Message attack test method and related device

Abstract

The invention discloses a message attack testing method and a related device, and relates to the technical field of message attack testing, and the method comprises the steps: testing equipment generates a join message, and sends the join message to tested equipment; wherein the protocol for adding the message is protocol independent multicast; the tested device receives the join message and analyzes the join message to obtain the IP address of the test device; the tested equipment judges whether the multicast neighbor relation table contains the IP address of the test equipment or not; if the message contains the IP address of the test equipment, the tested equipment generates a multicast data forwarding table item based on the join message; wherein the multicast data forwarding table item is used for determining a forwarding path of the multicast data sent by the tested equipment; and if the IP address of the test equipment is not contained, the tested equipment generates a neighbor check failure result. According to the invention, attack of malicious messages can be prevented.

Description

Technical Field

[0001] The present application relates to the technical field of message attack testing, and in particular to a message attack testing method and related devices. Background Art

[0002] IP (Internet Protocol) multicast communication refers to the forwarding of IP packets from a single source to a specific group of recipients. It is suitable for point-to-multipoint data transmission scenarios such as live streaming, online television, distance education, and video conferencing. Layer 3 multicast services are vulnerable to attacks. Malicious users can send large numbers of multicast protocol packets, causing a large number of invalid multicast entries to be created on multicast network devices (such as routers or switches that support Layer 3 multicast). This consumes a large amount of system resources and CPU (central processing unit) resources, impacting the normal operation of multicast network devices. Summary of the Invention

[0003] In view of the above problems, this application provides a message attack testing method and related devices, which can prevent malicious message attacks. The specific solution is as follows:

[0004] A first aspect of the present application provides a message attack testing method, which is applied to a message attack testing system. The message attack testing system includes a testing device and a device under test. The method includes:

[0005] The test device generates a join message and sends the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast;

[0006] The device under test receives the join message, parses the join message, and obtains the IP address of the test device;

[0007] The device under test determines whether the multicast neighbor relationship table contains the IP address of the test device;

[0008] If the IP address of the test device is included, the device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine a forwarding path for the multicast data sent by the device under test;

[0009] If the IP address of the testing device is not contained, the device under test generates a neighbor check failure result.

[0010] In a possible implementation, the test device includes a first test device, the first test device includes a first multicast network device, and the method further includes:

[0011] The first multicast network device sends a hello message; wherein the protocol of the hello message is protocol-independent multicast;

[0012] When the device under test receives the hello message, it parses the hello message to obtain the IP address of the first multicast network device;

[0013] The device under test generates the multicast neighbor relationship table based on the IP address of the first multicast network device.

[0014] In a possible implementation, the first test device further includes a first terminal. The test device generates a join message, and sends the join message to the device under test, including:

[0015] The first terminal sends a report message to the first multicast network device; wherein the protocol of the report message is Internet Group Management Protocol;

[0016] The first multicast network device receives the report message and parses the report message to obtain a target multicast group address; wherein the target multicast group address is the multicast group address carried by the device under test when sending the multicast data;

[0017] The first multicast network device generates a first join message based on the target multicast group address;

[0018] The first multicast network device sends the first join message to the device under test.

[0019] In a possible implementation, the device under test generates a multicast data forwarding entry based on the join message, including:

[0020] The device under test parses the first join message to obtain the target multicast group address;

[0021] The device under test generates the multicast data forwarding entry based on the target multicast group address and the interface for receiving the first join message.

[0022] In a possible implementation, the test device includes a second test device, the second test device includes a second terminal and a second multicast network device, and the test device generates a join message and sends the join message to the device under test, including:

[0023] The second terminal generates a plurality of different second join messages based on a plurality of different attack multicast group addresses; wherein the number of the second join messages is the same as the number of the attack multicast group addresses, and the attack multicast group address is different from the multicast group address carried by the device under test when sending the multicast data;

[0024] The second terminal transmits the plurality of second join messages to the second multicast network device;

[0025] The second multicast network device sends a plurality of the second join messages to the device under test.

[0026] A second aspect of the present application provides a message attack testing system, comprising:

[0027] Test equipment and equipment under test;

[0028] The test device is used to generate a join message and send the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast;

[0029] The device under test is used to receive the join message, parse the join message, and obtain the IP address of the test device; determine whether the multicast neighbor relationship table contains the IP address of the test device; if the IP address of the test device is contained, the device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine the forwarding path of the multicast data sent by the device under test; if the IP address of the test device is not contained, the device under test generates a neighbor check failure result.

[0030] In a possible implementation, the testing device includes:

[0031] a first test device and a second test device;

[0032] The first test device includes a first terminal and a first multicast network device, and the first terminal is connected to the device under test through the first multicast network device;

[0033] The second test device includes a second terminal and a second multicast network device, and the second multicast network device is connected to the first multicast network device, the second terminal, and the device under test respectively.

