk certificate MAC address. R1 received PC1 After the first packet is sent, the destination IP address and the destination MAC address of the first packet match an entry in the ARP authentication response table, and the first packet is determined to be a response packet corresponding to the ARP verification packet.

204: If the first packet is a response packet corresponding to the ARP verification packet, send the first packet to the control plane of the gateway.

Referring to Figure 1, R1 determines that the first packet is a response packet corresponding to the ARP authentication packet, and R1 sends the first packet to the control plane of R1 for processing.

It can be seen that the ARP request packet verification method proposed by the embodiment of the present invention can solve the problem that only the data plane responds to the ARP request packet, which may cause some network devices to fail to access the external network.

further,

The verification MAC address in the ARP verification message is different from the verification MAC address in the previous ARP certificate issued by the gateway.

further,

The gateway sends ARP authentication packets specifically:

The gateway obtains the verification IP address and the verification MAC address of the ARP verification packet through the ARP verification request table. The ARP verification request table includes at least one entry. The third entry is the same as the first entry. The third entry is one entry of the ARP verification request table. The first entry is one entry in the ARP authentication response table. The ARP verification response table includes at least two entries, each of which contains a verification IP address and a verification MAC address. The verification MAC addresses in the at least two entries are different from each other. The ARP verification request form is a subset of the ARP insurance response form.

further,

The determining whether the first packet is a response packet corresponding to the ARP verification packet includes: determining, by the ARP verification response table, whether the first packet is a response packet corresponding to the ARP verification packet. Determining the first report when the destination IP address of the first packet is equal to the verification IP address of the first entry, or when the destination MAC address of the first packet is equal to the verification MAC address of the first entry The text is the response packet corresponding to the ARP authentication packet. The ARP authentication request table exists in the data plane of the gateway, and the ARP authentication request table includes at least one entry. The third entry is the same as the first entry. The third entry is one entry in the ARP authentication request table, and the first entry is one entry in the ARP authentication response table. The technical effects of the ARP authentication packet are obtained from the ARP authentication request table. After receiving the response packet corresponding to the ARP authentication packet, the gateway can find a match in the ARP authentication response table. Entry. The third entry may be one entry in the ARP authentication response table (that is, the first entry), or may be one entry that is independent of the first entry of the ARP authentication response table.

The ARP Verification Request Table is a subset of the ARP Verification Response Table. In this way, the ARP authentication packet sent by the gateway contains the verification IP address and the verification MAC address provided by the ARP verification request table. After the ARP authentication packet arrives at the host where the ARP request packet is sent, the host sends a response packet corresponding to the ARP authentication packet to the gateway. The response packet corresponding to the ARP authentication packet must also contain the verification IP address and the verification MAC address provided by the ARP authentication request table. After the ARP authentication packet arrives at the gateway, it will match an entry in the ARP authentication response table of the data plane of the gateway. Therefore, after receiving the packet, the gateway can match whether the packet matches an entry in the ARP authentication response table of the data plane of the gateway, and whether the packet is a response packet corresponding to the ARP verification packet. Judge. The ARP verification response table exists in the data plane of the gateway. The ARP verification response table includes at least two entries, and the verification MAC addresses in the at least two entries are different from each other. The achievable technical effects include: at least two entries can be used to ensure that the first packet is a response to the ARP authentication packet. Message, another entry in the ARP Verification Response Table is used to be updated to a new entry.

The ARP verification response table is configured to determine whether the first packet is a response packet corresponding to the ARP authentication packet, and when the destination IP address of the first packet is equal to the verification IP address of the first entry, or when the first packet is When the destination MAC address of the packet is equal to the authentication MAC address of the first entry, the first packet is determined to be a response packet corresponding to the ARP verification packet.

