Method for preventing fragment attack of IP (Internet Protocol) datagram

Abstract

The invention discloses a method for preventing the fragment attack of an IP (Internet Protocol) datagram, relating to the technical field of network security. In the method, fragment messages of the received IP datagram are temporarily recombined before reaching a corresponding processing module; and in the process of temporary recombination, if the number of the fragment messages belonging to the same IP datagram exceeds a fragment threshold, the IP datagram is discarded. In the invention, by storing each IP fragment message in a cache and virtually recombining the fragments, the original datagram can be detected. Thus, network equipment can verify the sequence and integrality of each fragment and discover the hostile attack performed by utilizing the fragments, thereby more effectively preventing the IP fragment message attack.

Description

Technical field [0001] The invention relates to the technical field of computer network security, in particular to a method for preventing IP datagram fragmentation attacks. Background technique [0002] The maximum transmission unit (Maximum Transmission Unit, MTU) is the protocol data unit (Protocol Data Unit, PDU) of the data link layer, that is, the size of the frame. For the most common Ethernet, the data link layer protocol is based on IEEE802.2 / 802.3, and the length of the data (effective) field in the Ethernet frame ranges from 46 to 1500 bytes. This 1500 is the MTU of the Ethernet. When the upper layer protocol of the link layer, such as the IP datagram (including IP Header) to be transmitted by the IP protocol, exceeds this length range, the IP datagram must be divided into multiple pieces for transmission and reorganized in the target system. This process is Fragmentation, where each fragment that is divided is a fragment or fragmented message Fragment. [0003] It ca...

AI Technical Summary

Problems solved by technology

In this way, the host will consume a large amount of CPU to reorganize these fragments. After the reorganization is completed, it finds that it is a wrong datagram and discards it! If there are many such datagrams, the system cannot handle them, resulting in a crash!

[0008] If the means of the above-mentioned prior art 1 is used to set a threshold to limit the flow rate per second of the fragmented message of the IP datagram, the flow beyond the threshold can be discarded, but the legality and validity of the passed and discarded fragmented message cannot be identified. integrity;

[0009] If the method of the above-mentioned prior art 2 is adopted, the initial fragment packet can be released on the network and subsequent fragment packets can be rejected by using the access control list, but this method cannot correctly identify normal fragment packets.

[0010] It can be seen from the above description that the prior art only defines a switch or current limiting to control the fragmented message of the IP datagram in the process of passing through the network device, but does not control the fragmented message of the IP datagram. The legitimacy and integrity of the fragmented packets of IP datagrams cannot be prevented fundamentally from the attack of fragmented packets of IP datagrams.

Images