[0034] A third aspect of the present application provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the message attack testing method of the first aspect or any implementation of the first aspect.

[0035] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0036] The memory is used to store computer programs;

[0037] The processor is used to execute the computer program so that the electronic device can implement the message attack testing method of the above-mentioned first aspect or any implementation manner of the first aspect.

[0038] In a fifth aspect, the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can use the message attack testing method of the above-mentioned first aspect or any implementation of the first aspect.

[0039] By means of the above technical solution, the message attack testing method and related apparatus provided by the present application are as follows: a test device generates a join message and sends the join message to a device under test; the device under test receives the join message, parses the join message, and obtains the IP address of the test device; the device under test determines whether the IP address of the test device is contained in the multicast neighbor relationship table; if the IP address of the test device is contained, the device under test generates a multicast data forwarding table entry based on the join message; if the IP address of the test device is not contained, the device under test generates a neighbor check failure result. By determining whether the IP address of the test device is contained in the multicast neighbor relationship table, it is possible to detect whether the received join message is a join message sent by a multicast neighbor, thereby avoiding the problem of a large number of join messages not sent by multicast neighbors generating a large number of multicast data forwarding table entries, thereby occupying a large amount of system resources and CPU resources, and affecting the normal services of the multicast network device, and preventing attacks by malicious messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0041] Figure 1 A schematic diagram of a multicast transmission model provided in this application;

[0042] Figure 2 A flow chart of a message attack testing method provided by this application;

[0043] Figure 3 A schematic diagram of a message attack test system provided in this application;

[0044] Figure 4Schematic diagram of the multicast service traffic page constructed by PC1 provided for this application;

[0045] Figure 5 Schematic diagram of the multicast service traffic field constructed by PC1 provided in this application;

[0046] Figure 6 Schematic diagram of the page for PC2 to join the multicast group provided for this application;

[0047] Figure 7 Schematic diagram of PC2 joining the multicast group field provided for this application;

[0048] Figure 8 Schematic diagram of multicast PIM neighbors of switch 1 provided in this application;

[0049] Figure 9 Schematic diagram of multicast PIM neighbors of switch 2 provided in this application;

[0050] Figure 10 IGMP table diagram provided for this application;

[0051] Figure 11 A schematic diagram of a PIM forwarding table entry created by switch 2 provided in this application;

[0052] Figure 12 A schematic diagram of a PIM forwarding table entry created by the switch 1 provided in this application;

[0053] Figure 13 A schematic diagram of another PIM forwarding table entry created by switch 1 provided in this application;

[0054] Figure 14 A schematic diagram of another PIM forwarding table entry created by switch 2 provided in this application;

[0055] Figure 15 Schematic diagram of the Ethernet frame header of the PIM join message provided in this application;

[0056] Figure 16 Schematic diagram of the IP header of the PIM join message provided for this application;

[0057] Figure 17 A schematic diagram of a Join message header of a PIM Join message provided in this application;

[0058] Figure 18 A partial schematic diagram of a Join message header of a PIM Join message provided in this application;

[0059] Figure 19 Schematic diagram of establishing an invalid multicast entry for switch 1 provided in this application;

[0060] Figure 20 A schematic diagram of the CPU occupancy of switch 1 provided in this application;

[0061] Figure 21 A schematic diagram of a PIM neighbor check failure result of a switch 1 provided in this application;

[0062] Figure 22 A structural diagram of a message attack test system provided by this application;

[0063] Figure 23 This is a schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0064] The following describes the embodiments of the present application in conjunction with the accompanying drawings. The terms used in the implementation methods of the present application are only used to explain the specific embodiments of the present application and are not intended to limit the present application.

[0065] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0066] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0067] The characteristics of multicast transmission are single-point sending and multi-point receiving. Figure 1The figure shows a schematic diagram of the multicast transmission model. The dotted line is the multicast traffic transmission path. The multicast traffic sent by the multicast source is transmitted to the host through the multicast network device. The multicast source only sends one copy of the data. Only the multicast group members (host A and host B) can receive the multicast traffic data sent by the multicast source. Other hosts in the network (such as host C) cannot receive the multicast traffic data. The multicast source is the sender of the information. A multicast source can send data to multiple multicast groups at the same time, and multiple multicast sources can also send messages to a multicast group at the same time. A multicast group is a collection identified by an IP multicast address. Any user host (or other receiving device) that joins a multicast group becomes a member of the group and can identify and receive multicast data sent to the multicast group. The multicast network device can be a router or switch that supports three-layer multicast functions, such as Figure 1 Each switch in the multicast network device can not only provide multicast routing functions, but also provide multicast group member management functions on the terminal network segments connected to users. A host that joins a multicast group becomes a member of the multicast group, such as Figure 1 The members of the multicast group are dynamic, and hosts can join or leave the multicast group at any time.