Referring to Figure 1, R1 has an ARP verification request table on the data plane, and R1 is verified by ARP. The table obtains the verification IP address and the verification MAC address of the ARP verification packet, and R1 uses the first entry of the ARP verification response table as the ARP verification request table. R1 has an ARP verification response table on the data plane. The ARP verification response table includes two entries, that is, the first entry and the second entry. The verification MAC address of the first entry and the verification MAC address of the second entry are not the same. After receiving the first packet sent by the PC1, the R1 searches the ARP authentication response table for the entry that matches the first packet. If the destination IP address of the first packet is equal to the first entry of the ARP authentication response table. If the authentication IP address of the first packet is equal to the authentication MAC address of the first entry, the first packet is the response packet corresponding to the ARP authentication packet.

further,

Before the gateway issues the ARP insurance certificate, the method further includes: after the gateway sends the previous ARP verification message, the verification MAC address of the third entry is updated to the first verification MAC address.

further,

Before receiving the response packet corresponding to the ARP verification packet, the gateway further includes: updating the verification MAC address of the first entry to the first verification MAC address. The second entry in the ARP verification response table is used to determine whether the packet received by the gateway is a response packet corresponding to the previous ARP verification packet. The first entry and the second entry are different entries in the ARP verification response table.

After the gateway receives the previous ARP request packet, the gateway sends the previous ARP request to the previous ARP request because the entry in the ARP cache table of the data plane does not match the previous ARP request packet. The risk certificate ^,文, the previous ARP risk certificate is used to determine whether the host that sent the previous ARP request message exists. After the gateway sends the previous ARP authentication packet, the gateway updates the verification MAC address of the third entry to the first authentication MAC address before sending the ARP authentication packet. The technical effect of the solution is that the verification MAC address of the ARP request message is different from the verification MAC address of the previous ARP verification message.

Before receiving the response packet corresponding to the ARP authentication packet, the gateway updates the verification MAC address of the first entry to the first verification MAC address, and the second entry in the ARP verification response table is used to determine Whether the packet received by the gateway is a response packet corresponding to the previous ARP authentication packet, and the first entry and the second entry are different entries in the ARP authentication response table. The technical effects of the solution include: ensuring that the gateway accurately determines the response packet corresponding to the ARP authentication packet and the response packet corresponding to the previous ARP authentication packet. The entry for determining the response packet corresponding to the ARP authentication packet and the entry for determining the response packet corresponding to the previous ARP authentication packet are different entries to ensure that the ARP verification response table is updated, thereby being available. The ARP verification packet sent by the updated ARP authentication request table is determined, and the gateway determines that the response packet corresponding to the ARP verification packet sent by the ARP authentication request table is updated. The authentication MAC address of the entry corresponding to the ARP authentication packet is different from that of the response packet corresponding to the previous ARP authentication packet, ensuring that the LAN host authenticates the packet through the ARP authentication packet. The response packet of the MAC address and the spoofed IP address spoofing will not be able to find the matching entry in the ARP authentication response table. That is, the spoofed response packet will not be sent to the control plane of the gateway.

Referring to Fig. 1, R1 implements the technical solution corresponding to the network structure diagram shown in Fig. 1 through a computer program. The ARP verification response table is stored in R1's Ternary Content Addressable Memory (TCAM), and the ARP verification response table includes two entries. The R1 control plane generates a verification IP address, and the verification IP address and the IP address of R1 are IP addresses of the same network segment, and the verification IP address is different from the IP address of R1. R1 sends the insurance IP address to the ARP verification request form and the ARP verification response table. The control plane of R1 sets a timer for updating the ARP verification request table and the ARP verification response table. The period of the timer can be 2 seconds to 5 seconds.

The ARP verification request table is stored in the memory of R1. The ARP verification request table includes one entry. The initialization process of the ARP verification response table is as follows:

The control plane of R1 randomly generates an authentication MAC address, and sends the risk MAC address to an entry in the ARP verification response table in the TCAM of the data plane of R1; the control plane of R1 will be in the TCAM of the data plane of R1. Another entry in the ARP Validation Response table is set to 0. The initialization process of the ARP verification request form is as follows:

R1 starts the timer;

The control plane of R1 sends the verification MAC address generated in the initialization process of the ARP response table to the ARP verification request table in the memory of the data plane of R1.

The timer of the R1 control plane expires, triggering R1 to update the ARP verification request table and the ARP certificate response table.

The update process of the ARP verification response table is as follows:

The R1 control plane randomly generates a verification MAC address. The verification MAC address is not equal to the verification MAC address generated by the R1 control plane in the initialization process of the ARP verification response table. The R1 control plane sends the verification MAC address to another entry in the ARP verification response table, and updates the verification MAC address of the entry.

