Method for discovering illegally-accessed equipment

Abstract

The invention discloses a method for discovering illegally-accessed equipment. According to the method, two defense lines are adopted. The first defense line comprises the following steps: utilizing a topological physical graph of network management software to display all equipment in a controlled local network onto the topological physical graph; obtaining all PC client side information connected with switches in the local network through an SNMP (Simple Network Management Protocol), an ARP (Address Resolution Protocol), and an Netbios (Network Basic Input / Output System Protocol); adopting an MAC address discrimination method to establish a standard comparison table containing the content of legal equipment in the local network; carrying out binding operations on IP addresses of PC client sides, MAC and port numbers of the switches according to the standard comparison table. The second defense line comprises the following steps: randomly adopting the MAC address discrimination method to obtain port information of the switches connected with the all PC client sides, comparing the port information with that of the comparison table, and determining the client sides which do not exist as new-emerging ones and as illegally-accessed equipment and blocking. The method provides double safety.

Description

technical field [0001] The invention relates to a method for discovering illegal access equipment, which is especially suitable for timely discovering unauthorized access equipment on an internal network (local area network), and can accurately locate the position of the illegal access equipment on the network. Background technique [0002] The problem of illegal access to the internal network (local area network) is an important issue facing the internal network security of large and medium-sized enterprises. How to effectively monitor and manage the computers and network devices connected to the network is the prerequisite for the safe operation of the internal LAN. [0003] With the advancement and development of informatization, the internal networks of large and medium-sized enterprises are becoming larger and larger, and network applications are becoming more frequent. The size and complexity of the network has led to more and more serious network security risks. Int...

AI Technical Summary

Problems solved by technology

The disadvantage is that this mechanism is based on user and password authentication. For large and medium-sized LANs, there are many network users and complex personnel, and the security of multiple users and multiple passwords cannot be effectively guaranteed. As a result, illegal access users cannot effectively control

[0012] As mentioned above, the above two currently used technologies have high requirements for users, the operation settings are very complicated, and the maintenance workload in the future is also very large, and the effect is not very satisfactory, and both have obvious defects

Images