[0068] Layer 3 multicast services are vulnerable to attacks: Malicious users send a large number of Protocol Independent Multicast (PIM) Join messages, causing a large number of invalid multicast entries to be created on the switch, occupying a large amount of system and CPU resources and affecting normal switch services.

[0069] Based on this, the embodiment of the present application provides a message attack testing method that can check received Join messages to prevent malicious Join message attacks, thereby solving the above problem. The message attack testing method of the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0070] A message attack testing method provided in an embodiment of the present application is applied to a message attack testing system, which includes a testing device and a device under test.

[0071] like Figure 2 As shown, the message attack testing method includes:

[0072] Step 201: The test device generates a join message and sends the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast.

[0073] The test device may include a first test device and a second test device, the first test device is used to send normal messages to the device under test to test the performance of the device under test based on the normal messages, and the second test device is used to send attack messages to the device under test to test the response of the device under test when facing the attack messages.

[0074] The first test device includes a first terminal and a first multicast network device. The first terminal is connected to the device under test via the first multicast network device. The first terminal can be a computer device such as a host, and the first multicast network device can be a layer 3 switch. Alternatively, the first multicast network device can be a router that supports layer 3 multicast.

[0075] The second test device includes a second terminal and a second multicast network device. The second terminal is connected to the device under test via the second multicast network device, which is also connected to the first multicast network device. The second terminal can be a computer device such as a host, and the second multicast network device can be a layer 2 switch.

[0076] The device under test may include a third multicast network device configured to receive multicast data from a multicast source and forward the multicast data to multicast group members. The multicast source may be a computer device such as a host. The third multicast network device may be a Layer 3 switch or a router supporting Layer 3 multicast functionality.

[0077] The test device generates a join message, that is, both the first test device and the second test device can generate a join message. The join message is a PIM protocol message, and the message type of the PIM protocol message is a Join type.

[0078] In one possible implementation, the first test device generates a join message and sends the join message to the device under test, including:

[0079] The first terminal sends a report message to the first multicast network device; wherein the protocol of the report message is Internet Group Management Protocol;

[0080] The first multicast network device receives the report message and parses the report message to obtain the target multicast group address; wherein the target multicast group address is the multicast group address carried by the device under test when sending multicast data;

[0081] The first multicast network device generates a first join message based on the target multicast group address;

[0082] The first multicast network device sends a first join message to the device under test.

[0083] When a first terminal wants to join a multicast group, it sends a report message to the second multicast network device. The report message uses the Internet Group Management Protocol (IGMP). In practice, a host can send a report message to a Layer 3 switch. The report message carries the target multicast group address, i.e., the IP address of the multicast group that the first terminal wants to join, and the IP address of the first terminal.

[0084] The first multicast network device receives the report message and parses it to obtain the target multicast group address. The target multicast group address is the multicast group address carried by the device under test when sending multicast data, that is, the multicast group address that the first terminal wants to join, so that the multicast data sent by the device under test can be transmitted to the first terminal.

[0085] The first multicast network device generates a first join message based on the target multicast group address and sends it to the device under test. The first join message carries the target multicast group address, the IP address of the first multicast network device, the destination address, and the upstream neighbor IP address. The destination address is the group address of all PIM devices. The PIM devices include the first multicast network device, the second multicast network device, and the third multicast network device. The destination address is a fixed address, namely 224.0.0.13. The upstream neighbor IP address can be determined using the multicast neighbor relationship table.

[0086] In one possible implementation, a method for generating a multicast neighbor relationship table includes:

[0087] The first multicast network device sends a hello message; wherein the protocol of the hello message is protocol-independent multicast;

[0088] When the device under test receives the hello message, it parses the hello message and obtains the IP address of the first multicast network device;

[0089] The device under test generates a multicast neighbor relationship table based on the IP address of the first multicast network device.

[0090] The first multicast network device sends a hello message. This hello message is a PIM protocol message of the hello type. The hello message carries a destination address and a source address. The source address is the IP address of the first multicast network device, and the destination address is the PIM device group address, namely, 224.0.0.13. All PIM devices receive messages with the destination address 224.0.0.13. Therefore, upon receiving the hello message, the device under test (i.e., the third multicast network device, or the Layer 3 switch) parses the hello message and obtains the IP address of the first multicast network device. Based on the IP address of the first multicast network device, the device under test generates a multicast neighbor relationship table. In addition to the IP address of the first multicast network device, the multicast neighbor relationship table may also include the interface of the third multicast network device that receives the hello message.

