Method, device and system for preventing dhcp attack in flat network

Abstract

The invention discloses a method, device and system for preventing DHCP attacks in a flat network, including: setting interface IDs, Supervlan IDs and corresponding user limit values ​​in DHCP snooping; DHCP snooping receives discover messages sent by clients, and judges Whether the client is online; if not online, determine the corresponding user limit value according to the interface ID and Supervlan ID in the discover message; determine whether the current number of online users exceeds the user limit value; if it exceeds, the discover message will not be forwarded; if If the number of online users is not exceeded, add 1 to the current number of online users and forward the discover message; it can prevent DHCP attacks from causing address exhaustion, improve network security, and improve the usability and user experience of the overall solution.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, device and system for preventing DHCP attacks in a flat network. Background technique [0002] VLAN is the abbreviation of Virtual Local Area Network (Virtual Local Area Network), which is a logical network divided on a physical network, and the effect is the same as that of a common LAN. The unicast, broadcast and multicast frames of the second layer are forwarded and diffused in a VLAN, and will not directly enter other VLANs. Therefore, if a host connected to a port wants to communicate with other hosts not in the same VLAN, it must pass through a layer-3 device. [0003] Supervlan, that is, super vlan, also called vlan aggregation, is defined in RFC (Request For Comments, request for comment document) 3069. Its principle is to assign the IP of a network segment to different sub VLANs (Sub VLANs). Belongs to a Super VLAN. Each Sub VLAN is an independent bro...

AI Technical Summary

Problems solved by technology

[0006] Through Supervlan, vlan isolation, DHCP server and DHCP Snooping, a flat network can be established, but in this network, users may perform DHCP attacks to exhaust the address pool; for example, most of the current campus networks use flat network extensions , and configure a large address pool for the Supervlan. At this time, if the user conducts a DHCP attack, all available addresses under the Supervlan of the device will inevitably be exhausted, resulting in no address available for users in the remaining sub-vlans under the Supervlan.

Images