The update process of the ARP verification request form is as follows:

The R1 control plane sends the verification MAC address generated in the update process of the ARP verification response table to the ARP verification request table located in the memory, and updates the verification MAC address of the ARP verification request table.

further,

The control plane that sends the first packet to the gateway specifically includes:

The control plane of the gateway queries the ARP cache table of the control plane according to the source IP address and the source MAC address of the first document to check whether there is a corresponding entry in the ARP cache table of the control plane. The control plane of the gateway generates a fourth entry that includes the source IP address and the source MAC address of the first packet, and the control plane of the gateway sends the fourth entry to the ARP cache table of the data plane of the gateway.

further,

The risk MAC is randomly generated by the control plane of the gateway and sent by the control plane of the gateway to the data plane of the gateway.

Embodiment 2: The embodiment of the invention provides an ARP request packet verification apparatus, which can be used in the networking structure shown in FIG. The ARP request message verification device may be R1 in FIG. Referring to FIG. 3, FIG. 3 is a schematic diagram of an ARP request packet verification apparatus according to an embodiment of the present invention. The apparatus includes: a receiver 301, where the gateway is configured to receive an ARP request packet.

The sender 302 is configured to: if the gateway does not query the ARP request packet, the gateway sends an ARP authentication packet, where the destination Internet Protocol IP address of the ARP authentication packet is the ARP Source IP address of the request packet. The source IP address and the source media access control MAC address of the ARP authentication packet are the insurance IP address and the risk MAC address respectively. The verification IP address is the same as the IP address of the gateway. The address of the segment, the verification IP address is different from the IP address of the gateway;

The ARP cache table is located on the data plane of the gateway and is used to verify ARP request packets. The ARP cache table may include multiple entries, each of which includes an IP address and a MAC address corresponding to the IP address. If the gateway does not query the entry in the ARP cache table that matches the source IP address and the source MAC address of the ARP request packet, the gateway sends an ARP authentication packet. The address of the ARP authentication packet and the IP address of the gateway are the same network segment address. This ensures that the response packet sent by the host to the ARP authentication packet can reach the gateway. The destination IP address of the ARP authentication packet is the source IP address of the ARP request packet. This ensures that the host that sends the real ARP request packet to the local area network receives the ARP authentication packet sent by the gateway.

Referring to Figure 1, R1 receives the ARP request packet from PC1. Because the ARP request packet contains the Q pair, the user session table of the data plane of R1 does not have enough space to store the Q-to-ARP request packet sent by PC1. Respond to and generate an entry for the corresponding index. Therefore, R1 needs The PCI is to be accessed at the control plane. R1 sends an ARP authentication packet to the PCI. The destination IP address of the ARP authentication packet is the IP address of the PC1. The source IP address and source MAC address of the ARP authentication packet are the IP address and the risk MAC address randomly generated by the R1 control plane. The verification IP address and the IP address of R1 are in the same network segment, and the verification IP address is different from the IP address of R1. The verification MAC address is different from the verification MAC address in the previous ARP verification packet sent by R1.

The determining unit 303 is configured to receive the first packet, and determine whether the first packet is a response packet corresponding to the ARP verification packet.

Referring to Figure 1, the data plane of R1 is provided with an ARP verification response table, and the ARP verification response table includes a plurality of entries, each of which includes a risk IP address and a risk certificate MAC address. R1 receives the first packet sent by the PC1, and the destination IP address and the destination MAC address of the first packet match an entry in the ARP authentication response table, and the first packet is determined to be the response corresponding to the ARP verification packet. Message.

The sending unit 304 is configured to send the first packet to the control plane of the gateway if the first packet is a response packet corresponding to the ARP verification packet.

Referring to Figure 1, R1 determines that the first packet is a response packet corresponding to the ARP authentication packet, and R1 sends the first packet to the control plane of R1 for access processing.

It can be seen that the ARP request packet verification apparatus provided by the embodiment of the present invention can solve the problem that only the data plane responds to the ARP request packet, which may cause some network devices to fail to access the external network.

further,

The verified MAC address in the ARP authentication packet is different from the previous ARP sent by the gateway. The verified MAC address in the 4th article.

further,

The transmitter specifically includes:

Obtaining a unit, the gateway is configured to obtain an authentication IP address and a verification MAC address of the ARP verification message by using an ARP verification request table. The ARP verification request table includes at least one entry. The third entry is the same as the first entry. The third entry is one entry of the ARP verification request table. The first entry is one entry in the ARP verification response table. The ARP verification response table includes at least two entries, each of which contains a verification IP address and a verification MAC address. The verification MAC addresses in the at least two entries are different from each other. The ARP verification request table is a subset of the ARP verification response table.

further,

The determining unit specifically includes:

The analyzing unit is configured to determine, by using the ARP verification response table, whether the first packet is a response packet corresponding to the ARP verification packet. Determining the first packet when the destination IP address of the first packet is equal to the verification IP address of the first entry, or the destination MAC address of the first packet is equal to the verification MAC address of the first entry. It is the response packet corresponding to the ARP authentication packet.

