Method and device for preventing ARP cheating and network access server

Abstract

The embodiment of the invention provides a method and device for preventing ARP cheating and a network access server. The method comprises the steps that message information of an obtained first message is recorded in a first forwarding database; when a user knows that a source IP address corresponding to source IP address information of the first message does not exist in an authenticated database, the source IP address is added to the authenticated database; a static ARP table item corresponding to the source IP address is added to an ARP database; a second message is sent to a physical port corresponding to physical port information according to the physical port information, corresponding to the source IP address table item, in the first forwarding database, so that a browser corresponding to the source IP address skips to have access to a web authentication server to carry out web authentication, wherein the second message is a redirect message of the first message. Therefore, the purpose that ARP cheating is prevented in the web authentication process is achieved.

Description

technical field [0001] The present invention relates to a communication technology, in particular to a method and device for preventing address resolution protocol (Address Resolution Protocol, abbreviated: ARP) spoofing, and a network access server (Netwoek Access Server, abbreviated: NAS). Background technique [0002] Network (web) authentication is an identity authentication method based on Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, referred to as: HTTP) technology to control the user's access to the network. Usually, unauthenticated users need to use a browser before accessing the network. Open a site, and the NAS with the identity authentication function will force the browser to access the web authentication server, that is, the Portal server. The user enters the identity information on the page pushed by the Portal server through the browser for identity authentication. Only after the authentication is passed can the network resources be used. . [...

AI Technical Summary

Problems solved by technology

If the mapping database in the solution of the prior art is statically configured, it is not flexible enough and the management workload is huge; if it is automatically generated through Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, referred to as: DHCP) sniffing, all access NAS terminals must obtain IP addresses through DHCP, which has great restrictions on network deployment, and there is also the possibility of DHCP being spoofed when using DHCP

Images