A method and device for matching ip addresses

Abstract

The embodiment of the present application provides a method and device for matching IP addresses, which relate to the field of network security technology. The method is applied to network equipment, and the method includes: obtaining the target IP address to be matched and the target IP address corresponding to each second network The target basic prefix of segment classification; in the first prefix tree, with the longest match principle, find whether there is a first child node matching the target IP address, and obtain the first matching result; in the red-black tree of each second prefix tree In the node, find out whether there is a second child node matching the target IP address, and if it exists, in the second BinTree with the second child node as the root node, find out whether there is a third child node matching the target IP address, Obtaining a second matching result; determining a final matching result of the target IP address according to the first matching result and the second matching result. Using this application can improve the efficiency of IP address matching.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and device for matching IP addresses. Background technique [0002] Currently, a security policy is usually stored in a network device, and the security policy includes multiple rules (rules). Rules usually contain IP address matching items, so as to perform matching detection on IP addresses. Wherein, the IP address matching item may be configured as an IP address, or may be configured as an IP address range (hereinafter referred to as a network segment of known addresses). In practical applications, when the IP address matching item is configured as a known address network segment, the IP address range corresponding to the known address network segment is usually expressed in the form of an IP prefix, and the IP prefix includes the IP address and the prefix length. For example, the known address network segment of rule1 is FFFF / 16, and the known ad...

AI Technical Summary

Problems solved by technology

[0004] Based on the above solution, the network device needs to match the IP address in the packet with each rule one by one to obtain the matching result of the IP address. However, the number of rules contained in the security policy is usually large, so the efficiency of matching the IP address is relatively high. Low

Images