DHCP monitoring method and apparatus thereof

Abstract

The invention discloses a DHCP monitoring method. When the received user message fails to hit the DHCP binding table, a DHCP blacklist binding table is established, and the frequency information of the DHCP blacklist binding table being hit is recorded, so as to achieve tracking attacker's purpose. The invention also discloses a DHCP monitoring device. Through the invention, the attacker's attack behavior can be tracked and necessary information can be obtained, which is convenient for the network administrator to analyze.

Description

technical field [0001] The invention relates to the technical field of communication networks, in particular to a DHCP monitoring method and a device thereof. Background technique [0002] With the expansion of network scale and the improvement of network complexity, Dynamic Host Configuration Protocol (DynamicHost Configuration Protocol, DHCP) has been widely used. However, the DHCP protocol encounters many security problems in the application process. The main means for attackers to use DHCP to attack include the following two: [0003] 1) IP / MAC spoofing attack: the attacker sends a message with its own MAC and victim IP to the gateway router (including an IP message and a binding table to an Address Resolution Protocol (Address Resolution Protocol, ARP) message, etc.), Let the gateway router learn the binding relationship between the victim's IP and its own MAC address, then all subsequent packets arriving at the victim will be forwarded to the attacker. [0004] 2) Ma...

AI Technical Summary

Problems solved by technology

[0012] The DHCP Snooping solution solves the security problem of DHCP, but this solution only simply discards the attacker's packets, and it is impossible to learn any information about the attacker through this solution

Images