[0091] Of course, the third multicast network device, as a PIM device, will also send a hello message carrying the IP address of the third multicast network device. When the first multicast network device receives the hello message sent by the third multicast network device, it can also generate a multicast neighbor relationship table. In addition to including the IP address of the third multicast network device, the multicast neighbor relationship table can also include the interface of the first multicast network device for receiving the hello message.

[0092] In one possible implementation, after the first multicast network device receives the report message, the message attack testing method further includes:

[0093] The first multicast network device parses the report message to obtain the IP address of the first terminal;

[0094] The first multicast network device generates an Internet Group Management Protocol table entry based on the IP address of the first terminal, the target multicast group address, and the interface for receiving the report message.

[0095] The Internet Group Management Protocol table entry is an IGMP table entry. After the first multicast network device establishes the IGMP table entry, it can determine which interfaces need to forward multicast traffic data based on the IGMP table entry. That is, if the Internet Group Management Protocol table entry includes an interface for receiving report messages, then after receiving the multicast data, the first multicast network device will send the multicast data through the interface for receiving the report message, and the first terminal can receive the multicast data.

[0096] In one possible implementation, after the first multicast network device receives the report message, the message attack testing method further includes:

[0097] The first multicast network device generates a multicast data forwarding table entry based on the target multicast group address, the multicast neighbor relationship table, and the interface for receiving the report message.

[0098] The IP address of the third multicast network device and the interface of the first multicast network device for receiving hello messages can be obtained from the multicast neighbor relationship table. The multicast data forwarding table entry includes the target multicast group address, the IP address of the third multicast network device, the interface of the first multicast network device for receiving hello messages, and the interface for receiving report messages. The interface for receiving hello messages is used as the inbound interface, and the interface for receiving report messages is used as the outbound interface. The IP address of the third multicast network device is used as RPF (Reverse Path Forwarding) to perform RPF check. This multicast data forwarding table entry is a PIM forwarding table entry, and the type of this PIM forwarding table entry is (*, G), which represents the forwarding path from any multicast source to a specific multicast group G.

[0099] In one possible implementation, the second test device generates a join message and sends the join message to the device under test, including:

[0100] The second terminal generates a plurality of different second join messages based on the plurality of different attack multicast group addresses; wherein the number of the second join messages is the same as the number of the attack multicast group addresses, and the attack multicast group address is different from the multicast group address carried by the device under test when sending multicast data;

[0101] The second terminal transmits a plurality of second join messages to the second multicast network device;

[0102] The second multicast network device sends multiple second join messages to the device under test.

[0103] The second test device serves as an attack test device, and sends a large number of second join messages to the device under test to check whether the device under test will occupy a large number of CPU resources due to the generation of a large number of multicast data forwarding entries.

[0104] Unlike the first test device, which generates the first join message, the first test device generates the first join message on the first multicast network device, i.e., a Layer 3 switch. The second test device generates the second join message on the second terminal, i.e., a host. Furthermore, the first multicast network device generates only one first join message, while the second terminal generates multiple second join messages, with the number of second join messages even far exceeding the number of first join messages. In addition, the first multicast network device generates a first join message based on the target multicast group address, and the second terminal generates a second join message based on multiple different attack multicast group addresses, wherein the multiple different attack multicast group addresses may include the target multicast group address or may not include the target multicast group address. The purpose of generating the same number of second join messages based on multiple different attack multicast group addresses is to send them to the device under test, so that the device under test generates a corresponding multicast data forwarding table entry based on each second join message, that is, a PIM forwarding table entry. However, these large number of PIM forwarding table entries generated are all invalid multicast table entries, thereby occupying a large amount of CPU resources of the device under test, that is, occupying the CPU resources of the third multicast network device, affecting the normal business of the switch.

[0105] Based on multiple different attack multicast group addresses, the second terminal generates multiple different second join messages and sends them to the device under test via a second multicast network device. The second multicast network device can be a Layer 2 switch that transparently transmits the second join messages to the device under test. These second join messages carry multiple different attack multicast group addresses, which can increase in number starting from 239.1.1.1. They also carry the second terminal's IP address, the destination address, and the upstream neighbor IP address. The destination address is the group address of all PIM devices, 224.0.0.13. The upstream neighbor IP address is the IP address of the device under test, that is, the IP address of the third multicast network device.

[0106] Step 202: The device under test receives the join message, parses the join message, and obtains the IP address of the test device.

[0107] The join message can be the first join message or the second join message. If the device under test receives the first join message, the IP address of the first multicast network device is obtained after parsing the first join message. If the device under test receives the second join message, the IP address of the second terminal is obtained after parsing the second join message.

