Method and device for preventing MAC address flooding attacks

Abstract

The invention discloses a method and device for preventing MAC address flooding attacks. The method comprises the following steps: judging whether the sum of suspected times in a certain port MAC address table entry in a blacklist MAC address table is greater than a set threshold value of the sum of suspected times or not; and judging whether the port is attacked or not, if the port is attacked, shortening the aging time of the related MAC address table entry of the port in the MAC address table, and marking the related MAC address table entry as suspicious. According to the method, port attack conditions can be judged, emergency measures can be taken, suspicious MAC address table entry deletion time is shortened, MAC address table space is released, MAC address flooding attacks are controlled, and bandwidth pressure is reduced; and judging whether the MAC address is a factor causing flooding attack or not by judging whether the suspected times of the blacklist MAC address entry is greater than a set suspected times threshold or not, and if so, marking the state of the MAC address entry as dormancy. In the sleep period, the data frame is discarded, flooding caused by MAC address broadcasting is avoided, and then MAC address flooding attacks are avoided.

Description

technical field [0001] The invention belongs to the technical field of communications, and in particular relates to a method and device for preventing MAC address flooding attacks. Background technique [0002] An Ethernet switch is a switch that transmits data based on Ethernet. It works on the second layer of the OSI reference model, that is, the data link layer. It is a network device based on MAC (Media Access Control) address identification and Ethernet data frame forwarding. . The Ethernet switch can perform data transmission between multiple port pairs at the same time, so that each pair of hosts that communicate with each other can perform conflict-free data transmission, effectively isolate conflict domains, and ensure that the broadband of each terminal does not affect each other. Unlike the hub that broadcasts data packets to all nodes, an Ethernet switch can directly send data packets to the destination node. It is because there is a MAC address table inside th...

AI Technical Summary

Problems solved by technology

First, when a large number of terminals need to communicate, because the number of terminals is limited by the port, more switches are needed to meet the communication needs, resulting in increased costs; second, each port limits the number of terminal connections, which does not prevent the port from being attacked from the root cause. Once flooded, there is still a waste of bandwidth resources

Images