ARP bidirectional defense system and method

Abstract

The invention discloses an ARP bidirectional defense system and method, and relates to the technical field of ARP defense. The system comprises a gateway server comprising a gateway ARP packet filtering module and a plurality of hosts provided with host ARP packet filtering modules, the plurality of hosts are connected with the gateway server and are used for actively acquiring the gateway MAC ofthe gateway server; a gateway ARP cache mapping table is also arranged in the gateway server; wherein an ARP request packet and an ARP response packet which are sent to the host through the gateway server within a preset time threshold value are stored in the gateway ARP cache mapping table. A gateway ARP packet filtering module is arranged in a gateway server, and whether an IP address and an MACaddress in an ARP message exist in a cheating record table or not is retrieved through the gateway ARP packet filtering module and used for surface monitoring of a malicious attack source host; then,the abnormal ARP message in the ARP message is identified through the gateway ARP packet filtering module and is marked as abnormity, the source host for deceptive attack is efficiently removed, andthe security is improved.

Description

technical field [0001] The invention belongs to the technical field of ARP defense, in particular to an ARP two-way defense system and method. Background technique [0002] The ARP attack problem in the local area network has been difficult to be fundamentally solved, because the current various ARP prevention measures have their own limitations. The ARP personal firewall cannot guarantee that the obtained gateway must be correct, and it cannot defend against attacks on the gateway; the binding of VLANs and switch ports does not provide any protection for the gateway. No matter how the VLAN is subdivided, once the gateway is attacked, the entire network will still be disrupted. Dropped and paralyzed, and the cost of rigid management is high; the double-binding measure has limited preventive capabilities, and management is too troublesome. [0003] The invention provides an ARP two-way defense system and method, which is dedicated to solving the problem of poor defense abili...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide ARP two-way defense system and method, by arranging gateway ARP packet filter module in gateway server, and by gateway ARP packet filter module contrast gateway ARP cache mapping table to filter out abnormal ARP message; The identification unit is used to identify abnormal ARP messages and identify whether the source host is an attacking and deceiving host through the abnormal message processing module, so as to realize the safe and efficient defense of the ARP system and solve the problem of poor defense ability when the existing ARP is attacked

Images