ARP (Address Resolution Protocol) auxiliary model based on SDN (Software Defined Network)

Abstract

The invention discloses an ARP (Address Resolution Protocol) auxiliary model based on an SDN (Software Defined Network). The ARP auxiliary model comprises an ARP datagram filtering module, an ARP request datagram processing module, an ARP response message sending module, an ARP traffic statistics and analysis module and an IP-MAC (Internet Protocol-Media Access Control) mapping table management and configuration module, wherein the ARP datagram filtering module is used for performing format correctness detection on an ARP message reported by a switch; the ARP request datagram processing module is used for answering an ARP request message; the ARP response message sending module is used for constructing and sending an ARP response datagram of a non-empty query result; the ARP traffic statistics and analysis module is used for receiving various ARP message event records and switch port information transmitted by the ARP datagram filtering module and the ARP request processing module; and the IP-MAC mapping table management and configuration module is used for providing management and configuration interfaces of an IP-MAC mapping table. When the ARP auxiliary model is applied to the SDN, ARP broadcast can be effectively isolated; ARP spoofing is prevented; an executor of the ARP spoofing is traced; and global IP-MAC information is managed and maintained.

Description

technical field [0001] The present invention relates to the field of network security and network management, in particular to an SDN-based ARP protocol auxiliary model. Background technique [0002] ARP spoofing and ARP broadcast storms have always been fundamental problems faced by network management. The ARP protocol is used to establish the mapping between the host IP and the physical address of the host in the LAN, and is an important basic protocol in the TCP / IP protocol. The ARP protocol is simple and effective but lacks security mechanisms at the same time. The threshold for network attacks is very low. After being attacked, it will lead to serious consequences such as network bandwidth consumption, switch resource occupation, session hijacking, denial of service attacks, broadcast storms, etc., and it is difficult to track the source of the attack. . In traditional computer networks, ARP spoofing and ARP broadcasting can be controlled to a certain extent, but at t...

AI Technical Summary

Problems solved by technology

[0005] The existing technologies represented by the above-mentioned patent risks have limited ability to restrict ARP traffic in the network, and cannot fundamentally solve ARP attacks in the network

Images