Method, system and switch for preventing MAC address spoofing

Abstract

Disclosed are a method and a system for preventing MAC address cheat, and a switch. The switch comprises: a binding state table item generation unit, configured to generate a binding state table of a user according to user information when the user accesses a network; a binding state table state processing unit, configured to process state migration of a user address; a packet detection processing unit, configured to, after the switch receives a neighbor notification packet, detect whether a destination address of the neighbor notification packet is valid according to the user information recorded in binding state table items; in the case that a destination link layer address option exists in the packet, check whether the destination link layer address option is consistent with that recorded in the binding state table items; if yes, forward the packet; otherwise, discard the received neighbor notification packet. Through application of the present invention, when an NA packet with a false link layer address exists in the network, the switch discards the packet, thereby ensuring the network security.

Description

technical field [0001] The invention relates to the field of data products, in particular to a method, a system and a switch for preventing MAC address spoofing in an IPv6 network. Background technique [0002] In the IPv6 network, ICMPv6-based Neighbor Discovery Protocol (ND) is used to solve the interaction problem between nodes on the same link. It replaces the address resolution protocol (ARP) used in IPv4, the router discovery part of the control message protocol (ICMP) and all functions of the redirection protocol, and can obtain network parameters such as link MTU and hop limit. The neighbor node discovery process of IPv6 is the process of using a series of ND packets and steps to determine the relationship between neighbor nodes and perform network configuration. [0003] Although the Neighbor Discovery Protocol (Neighbor Discovery Protocol) of the switch makes the network configuration process more automatic and reduces the burden on the administrator, since the li...

AI Technical Summary

Problems solved by technology

[0006] The technical problem to be solved by the present invention is to provide a method, a system and a switch for preventing MAC address spoofing, which are used to detect network packets, prevent MAC address spoofing, and avoid the large amount of packet detection in the prior art and the existence of security risks

Images