Universal method of anti-springboard machine based on Ethernet bridge rule

Abstract

The invention discloses a universal method for an anti-springboard machine based on an Ethernet bridge rule, which adopts a configuration mode of filtering a data packet by an Ethernet bridge, and utilizes a configuration tool ebtables for filtering the data packet for the flow of a data link layer in a Linux kernel, when the data packet is sent to a Linux host machine, the host machine detects and processes the filtering rule of the data packet and filters the data packet; because the honeypot deployed by multiple vlan is bridged on the Linux host machine, when an attacker attacks the honeypot, the FORWARD chain is limited by utilizing ebtables, and the FORWARD chain rule does not enter a user control and is responsible for forwarding a data packet which flows through the host machine but does not enter the local machine. According to the method, an Ethernet bridge rule is adopted, multiple vlans are bridged on a Linux host machine to create a large number of honeypots, a honeynet deployed in a large range is formed, and through the operation of limiting and allowing port flow, the honeypots are independent of real services, and anti-springboard operation is carried out.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a general method for an anti-springboard machine based on Ethernet bridge rules. Background technique [0002] In the prior art, the anti-springboard approach is to add a firewall to the overall business scope, or configure a firewall for each honeypot itself to perform anti-springboard protection. However, adding a firewall to the overall business scope will easily affect the existing business functions, which is not conducive to flexible configuration. If the honeypot itself is used to configure the firewall to prevent the springboard, it is easy for the attacker to modify the anti-springboard after obtaining the super administrator authority, making it invalid. SUMMARY OF THE INVENTION [0003] Purpose of the invention: The purpose of the present invention is to aim at the deficiencies of the prior art, and to provide a general method for an anti-jumpin...

AI Technical Summary

Problems solved by technology

[0003] Purpose of the invention: the purpose of the present invention is to aim at the deficiencies in the prior art, provide a kind of general method of anti-jump board machine based on Ethernet bridge rule, by restricting and allowing the operation of port flow, make honeypot can be independent of real business, solve Solved the problem that the host host directly restricts the flow of the bridged honeypot

Images