The ARP authentication request table exists in the data plane of the gateway, and the ARP authentication request table includes at least one entry. The third entry is the same as the first entry, and the third entry is one entry of the ARP verification request table. The first entry is one entry in the ARP verification response table. The technical effects of the ARP authentication packet are obtained from the ARP authentication request table. After receiving the response packet corresponding to the ARP authentication packet, the gateway can find a match in the ARP authentication response table. Entry. The third entry may be one entry in the ARP verification response table (that is, the first entry), or may be an entry that is independent of the first entry of the ARP authentication response table.

The ARP Verification Request Table is a subset of the ARP Verification Response Table. In this way, the ARP authentication packet sent by the gateway contains the verification IP address and the verification MAC address provided by the ARP verification request table. After the ARP verification packet arrives, the host that sent the ARP request packet to the real existence is the master. The machine feeds back the response packet corresponding to the ARP authentication packet to the gateway. The ARP authentication packet corresponding response message must also contain the verification IP address and the verification MAC address provided by the ARP verification request table. After the response packet corresponding to the ARP authentication packet arrives at the gateway, it will match an entry in the ARP authentication response table of the data plane of the gateway. Therefore, after receiving the packet, the gateway can match whether the packet matches an entry in the ARP authentication response table of the data plane of the gateway, and whether the packet is a response packet corresponding to the ARP verification packet. Judge. The ARP verification response table exists in the data plane of the gateway, and the ARP verification response table includes at least two entries, and the verification MAC addresses in the at least two entries are different from each other. The achievable technical effects include: at least two entries can be used to ensure that the first packet is a response to the ARP authentication packet. Message, another entry in the ARP Verification Response Table is used to be updated to a new entry.

Referring to Figure 1, R1 has an ARP authentication request table on the data plane. R1 obtains the verification IP address and the verification MAC address of the ARP verification packet through the ARP verification request table, and R1 uses the first entry of the ARP verification response table as the ARP authentication. Request form. R1 has an ARP verification response table on the data plane. The ARP verification response table includes two entries, that is, the first entry and the second entry. The verification MAC address of the first entry and the verification MAC address of the second entry are not the same. After receiving the first packet sent by the PC1, the R1 searches the ARP authentication response table for the entry that matches the first packet. If the destination IP address of the first packet is equal to the first entry of the ARP authentication response table. If the authentication IP address of the first packet is equal to the authentication MAC address of the first entry, the first packet is the response packet corresponding to the ARP authentication packet.

Further, the ARP request message verification device includes:

a first update unit, configured to send the previous one before the gateway sends an ARP verification message After the ARP verification packet, the verification MAC address of the third entry is updated to the first verification MAC address.

Further, the ARP request message verification device includes:

And a second updating unit, configured to: after the gateway receives the response packet corresponding to the ARP verification packet, update the verification MAC address of the first entry to the first verification MAC address. The second entry in the ARP authentication response table is used to determine whether the packet received by the gateway is a response packet corresponding to the previous ARP authentication packet. The first entry and the second entry are different entries in the ARP verification response table.

Before receiving the response packet corresponding to the ARP authentication packet, the gateway updates the verification MAC address of the first entry to the first verification MAC address, and the second entry in the ARP verification response table is used to determine that the gateway receives the response packet. Whether the packet is a response packet corresponding to the previous ARP authentication packet, and the first entry and the second entry are different entries in the ARP authentication response table. The technical effects of the solution include: ensuring that the gateway accurately determines the response packet corresponding to the ARP authentication packet and the response packet corresponding to the previous ARP authentication packet. The entry for determining the response packet corresponding to the ARP authentication packet and the entry for determining the response packet corresponding to the previous ARP authentication packet are different entries to ensure that the ARP verification response table is updated, thereby being available. The ARP verification packet sent by the updated ARP authentication request table is determined, and the gateway determines that the response packet corresponding to the ARP verification packet sent by the ARP authentication request table is updated. An entry for determining a response packet corresponding to the ARP verification packet and an entry for determining a response packet corresponding to the previous ARP verification packet Verify that the MAC address is different. Ensure that the MAC address host fails to find the matching entry in the ARP authentication response table by using the authentication MAC address in the ARP authentication packet and the response packet for authenticating the IP address. The fake response packet will not be Up to the control plane of the gateway.

