Method and network appliance for preventing network attack

Abstract

The invention relates to the communication field and discloses a method for preventing network attack and a network device solving the bad network attack effect problem in the prior art. The method arranges at least two committed access rate CAR channels and at least one rate threshold for each protocol packet in the network device, and selects corresponding CAR channel to up transmit each protocol packet based on the relation between an up-transmitting rate of each protocol packet at each port of the network device and the presetting rate threshold for each protocol packet. The method of theinvention can effectively solve the communication interrupt defect caused by that the normal up-transmitting packet of a legal client is edged off by an attack packet and the packet is limited rate by only one CAR in the prior network device. The invention also discloses the network for preventing network attack.

Description

technical field [0001] The invention relates to the communication field, in particular to a method and network equipment for preventing network attacks. Background technique [0002] With the rapid development of the Internet, network attacks are becoming more and more frequent. Attacks not only target terminal devices but also network devices, such as routers, switches, etc. Attackers generally send a large number of forged messages to them in a short period of time. This causes the system to be busy processing these packets, and other normal task processing is affected to achieve the purpose of the attack. In severe cases, this attack can cause system resources to be exhausted and equipment to go down. [0003] In order to prevent such network attacks, it is a relatively common method to use CAR (Committed Access Rate, agreed access rate) to limit network devices. CAR is a flow control technology often used in the communication field. Usually, network devices set CAR to ...

AI Technical Summary

Problems solved by technology

However, at present, the use of CAR technology to prevent attacks generally imposes a unified rate limit on all packets sent for processing, regardless of where the packets come from, what type of packets, etc.

If the flow of attack packets from a certain port is too large, even if CAR is used to control the flow, the packets normally sent from other ports may still be squeezed out.

Similarly, if the traffic of attack packets from a certain protocol is too large, even if CAR is used for traffic control, the normally sent packets from other protocols may still be squeezed out.

Both of these situations result in interruption of normal communication for legitimate users

Images