WO2013086832A1

WO2013086832A1 - Method and device for suppressing impact of snmp packets

Info

Publication number: WO2013086832A1
Application number: PCT/CN2012/075306
Authority: WO
Inventors: 强伟峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-12-14
Filing date: 2012-05-10
Publication date: 2013-06-20
Also published as: CN103166784A

Abstract

The present invention provides a method and device for suppressing an impact of SNMP packets, used for resisting the impact from SNMP packets. The method for suppressing an impact of SNMP packets comprises: a network unit determining whether the number of SNMP packets received in a preset time reaches a preset limit, and obtaining a determination result; and when the determination result is that the number of the SNMP packets exceeds the preset limit, the network unit discarding the SNMP packets that exceed the present limit and are received in the present time. The technical solutions of the present invention effectively resist the impact from the SNMP packets.

Description

Method and device for suppressing SNMP packet impact

The present invention relates to the field of network technologies, and in particular, to a simple network management protocol.

(Simple Network Management Protocol, SNMP) is a method and device for attacking texts. Background technique

SNMP is the most widely used network management protocol in TCP/IP networks. After years of development and application, SNMP has become the de facto standard for network management. The SNMP-based network management consists of two parts: a network management station (Manager) and a managed network unit (Agent). The network management station can also be called a management process, and the network unit can also be called a proxy device.

In an actual network application, the network device is affected by SNMP packets. In some cases, a large number of SNMP packets are generated, which is several thousand per second. These SNMP packets point to the same IP address. Some of these situations are caused by network device failures, and some are malicious attacks. Related solutions have not yet been proposed to avoid the problem of network devices being affected by SNMP packets. Summary of the invention

The embodiment of the invention provides a method and a device for suppressing the impact of an SNMP packet, which are used to solve the problem that the network device in the prior art is affected by the SNMP packet.

In order to achieve the object of the present invention, according to an aspect of the embodiments of the present invention, a method for suppressing an impact of an SNMP packet is provided, and the following technical solutions are adopted:

The method for suppressing the impact of the SNMP packet includes: the network unit determines whether the number of SNMP packets received within the predetermined time reaches a preset limit, and obtains a judgment result; when the number of SNMP packets exceeds a preset limit, the network The unit will receive more than the preset limit within the predetermined time. SNMP packets are discarded.

Further, the network unit determines whether the number of SNMP packets received within the predetermined time reaches a preset limit, and obtains a determination result that: the network unit updates the SNMP received in the first predetermined time period when receiving the new SNMP message. The number of packets; and the network unit determines whether the current time reaches the second predetermined time, and if not, determines whether the number of SNMP packets reaches the preset limit.

Further, before the network unit determines whether the number of SNMP packets received within a predetermined time reaches a preset limit, and before obtaining a determination result, the method for suppressing the impact of the SNMP packet further includes: filtering, by the network unit, based on the predetermined mask list Illegal SNMP packets.

Further, the predetermined mask list is: a list consisting of a preset illegal IP address or an illegal MAC address.

Further, the network unit filters out the illegal SNMP message based on the predetermined mask list, including: the network unit acquires the source IP address or the source MAC address of the received SNMP message; the network unit reaches a comparison result; the network unit compares the result to the source When the IP address or source MAC address is an illegal IP address or an illegal MAC address, the SNMP packets corresponding to the source IP address or the source MAC address are discarded.

According to another aspect of the present invention, an apparatus for suppressing an impact of an SNMP message is provided, and the following technical solutions are adopted:

The device for suppressing the impact of the SNMP packet includes: a determining module, configured to determine whether the number of SNMP packets received within a predetermined time reaches a preset limit, and obtain a judgment result; and the first discarding module is set to be in the judgment result When the number of SNMP packets exceeds the preset limit, the SNMP packets received within the preset time limit exceeding the preset limit are discarded.

Further, the determining module includes an updating module, configured to update the number of SNMP packets received in the first predetermined time period when receiving the new SNMP message; and determining the submodule, Set to determine whether the current time reaches the second predetermined time. If not, determine whether the number of SNMP packets reaches the preset limit.