[0108] Step 203: The device under test determines whether the multicast neighbor relationship table contains the IP address of the test device; if so, execute step 204; if not, execute step 205.

[0109] The multicast neighbor relationship table is generated by the device under test based on the IP address of the first multicast network device. The multicast neighbor relationship table contains the IP address of the first multicast network device. If the device under test receives the first join message and parses it to obtain the IP address of the first multicast network device, it can be determined that the multicast neighbor relationship table contains the IP address of the test device. If the device under test receives the second join message and parses it to obtain the IP address of the second terminal, it can be determined that the multicast neighbor relationship table does not contain the IP address of the test device.

[0110] Step 204: The device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine a forwarding path for the multicast data sent by the device under test.

[0111] When the multicast neighbor relationship table contains the IP address of the test device, the IP address of the test device is the IP address of the first multicast network device, and the IP address of the first multicast network device is obtained by parsing the first join message. The device under test can generate a multicast data forwarding table entry based on the first join message.

[0112] In one possible implementation, the device under test generates a multicast data forwarding table entry based on the join message, including:

[0113] The device under test parses the first join message and obtains the target multicast group address;

[0114] The device under test generates a multicast data forwarding table entry based on the target multicast group address and the interface receiving the first join message.

[0115] The multicast data forwarding table entry includes the target multicast group address and the interface receiving the first join message, and the interface receiving the first join message is used as the outgoing interface. The multicast data forwarding table entry is a PIM forwarding table entry, and the type of the PIM forwarding table entry is (*, G), indicating a forwarding path from any multicast source to a specific multicast group G.

[0116] Step 205: The device under test generates a neighbor check failure result.

[0117] When the multicast neighbor relationship table does not contain the IP address of the test device, the IP address of the test device is the IP address of the second terminal, and the IP address of the second terminal is parsed from the second join message. Because the IP address of the second terminal is not in the multicast neighbor relationship table, the second terminal and the first multicast network device are not in a neighbor relationship. The second join message fails the PIM neighbor check on the device under test. The device under test will not generate a multicast data forwarding table entry based on the second join message, and thus will not be processed by the CPU of the device under test, thus not occupying excessive CPU resources. The device under test generates a neighbor check failure result, which can indicate the reason for not generating the multicast data forwarding table entry, as well as the IP address of the second terminal.

[0118] To further illustrate the message attack test method provided by this application, please refer to Figure 3 , Figure 3 Schematic diagram of the message attack test system.

[0119] Figure 3 In the figure, Switch 1 is the device under test, PC 1 is Host 1, serving as the multicast source, Switch 2 and PC 2 are the first test device, Switch 2 is the first multicast network device, PC 2 is Host 2, serving as the first terminal, PC 3 and the Layer 2 switch are the second test device, PC 3 is Host 3, serving as the second terminal, and the Layer 2 switch is the second multicast network device. The dotted circle outlines the multicast domain. Switch 1 has two ports, G1 and G2. Switch 2 also has two ports, G1 and G2. Switch 1's G1 port is connected to PC 1, and Switch 1's G2 port is connected to Switch 2's G2 port via the Layer 2 switch. Switch 2's G1 port is connected to PC 2. PC 3 sends an attack packet to Switch 1, the packet path indicated by the dotted arrow. PC 2 sends a normal packet to Switch 2, which then transmits the packet to Switch 1. Figure 3 The full name of PIM-SM is Protocol Independent Multicast-Sparse Mode.

[0120] Before performing the packet attack test, you can configure Switch 1, Switch 2, PC 1, and PC 2 separately.

[0121] When configuring switch 1, create VLANa1 and VLANa2. VLAN stands for Virtual Local Area Network. Add port G1 of switch 1 to VLANa1, and port G2 of switch 1 to VLANa2. Create interfaces VLANif a1 and VLANif a2, assign IP addresses to them, and enable PIM-SM on them.

[0122] When configuring switch 2, create VLAN b1 and VLAN b2, add port G1 of switch 2 to VLAN b1, and add port G2 of switch 2 to VLAN b2. Create interfaces VLANIF b1 and VLANIF b2, assign IP addresses to interfaces VLANIF b1 and VLANIF b2, enable the multicast protocol PIM-SM function on interfaces VLANIF b1 and VLANIF b2, and enable IGMP on interface VLANIF b1.

[0123] When configuring PC1, install open source software and construct multicast service traffic. Figure 4 Construct a multicast service traffic page diagram for PC1, as shown below: Figure 4 As shown, the IP address is the multicast group IP address: 239.22.22.22, and the transport layer port number Port is 100. Multicast data can be sent to the multicast group corresponding to the multicast group IP address and transport layer port number. The NIC (Network Interface Card) of PC1 is 100.10.10.100. Figure 5 Construct a multicast service traffic field diagram for PC1. The Multicast Group is the group address: 239.22.22.22:100, the NIC is 100.10.10.100, the number of packets is 18593, and the service data payload is 256.