Referring to Fig. 1, R1 implements the technical solution corresponding to the network structure diagram shown in Fig. 1 through a computer program. The ARP verification response table is stored in the TCAM of R1. The ARP verification response table includes two entries. The R1 control plane generates a verification IP address, and the verification IP address and the IP address of R1 are IP addresses of the same network segment, and the verification IP address is different from the IP address of R1. R1 delivers the insurance IP address to the ARP verification request form and the ARP verification response table. The control plane setting timer of R1 is used to update the ARP verification request table and the ARP verification response table. The period of the timer can be from 2 seconds to 5 seconds.

The ARP verification request table is stored in the memory of R1. The ARP verification request table includes one entry.

The initialization process of the ARP verification response table is as follows:

The control plane of R1 randomly generates an authentication MAC address, and sends the risk MAC address to an entry in the ARP verification response table in the TCAM of the data plane of R1; the control plane of R1 will be in the TCAM of the data plane of R1. Another entry in the ARP Validation Response table is set to 0.

The initialization process of the ARP verification request form is as follows:

R1 starts the timer;

The update process of the ARP verification response table is as follows:

The R1 control plane randomly generates a verification MAC address. The verification MAC address is not equal to the verification MAC address generated by the R1 control plane in the initialization process of the ARP verification response table. The R1 control plane sends the verification MAC address to another entry in the ARP verification response table, and updates the entry. Verify the MAC address.

The update process of the ARP verification request form is as follows:

Further, the sending unit further includes:

a query unit, configured by the control plane of the gateway, according to the source IP address and the source MAC address of the first packet, whether a corresponding entry exists in the ARP cache table of the control plane;

a generating unit, configured to: if the ARP cache table of the control plane does not have a corresponding entry, the control plane of the gateway generates a fourth entry that includes a source IP address and a source MAC address of the first packet;

The sending unit sends the fourth entry to the ARP cache table of the data plane of the gateway.

A person skilled in the art can understand that all or part of the steps of implementing the foregoing method embodiments may be implemented by hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and when executed, the program includes The foregoing steps of the method embodiment; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

An address resolution protocol ARP request packet verification method, which is characterized by:

The gateway receives the ARP request packet.

If the gateway does not query an entry matching the source Internet Protocol IP address and the source media access control MAC address of the ARP request message in the ARP cache table of the control plane, the gateway issues an ARP insurance certificate 4 The source IP address of the ARP authentication packet is the source IP address of the ARP request packet, and the source IP address and the MAC address of the ARP authentication packet are the verification IP address and the risk MAC address respectively. The verification IP address is an address of the same network segment as the IP address of the gateway, and the verification IP address is different from the IP address of the gateway;

The gateway receives the first packet, and determines whether the first packet is a response message corresponding to the ARP verification packet.

And sending the first packet to the control plane of the gateway, if the first packet is a response packet corresponding to the ARP verification packet.

2. The method of claim 1 wherein:

3. Method according to claim 1 or 2, characterized in that it:

The ARP verification packet sent by the gateway specifically includes:

The gateway obtains the verification IP address and the verification MAC address of the ARP verification packet by using the ARP verification request table, where the ARP verification request table includes at least one entry, and the third entry is the same as the first entry. The third entry is one entry of the ARP verification request table, where the first entry is one entry in the ARP verification response table, and the ARP verification response table includes at least two entries, each The entry includes a verification IP address and a verification MAC address, and the verification MAC addresses in the at least two entries are different from each other, and the ARP verification request table is a subset of the ARP verification response table.

4. The method of claim 3 wherein: The determining, by the determining whether the first packet is a response packet corresponding to the ARP verification packet, specifically includes:

Determining, by the ARP verification response table, whether the first packet is a response packet corresponding to the ARP verification packet, where the destination IP address of the first packet is equal to the verification IP address of the first entry. When the destination MAC address of the first packet is equal to the verification MAC address of the first entry, the first packet is determined to be a response packet corresponding to the ARP verification packet.

