Method and device for preventing igmp deception and attack

Abstract

The invention discloses a method and device for preventing IGMP spoofing and attacking, comprising: S1: a switch monitors the IP address request process of a DHCP host to establish a DHCP binding table including user IP, MAC address, virtual local area network identification and receiving port information; S2: The switch listens to the IGMP message and determines the type of the message. If it is a general group query message, execute step S3. If it is a membership report message, execute step S4; S3: According to the receiving port information and the pre-configured trusted port Whether it matches, judge the legitimacy of the message; S4: judge the legitimacy of the message according to whether the message information matches the DHCP binding table information and the threshold value of the number of multicast groups that each IP is allowed to join. The invention effectively solves the problems of IGMP general group query deception, IGMP source address deception and IGMP member report message attack. The method is simple and easy to implement, and is beneficial to safe operation of the network.

Description

technical field [0001] The invention relates to the field of computer data communication, in particular to a method and device for preventing IGMP deception and attack. Background technique [0002] With the continuous development of network broadband technology, streaming media data is widely used in many services such as video on demand, online teaching, and online live broadcast due to its intuition, practicality, and interactivity. These services have point-to-multipoint characteristics. For a service mode similar to point-to-multipoint, if a point-to-point unicast mode is used for data transmission, a large amount of network resources will be wasted. In order to save the occupation of network resources, IP multicast technology emerges in due course. Through IP multicast technology, a system can simultaneously send the same data packet to multiple hosts in the same multicast group. IGMP (Internet Group Management Protocol, Internet Group Management Protocol) is a protoc...

AI Technical Summary

Problems solved by technology

If an illegal user forges the IGMP leave message of the host of the IGMP querier, after the host leaves, there will be multicast traffic flowing to the host away from the multicast group, resulting in a waste of bandwidth; if an illegal host forges the source IP to send an IGMP membership report packets, which will increase the CPU load of multicast routers on the network

In addition, even a host with a legal IP may launch an IGMP attack. The host sends a large number of IGMP membership report messages, which increases the CPU burden of the multicast router on the network and occupies a large amount of software and hardware resources.

Images