Further, the device for suppressing the impact of the SNMP packet further includes: a filtering module, configured to filter the illegal SNMP packet according to the predetermined mask list.

Further, the filtering module includes an obtaining module, configured to obtain a source IP address or a source MAC address of the received SNMP packet, and a comparison module, configured to compare the source IP address or the source MAC address with the illegal IP address or the illegal MAC address. And obtaining a comparison result; and the second discarding module is set to be the source IP address or the source MAC address is an illegal IP address or illegally found, and the technical solution described in the embodiment of the present invention has the following advantages:

1. By setting the limit of the number of packets in a unit of time, if a large number of SNMP packets are impacted on the device and the SNMP packets exceeding the quota are discarded, the device will not be down, except for the device. In addition to some SNMP messages, other functions work normally.

2. By setting a list of illegal IP addresses or illegal MAC addresses, you can filter the IP addresses or MAC addresses of abnormal SNMP packets to eliminate the impact of abnormal SNMP packets. DRAWINGS

Processing flow chart;

FIG. 3 is a specific flowchart of a method for suppressing an impact of an SNMP packet according to the embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an apparatus for suppressing an impact of an SNMP packet according to an embodiment of the present invention. detailed description

The embodiments of the present invention are described in detail below with reference to the drawings, but the present invention may be embodied in many different ways as defined and covered by the claims.

S101: The network unit determines whether the number of SNMP packets received within the predetermined time reaches a preset limit, and obtains a judgment result;

S103: When the number of SNMP packets exceeds the preset limit, the network unit discards the SNMP packets that exceed the preset limit received in the predetermined time.

With the above technical solution of the embodiment, the limit of the number of packets is set in a unit time, and when a large number of SNMP packets are impacted on the device, the SNMP packets exceeding the quota are discarded, so that the device does not appear. In addition to discarding some SNMP packets, other functions work normally.

Preferably, the network unit determines whether the number of SNMP packets received within the predetermined time reaches a preset limit, and obtains a determination result that: the network unit updates the SNMP received in the first predetermined time period when receiving the new SNMP message. The number of packets; and the network unit determines whether the current time reaches the second predetermined time, and if not, determines whether the number of SNMP packets reaches the preset limit.

The specific implementation of the foregoing embodiment may be: Whenever there is an SNMP message, first update the number of SNMP packets received in the current second, and then check whether the current time reaches the next second: If the next second is reached, it will indicate The number of SNMP packets received in the current second is zero. If the next second is not received, check whether the number of SNMP packets processed in the current second reaches the limit. If not, continue processing. If it is reached, discard the current one. SNMP packets are not processed.

With the above technical solution of the embodiment, when a large number of SNMP packets impact the network element, a large amount of CPU and memory resources of the device are consumed, which affects the normal operation of the device, and the device is allowed to be used. In a state of paralysis. Packets that exceed this limit are discarded by setting the limit of the SNMP packets processed per second. The large number of packets are discarded at the initial stage of SNMP processing, which reduces the occupation of system resources.

Preferably, the method for suppressing the impact of the SNMP packet before the network unit determines that the number of SNMP packets received in the predetermined time period reaches a preset limit, and the method for suppressing the impact of the SNMP packet includes: the network unit filters out the predetermined mask list. Illegal SNMP packets.

The method of setting the SNMP packet limit per unit time can effectively reduce the number of SNMP packets processed by the system. However, the disadvantage is that the SNMP request from the attacker may be filtered together with other legitimate SNMP requests on the network, resulting in the system. The normal working is affected. With the above technical solution of the embodiment, the SNMP packet can be discarded once, so that the illegal SNMP packet is discarded in advance, and the method for ensuring the legal SNMP packet to participate in the SNMP packet quota is further SNMP files are processed.

Preferably, the predetermined mask list is: a list consisting of a preset illegal IP address or an illegal MAC address.

For a malicious or illegal or abnormal IP address and MAC address that is known in advance, a malicious or illegal or abnormal IP address and MAC address are included in the list, and the source IP address is obtained when receiving the SNMP packet. If the source IP address or the source MAC address is in the list, the corresponding SNMP packet is discarded.

