A method and device for preventing gateway arp deception

Abstract

The invention provides a method and device for preventing gateway ARP cheating, belonging to the technical field of network security. The present invention mirrors the flow of the aggregation layer switch to a server configured with a TAP virtual network device, captures the data of the data link layer on the server, and combines the IP address of the gateway and its corresponding MAC address with the captured data of the data link layer. Compare the IP address and MAC address in the ARP response data. If there is an ARP response data packet that does not match the gateway IP address or MAC address, it is considered that the data is ARP spoofing. You can find out the spoofing through the actual MAC address of the response. The host can achieve the effect of preventing spoofing. Dynamic detection can be performed in a large network without cumbersome configuration of the intranet server. When this type of attack is actually detected, the MAC address of the attacking host can be blocked to eliminate other attacks. impact on the network.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for preventing gateway ARP deception. Background technique [0002] Most of the existing ways to prevent gateway ARP spoofing are to download and install firewall-type client software that prevents ARP spoofing on hosts connected to the network, or configure static ARP entries in the system to uniquely bind the gateway IP address and MAC address. In a large network, there are problems of cumbersome configuration and low configuration efficiency, and when this type of attack actually occurs, network engineers need to actively capture packets for traffic analysis, and the traceability efficiency of locating the source host of the attack is relatively low. [0003] In the Chinese patent application document CN106488458A, a method for detecting gateway address resolution protocol ARP spoofing is disclosed, which is applied in the access point AP, includin...

AI Technical Summary

Problems solved by technology

[0006] 1. The existing way to prevent the ARP spoofing attack of the intranet gateway needs to manually set the binding relationship independently on each host connected to the network, which is cumbersome to configure and inefficient

[0007] 2. The existing ways to prevent the ARP spoofing attack of the intranet gateway are mostly to install an ARP-type protective firewall in the server connected to the network or add a static ARP entry of the gateway to each connected server, and the actual occurrence of When attacking, network administrators need to locate the attacking machine through packet capture and other investigation methods, which makes it difficult to locate the source of the attack

[0008] 3. Although the above patent documents can effectively protect against ARP spoofing attacks, they have not processed the actual attack source IP and MAC addresses, and have not solved the problem from the root cause. There are still attack risks in the network. When there are multiple When a host sends ARP spoofing packets at high frequency, it will cause abnormal traffic surge in the network, causing network congestion and affecting the overall network stability

Images