[0124] When configuring PC2, install the open source software and join the multicast group. Figure 6 Schematic diagram of the page for PC2 to join the multicast group, as shown Figure 6 As shown, IP is the multicast group IP address: 239.22.22.22, and the transport layer port number Port is 100. Figure 4 The transport layer port number is the same as that of the NIC on PC2, which is 100.11.11.100. Figure 7 This is a diagram of PC2 joining the multicast group field. The Multicast Group is the group address: 239.22.22.22:100, the NIC is 100.11.11.100, and the number of packets received is 18593, the same as the number of packets sent by PC1.

[0125] During the attack test, the switch 2 of the first test device sends normal messages to the device under test to test the performance of the device under test based on the normal messages.

[0126] Switch 1 and Switch 2 establish a multicast PIM neighbor relationship by sending Hello messages. Figure 8 This is a diagram of the multicast PIM neighbors of switch 1. Figure 8 In the figure, Neighbor Address is the neighbor IP address of Switch 1, that is, the IP address of Switch 2: 100.50.50.2, and Interface is the interface vlanif a2:vlan108 of Switch 1, which is also the interface for sending Hello messages. Figure 9 This is a diagram of the multicast PIM neighbors of switch 2. Figure 9In the figure, Neighbor Address is the neighbor IP address of Switch 2, that is, the IP address of Switch 1: 100.50.50.1, and Interface is the interface vlanif b2:vlan108 of Switch 2, which is also the interface for sending Hello messages.

[0127] After receiving the report message sent by PC2, switch 2 creates an IGMP entry. Figure 10 This is a schematic diagram of IGMP table entries. Figure 10 In the example, Interface is the interface vlanif b1:vlan1011 on switch 2 that receives report messages, Group Address is the multicast group IP address: 239.22.22.22, and Last Reporter Address is the NIC of PC 2, which is 100.11.11.100.

[0128] After Switch 2 receives the report message from PC 2, it sends a Join message to Switch 1. The Join message carries Switch 2's IP address, the multicast group IP address, the PIM message type (Join), the upstream neighbor (Switch 1's IP address), and the destination address (224.0.0.13, which can be intercepted by Switch 1).

[0129] Switch 2 creates a multicast PIM forwarding entry. Figure 11 A schematic diagram of a PIM forwarding table entry created for switch 2. Figure 11 In the example, the PIM forwarding entry type is (*, G), indicating the forwarding path from any multicast source to a specific multicast group, G. The IP address of multicast group G is 239.22.22.22. RPF stands for Reverse Path Forwarding. The IP address of RPF is the IP address of Switch 1. The upstream neighbor can be obtained through the multicast PIM neighbor relationship, and the IP address of RPF is 100.50.50.1. The incoming interface is interface vlanif b2:vlan108 on Switch 2, which is the inbound interface for Switch 2 to receive multicast traffic data. The outgoing interface is interface vlanif b1:vlan1011 on Switch 2, which is the outbound interface for Switch 2 to send multicast traffic data.

[0130] After receiving the Join message from Switch 2, Switch 1 creates a multicast PIM forwarding entry. Figure 12 A schematic diagram of a PIM forwarding table entry created for switch 1. Figure 12In the example, the PIM forwarding entry type is (*, G), indicating the forwarding path from any multicast source to a specific multicast group G. The IP address of multicast group G is 239.22.22.22. The Outgoing Interface is interface vlanif a2:vlan108 on Switch 1, which is the outgoing interface for multicast traffic sent by Switch 2.

[0131] When the multicast source PC1 sends multicast traffic data, it is received by the interface vlanif a1:vlan100 of switch 1, and forwarded to switch 2 through the interface vlanif a2:vlan108 of switch 1. The interface vlanif b2:vlan108 of switch 2 receives the multicast traffic data, and then the interface vlanif b1:vlan1011 of switch 2 forwards the multicast traffic data to host PC2. In this process, both switch 1 and switch 2 will create PIM forwarding entries. Figure 13 and Figure 14 shown.

[0132] Figure 13 Schematic diagram of another PIM forwarding table entry created for switch 1. Figure 14 Schematic diagram of another PIM forwarding entry created for Switch 2. Figure 13 In the example, the PIM forwarding entry type is (S, G), indicating the forwarding path from multicast source S to multicast group G. The IP address of multicast source S is 100.10.10.100, which is the IP address of PC 1. The IP address of multicast group G is 239.22.22.22. The incoming interface is interface vlanif a1:vlan100 on switch 1, which is the inbound interface for multicast traffic received by switch 1. The outgoing interface is interface vlanif a2:vlan108 on switch 1, which is the outbound interface for multicast traffic sent by switch 1.