Preferably, the network unit filters out the illegal SNMP message based on the predetermined mask list, including: the network unit acquires the source IP address or the source MAC address of the received SNMP message; the network unit to a comparison result; the network unit compares the result to the source When the IP address or source MAC address is an illegal IP address or an illegal MAC address, the SNMP packets corresponding to the source IP address or the source MAC address are discarded.

Through the above technical solution of the implementation, the IP address or MAC from the mask list can be SNMP packets discarded address, the system handles only valid SNMP requests _t

The flow chart of the T-processing of the thorn suppression 3⁄41 M 艮所述 is described in the embodiment.

As shown in Figure 2, the specific steps for adding a method for suppressing SNMP packet attacks are as follows:

Step 201: Read the arrived data from the SNMP port, and put the read data into the buffer area. Only the text shock treatment.

Step 203: Decode the SNMP packet, parse the received packet, and convert it into an internal format.

Step 204: Security check, check whether the message has permission to operate the MIB change it requires. Step 205: Map the MIB variable to confirm that the requested MIB variable must be in the main MIB tree and can be mapped to the corresponding MIB leaf node.

Step 206: After setting the corresponding data, after finding the leaf node of the MIB object on the MIB tree, the corresponding function should be executed according to the requested GET/SET operation to read or modify the data.

Step 207: After encoding the result and performing the corresponding operation, the agent needs to convert the internal data structure into the ASN.1 format and put it into the buffer to be sent.

Step 208: Send an SNMP message, and call a sending function to send the data to the management station. With the above technical solution of the embodiment, the device supporting the SNMP protocol has the capability of resisting the impact of the SNMP packet, and the solution has the characteristics of being simple and versatile, and is also suitable for other protocol processing modules.

FIG. 3 is a specific flowchart of a method for suppressing an impact of an SNMP packet according to an embodiment of the present invention; As shown in FIG. 3, the specific steps of the method for suppressing the impact of the SNMP packet may be as follows: Step 301: Receive an SNMP packet, read the arrived data from the SNMP port, and put the read data into the buffer.

Step 302: Check whether the source IP address or the source MAC address in the SNMP packet is in the masked list. If yes, the program proceeds to step 305 to discard the SNMP packet. If it is not in the mask list, go to step 303. The IP address or MAC address to be masked can be configured in advance through the command line.

Step 303: In this step, it is checked whether the SNMP packet received in the current time period has reached the set limit. If the quota is reached, the program proceeds to step 305 to discard the SNMP packet. If not, the process proceeds to step 304 continues processing.

The specific method of determining whether the SNMP packet received in the current time period reaches the limit is as follows: Whenever there is an SNMP packet, update the number of SNMP packets received in the current second, and then check whether the current time is up. Next second: If the next second is reached, it will indicate that the number of SNMP packets received in the current second is zero; if it is not the next second, it checks whether the number of SNMP messages processed in the current second reaches the limit, if not Reach, continue processing, if it is reached, the program discards the current SNMP message and does not process it.

Step 304: In this step, the processing of the SNMP^ message is continued, and the normal processing procedure is entered.

With the above technical solution of the present embodiment, the method of processing the SNMP packet limit and the method of filtering the illegal address in the unit time is minimized, so that the impact of the SNMP packet impact on the system is minimized.

FIG. 4 is a schematic structural diagram of an apparatus for suppressing an impact of an SNMP packet according to an embodiment of the present invention. As shown in FIG. 4, the apparatus for suppressing the impact of the SNMP packet includes a determining module 41, configured to determine whether the number of SNMP packets received within a predetermined time reaches a preset limit, and obtain a judgment result; and the first discarding module 43, set to the number of SNMP packets in the judgment result exceeds the pre- When a quota is set, SNMP packets that exceed the preset limit received within the predetermined time are discarded.

Preferably, the determining module 41 includes an update module (not shown), configured to update the number of SNMP packets received within the current predetermined time before receiving the new SNMP message; and determining the sub-module (not shown) Set to determine whether the current time is within a predetermined period of time. If yes, determine whether the number of SNMP packets reaches the preset limit.

Preferably, the apparatus for suppressing the impact of the SNMP packet further includes a filtering module (not shown) configured to filter the illegal SNMP packet based on the predetermined mask list.

