Method, unit and system for preventing address resolution protocol flux attack

Abstract

The present invention discloses method, unit and system for preventing address analysis agreement flow capacity attack. The method includes: testing the number of ARP packet with same character in network; judging the number of ARP packet exceed presetting value, transmitting the ARP flow capacity to attack happened broadcast message if the value is exceed; lawless user is located and disposed according to ARP flow capacity attack by the broadcast message. The system includes: gateway equipment unit, processing unit for preventing ARP flow capacity attack, access switch unit. According to theinvention, only disposable configure is executed for testing and locating the ARP packet before testing, process modus of illegal user is also flexible, thereby this can maximum reduce amount of workof administrator to reach the effect of convenient management, simple operation and intelligent.

Description

technical field [0001] The invention relates to the field of network data communication security, in particular to a method, unit and system for preventing ARP traffic attacks. Background technique [0002] With the rapid development of the network, the security of the data communication network is also concerned. When hosts on different subnets communicate, the communication data needs to be forwarded through the gateway device, and the gateway device needs to support the Address Resolution Protocol (Address Resolution Protocol, hereinafter referred to as: ARP) technology, and process the ARP message to Ensure the normal operation of the gateway equipment and realize the normal progress of network communication. However, in the process of network data communication, illegal users often send ARP requests or responses to the gateway device with a large number of legal ARP packets, which will cause the ARP processing resources of the gateway device and a large amount of netwo...

AI Technical Summary

Problems solved by technology

[0004]1. Due to the uncertainty of the network being attacked by ARP traffic, the administrator cannot discover the existence of the problem in time. For intermittent ARP traffic attacks, the administrator cannot find out at all The existence of the problem or misjudgment is ARP spoofing;

[0005]2. Due to manual processing, when an ARP traffic attack occurs in the network, the administrator cannot quickly detect, locate and deal with the illegal user who initiated the ARP traffic attack ;

[0006]3. The administrator locates illegal users by grabbing messages from different network locations, resulting in a huge workload;

[0007]4. Even if the administrator can locate the illegal user who initiates the ARP traffic attack, he cannot handle it flexibly. Instead, he can only shut down the attacking host or unplug the Disconnect the network cable of the attacking host and perform antivirus to deal with it

Images