A method for preventing attacks based on virtual network devices forging ip addresses

Abstract

The invention provides an anti-attack method by counterfeiting an IP address based on virtual network equipment, and relates to the field of network security. The method comprises the following steps:firstly, creating a network bridge and TAP virtual network equipment; configuring an IP address to be counterfeited; capturing all ARP request data for accessing the counterfeited IP address in the TAP virtual network equipment; if the ARP request data is captured, replying a counterfeited ARP reply message to an attacker; after ARP data packet interaction is completed, capturing all IP data packets by creating TUN virtual network equipment, and guiding the captured attack traffic to a honeynet system, so that the purposes of normally generating data interaction and analyzing attack behaviorsand data after an IP address is counterfeited are achieved. According to the method, the TUN / TAP virtual network equipment is used for counterfeiting the host IP, protecting the actual host and sending the equipment ARP reply message to the attacker, and the method is used for network attack analysis and is high in expandability.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method for preventing attacks based on virtual network equipment forging IP addresses. Background technique [0002] With the rapid development of the Internet, network security has become a matter of great concern to people. Improving network security and preventing network attacks have always been a concern of network security personnel. [0003] Common network attack methods include: TCP SYN denial of service attack, ICMP flood, UDP flood, port scan, fragmented IP packet attack, SYN bit and FIN bit set at the same time, TCP packet attack without any flag set, FIN bit set flag but does not set the ACK flag attack on TCP packets, overlong PING packets, address guessing attacks, teardrop attacks, IP packets with source routing options, IP packets with record routing options, and IP packets with unknown protocol fields. Text, IP address spoofing, WinNuke attack, Land attack, Sc...

AI Technical Summary

Problems solved by technology

[0010] 1. The existing technology detects the usage status of IP addresses in real time and adds idle IP addresses to the list, which belongs to active detection. However, for sudden attacks, the existing technology has no response strategy, that is, it lacks passive response measures for sudden attacks

[0011] 2. The existing technology only hides the host IP address, and when an attack is judged, the attack cannot be used to obtain relevant information for subsequent analysis

Images