Preferably, the filtering module (not shown) includes an ear block (not shown), configured to obtain a source IP address or a source MAC address of the received SNMP message; and a comparison module (not shown) , configured to compare the source IP address or the source MAC address with the illegal IP address or the illegal MAC address to obtain a comparison result; and the second discarding module (not shown), set to compare the result address or the source MAC address The corresponding SNMP^ text is discarded.

With the above-mentioned embodiment of the present invention, when a large number of SNMP messages are generated, the SNMP number exceeding the quota part is discarded in the case that a large number of SNMP packets impact the device when the number of packets is set in a unit time. For example, you can make the device not down. In addition to discarding some SNMP packets, other functions work normally. You can also eliminate the impact of abnormal SNMP packets by setting an illegal IP address or non-filtering.

The above description is only an embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. These improvements and retouchings should also be considered. It is the scope of protection of the present invention.

Claims

Claim

A method for suppressing an impact of an SNMP 4 message, wherein the method comprises:

The network unit determines whether the number of SNMP packets received within the predetermined time reaches a preset limit, and obtains a judgment result;

When the number of the SNMP packets exceeds the preset limit, the network unit discards the SNMP packets that are received within the predetermined time and exceeds the preset limit.

The method for suppressing the impact of an SNMP packet according to claim 1, wherein the network unit determines whether the number of SNMP packets received within a predetermined time reaches a preset limit, and obtains a judgment result as follows:

The network unit updates the number of the SNMP packets received in the first predetermined time period when receiving a new SNMP message;

The network unit determines whether the current time reaches the second predetermined time, and if not, determines whether the number of the SNMP packets reaches the preset limit.

The method for suppressing the impact of an SNMP packet according to claim 1, wherein the network unit determines whether the number of SNMP packets received within a predetermined time reaches a preset limit, and before obtaining a judgment result, The method also includes:

The network unit filters out the illegal SNMP message based on the predetermined mask list.

4. The method for suppressing the impact of an SNMP packet according to claim 3, wherein the predetermined mask list is:

3⁄413⁄4 light setting ^ ^ 丄

'i

The method for suppressing the impact of an SNMP packet according to claim 4, wherein the filtering, by the network unit, the filtering of the illegal SNMP packet based on the predetermined mask list comprises:

Obtaining, by the network unit, a source IP address or a source MAC address of the received SNMP message;

The net Or comparing the illegal MAC addresses to obtain a comparison result;

When the comparison result is that the source IP address or the source MAC address is the illegal IP address or the illegal MAC address, the network unit will correspond to the source IP address or the source MAC address. SNMP ^ discarded.

An apparatus for suppressing an impact of an SNMP packet, where the apparatus includes: a judging module and a first discarding module; wherein

The determining module is configured to determine whether the number of SNMP packets received within a predetermined time reaches a preset limit, and obtain a judgment result;

The first discarding module is configured to: when the number of the SNMP packets exceeds the preset quota, the SNMP packets that are received in the predetermined time and exceed the preset limit throw away.

The apparatus for suppressing the impact of an SNMP packet according to claim 6, wherein the determining module comprises: an updating module and a determining submodule;

The update module is configured to update the number of the SNMP packets received in the first predetermined time period when receiving a new SNMP message;

The determining sub-module is configured to determine whether the current time reaches the second predetermined time, and if not, determine whether the number of the SNMP packets reaches the preset limit.

The device for suppressing the impact of an SNMP packet according to claim 7, wherein the device further comprises:

The filtering module is configured to filter out illegal SNMP packets based on the predetermined mask list.

The device for suppressing the impact of an SNMP packet according to claim 8, wherein the filtering module comprises: an obtaining module, a comparing module, and a second discarding module;

The obtaining module is configured to obtain a source IP address or a source MAC address of the received SNMP packet;

The comparing module is configured to set the source IP address or the source MAC address to the non- Comparing the legal IP address or the illegal MAC address to obtain a comparison result; and the second discarding module is configured to: when the comparison result is the source IP address or the source MAC address is the illegal IP address When the address or the illegal MAC address is used, the source IP address or the SNMP address corresponding to the source MAC address is discarded.