5. The method of claim 3, wherein:

Before the gateway sends the ARP certificate, the gateway further includes: after the gateway sends the previous ARP verification packet, the verification MAC address of the third entry is updated to the first verification MAC address.

6. The method of claim 5 wherein:

Before the gateway receives the response packet corresponding to the ARP verification packet, the method further includes: updating the verification MAC address of the first entry to the first verification MAC address, where the ARP verification response table is The second entry is used to determine whether the packet received by the gateway is a response packet corresponding to the previous ARP verification packet, and the first entry and the second entry are the ARP verification response. Different entries in the table.

7. A method according to any one of claims 1 to 6, characterized in that:

The control plane for sending the first message to the gateway specifically includes:

The control plane of the gateway queries whether the ARP cache table of the control plane has a corresponding entry according to the source IP address and the source MAC address of the first packet, if the ARP cache table of the control plane does not exist. Corresponding to the entry, the control plane of the gateway generates a fourth entry that includes the source IP address and the source MAC address of the first packet, and the control plane of the gateway sends the fourth entry to the The ARP cache table of the data plane of the gateway.

8. A method according to any one of claims 1 to 7, characterized in that:

The verification MAC is randomly generated by the control plane of the gateway, and is sent by the control plane of the gateway to the data plane of the gateway.

An apparatus for verifying an ARP request packet, comprising:

a receiver, the gateway is configured to receive an ARP request packet;

a sender, configured to: if the gateway does not query an entry that matches the ARP request packet in the ARP cache table, the gateway sends an ARP verification packet, and the destination Internet Protocol IP address of the ARP verification packet For the source IP address of the ARP request packet, the source IP address and the source media access control MAC address of the ARP authentication message are a security IP address and a risk certificate MAC address, respectively, and the verification IP address and the location The IP address of the gateway is the address of the same network segment, the verification IP address is different from the IP address of the gateway, and the verification MAC address is different from the verification MAC address in the previous ARP verification packet sent by the gateway;

a determining unit, the gateway is configured to receive the first packet, and determine whether the first packet is a response packet corresponding to the ARP verification packet;

The sending unit is configured to send the first packet to the control plane of the gateway, if the first packet is a response packet corresponding to the ARP verification packet.

10. Apparatus according to claim 9 wherein:

11. Apparatus according to claim 9 or 10, characterized in that:

The transmitter specifically includes:

Obtaining a unit, the gateway is configured to obtain a verification IP address and a verification MAC address of the ARP verification packet by using an ARP verification request table, where the ARP verification request table includes at least one entry, a third entry, and a first table. The third entry is the first entry of the ARP verification request table, and the first entry is one entry in the ARP verification response table, and the ARP verification response table includes at least two entries. The entry, each of the entries includes a verification IP address and a verification MAC address, and the verification MAC addresses in the at least two entries are different from each other.

12. Apparatus according to claim 11 wherein:

The determining unit specifically includes: An analyzing unit, configured to determine, by using the ARP verification response table, whether the first packet is a response packet corresponding to the ARP verification packet, where a destination IP address of the first packet is equal to the first table When the IP address of the item is verified, or when the destination MAC address of the first packet is equal to the verification MAC address of the first entry, the first packet is determined to be a response corresponding to the ARP verification packet. Text.

The device according to claim 12, further comprising:

And a first update unit, configured to: after the gateway sends the ARP verification message, the gateway updates the verification MAC address of the third entry to the first verification MAC address.

The device according to claim 13, further comprising:

a second update unit, configured to: after the gateway receives the response packet corresponding to the ARP verification packet, update the verification MAC address of the first entry to the first verification MAC address, where the ARP verification is performed. The second entry in the response table is used to determine whether the packet received by the gateway is a response packet corresponding to the previous ARP verification packet, where the first entry and the second entry are Different entries in the ARP verification response table.

15. Apparatus according to any one of claims 9 to 14 wherein:

The uploading unit further includes:

a query unit, the control plane for the gateway, according to the source IP address and the source MAC address of the first packet, query whether the ARP cache table of the control plane has a corresponding entry;

And a sending unit, where the control plane for the gateway sends the fourth entry to the ARP cache table of the data plane of the gateway.