[0133] Figure 14 Schematic diagram of a PIM forwarding table created for switch 2. Figure 13In the example, the PIM forwarding entry type is (S, G), indicating the forwarding path from multicast source S to multicast group G. The IP address of multicast source S, which is PC1's IP address, is 100.10.10.100. The IP address of multicast group G is 239.22.22.22. The incoming interface is switch 2's interface vlanif b2:vlan108, which is the inbound interface for multicast traffic. The outgoing interface is switch 2's interface vlanif b1:vlan1011, which is the outbound interface for multicast traffic. The RPF IP address is switch 1's IP address. The upstream neighbor can be determined through the multicast PIM neighbor relationship, and the RPF IP address is 100.50.50.1.

[0134] During the attack test, the second test device PC3 sends an attack message to the device under test to test the response of the device under test to the attack message.

[0135] Configure PC3, install open source software on PC3, and construct a multicast protocol PIM Join message, such as Figure 15-18 shown.

[0136] Figure 15 Schematic diagram of the Ethernet frame header of the PIM add message. Figure 15 In the figure, Destination Mac is the destination Mac (Media Access Control Address), which corresponds to the destination IP address 224.0.0.13 (the destination IP address 224.0.0.13 is known, and the destination Mac address is parsed through the mapping relationship with the destination IP address 224.0.0.13). The destination Mac address is 01:00:5e:00:00:0d, and Source Mac is the source Mac address, which is also the PC3 Mac address.

[0137] Figure 16 Schematic diagram of the IP header of the PIM add message. Figure 16 In the figure, Source address is the source address, that is, the IP address of PC3: 100.50.50.100, and Destination address is the destination IP address: 224.0.0.13.

[0138] Figure 17 This is a diagram of a Join message header in a PIM Join message. Figure 17In the example, the PIM message type is 3, indicating a Join message. Upstream Neighbor is the upstream neighbor, meaning PC3's upstream neighbor is Switch 1. Unicast Address is the upstream neighbor's IP address, Switch 1's IP address (100.50.50.1), which allows Switch 1 to verify that the Join message is intended for Switch 1. Group Address is the group address, one of which is 239.1.1.1, the attack multicast group IP address.

[0139] Figure 18 A partial diagram of a PIM Join message header. Figure 18 In the example, PC3 generates a large number of join messages to attack Switch 1. The multicast group address Group Multicast Address starts from 239.1.1.1 and increases one by one to obtain multiple different attack multicast group addresses. That is, the attack multicast group IP addresses are 239.1.1.1, 239.1.1.2, 239.1.1.3, etc., thereby generating the same number of join messages as the attack multicast group addresses.

[0140] After PC 3 generates a large number of join messages, if Switch 1 does not perform a neighbor check (that is, does not determine whether PC 3's IP address is in the multicast neighbor table), Switch 1 will generate a PIM forwarding entry for each PIM join message sent by PC 3. This will cause Switch 1 to create a large number of invalid multicast entries, consuming an excessive amount of Switch 1's CPU resources. Figure 19 Schematic diagram of establishing an invalid multicast entry for switch 1. Figure 19 In the example, the multicast group addresses are 239.1.1.1, 239.1.1.2, 239.1.1.3, 239.1.1.4, and 239.1.1.5. The Outgoing Interface is interface vlanif a2:vlan108 on Switch 1, which is the outgoing interface for multicast traffic data sent by Switch 1.

[0141] Since the PIM join message is sent to the CPU (Central Processing Unit) of switch 1 for processing, it occupies a large amount of CPU resources. Figure 20 This is a diagram of the CPU usage of switch 1. Figure 20 As shown, the CPU utilization CurrUse reaches 100.00%, affecting the normal services of switch 1.

[0142] After PC3 generates a large number of join messages, if switch 1 performs a neighbor relationship check, that is, determines whether the multicast neighbor relationship table contains PC3's IP address, combined with Figure 16 and Figure 8 The IP address of PC 3, 100.50.50.100, is different from 100.50.50.2. PC 3's IP address is not in the neighbor table established by Switch 1. When the join message sent by PC 3 reaches Switch 1, Switch 1 checks the neighbor table and finds that PC 3 is not a neighbor. Therefore, Switch 1 does not generate a PIM forwarding entry based on PC 3's join message, which reduces the CPU usage of Switch 1.

