A kind of dhcp network protection system and method

Abstract

The present invention provides a DHCP network protection system and method. The DHCP relay agent information module performs message processing on the DHCP request message of the client terminal equipment, so as to add the location information of the connection intermediate network node equipment to the DHCP relay agent. In the proxy information string information, the DHCP monitoring module receives the DHCP request message added with the DHCP relay agent information string information to generate a corresponding DHCP binding table for locating the network attack source, and the DHCP monitoring module also presets the rate Restriction, can accurately determine and locate the source of network attacks, improve the accuracy and efficiency of DHCP network security protection, and the DHCP relay agent information module and DHCP monitoring module are separated and run on different boards, reducing the number of modules running on the same board. This reduces the pressure of processing a large number of packets, and makes the upstream DHCP request packet carry more information to identify the source of the request packet.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a DHCP network protection system and method. Background technique [0002] In a data communication network, DHCP is widely used as an important way to obtain an IP address. However, due to the limitations of the DHCP operating mechanism, the DHCP server and the DHCP client have no authentication mechanism, so they are vulnerable to attacks during a complete DHCP request to obtain an IP address. For the way of attack, one is to access an illegal DHCP server on the uplink port, and assign an illegal IP to the DHCP client; The allocated IP address segments are exhausted, causing normal DHCP clients to fail to request IP addresses. [0003] The DHCP snooping technology was created to solve the DHCP security problem. The DHCP snooping mechanism filters abnormal DHCP request information by establishing and maintaining a normal DHCP binding table. At this stage, network devices that...

AI Technical Summary

Problems solved by technology

[0004] Although the emergence of DHCP Snooping can solve some of the problems of DHCP attacks, there are still imperfections here. The DHCP client at the terminal can also initiate forged multiple or a large number of DHCP request packets to the DHCP server in a seemingly legitimate way. The way to request to IP

Images