[0143] Because the source IP address of the multicast protocol PIM join message sent by PC3 is different from the PIM neighbor IP address of switch 1, the join message fails the PIM neighbor check on switch 1, and switch 1 generates a neighbor check failure result. The neighbor check failure result can indicate the reason for not generating a multicast data forwarding table entry and the IP address of the second terminal. Figure 21 This is a diagram showing the PIM neighbor check failure result for switch 1. Figure 21 In the example, the IP address detected is 100.50.50.100. The content circled in the rectangle indicates that the Join message failed to be decoded and the neighbor check failed. At this time, the Join message sent by PC3 will not be created in the multicast table on Switch 1 and will not be processed by the CPU, thus not occupying excessive CPU resources on Switch 1.

[0144] The message attack testing method provided by this application detects whether a received join message is from a multicast neighbor by determining whether the test device's IP address is present in the multicast neighbor relationship table. This method avoids the problem of generating a large number of multicast data forwarding table entries due to a large number of join messages from non-multicast neighbors, which would occupy a large amount of system and CPU resources and affect the normal operation of multicast network devices. It can also prevent malicious message attacks. In addition, this testing method can perform attack tests on multicast protocol PIM join messages without the need for a tester, which can reduce testing costs.

[0145] The above describes a message attack testing method provided in an embodiment of the present application. The following describes a system for executing the above message attack testing method.

[0146] The present application embodiment provides a message attack testing system, such as Figure 22 As shown, the system includes:

[0147] Test equipment and equipment under test;

[0148] The test device is used to generate a join message and send the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast;

[0149] The device under test is used to receive a join message, parse the join message, and obtain the IP address of the test device; determine whether the multicast neighbor relationship table contains the IP address of the test device; if the IP address of the test device is contained, the device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine the forwarding path of the multicast data sent by the device under test; if the IP address of the test device is not contained, the device under test generates a neighbor check failure result.

[0150] In one possible implementation, the testing device includes:

[0151] A first test device 11 and a second test device 12;

[0152] The first test device includes a first terminal 111 and a first multicast network device 112, and the first terminal is connected to the device under test through the first multicast network device;

[0153] The second test device includes a second terminal 113 and a second multicast network device 114. The second multicast network device is connected to the first multicast network device, the second terminal, and the device under test respectively.

[0154] Optionally, the device under test includes: a third multicast network device 115.

[0155] Optionally, the message attack test system further includes: a multicast source 116.

[0156] Multicast source 116 is connected to third multicast network device 115 , which is connected to first multicast network device 112 via second multicast network device 114 . First multicast network device 112 is connected to first terminal 111 , and second multicast network device 114 is connected to second terminal 113 .

[0157] In one possible implementation,

[0158] The first multicast network device is further configured to send a hello message; wherein the protocol of the hello message is protocol-independent multicast;

[0159] The device under test is further configured to, upon receiving a hello message, parse the hello message to obtain the IP address of the first multicast network device; and generate a multicast neighbor relationship table based on the IP address of the first multicast network device.

[0160] In one possible implementation,

[0161] The first terminal is further configured to send a report message to the second multicast network device; wherein the protocol of the report message is the Internet Group Management Protocol;

[0162] The first multicast network device is further configured to receive a report message and parse the report message to obtain a target multicast group address, wherein the target multicast group address is the multicast group address carried by the device under test when sending multicast data; generate a first join message based on the target multicast group address; and send the first join message to the device under test.

[0163] In one possible implementation,

[0164] The device under test is further configured to parse the first join message to obtain a target multicast group address; and generate a multicast data forwarding entry based on the target multicast group address and an interface for receiving the first join message.

[0165] In one possible implementation,

[0166] The second terminal is further configured to generate a plurality of different second join messages based on a plurality of different attack multicast group addresses; wherein the number of the second join messages is the same as the number of the attack multicast group addresses, and the attack multicast group address is different from the multicast group address carried by the device under test when sending multicast data; and transmit the plurality of second join messages to the second multicast network device;

[0167] The second multicast network device is further configured to send multiple second join messages to the device under test.

[0168] An electronic device is also provided in an embodiment of the present application. Figure 23 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic device in the embodiments of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 23 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0169] like Figure 23 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 2301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 2302 or a program loaded from a storage device 2308 into a random access memory (RAM) 2303. When the electronic device is powered on, the RAM 2303 also stores various programs and data required for the operation of the electronic device. The processing device 2301, the ROM 2302, and the RAM 2303 are connected to each other via a bus 2304. An input / output (I / O) interface 2305 is also connected to the bus 2304.

[0170] Typically, the following devices may be connected to the I / O interface 2305: an input device 2306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 2307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 2308 including, for example, a memory card, a hard disk, etc.; and a communication device 2309. The communication device 2309 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 23 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0171] The electronic device can implement the above-mentioned message attack testing method.

[0172] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any one of the message attack testing methods provided in the embodiments of the present application.

[0173] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any message attack testing method provided in the embodiment of the present application.

[0174] It should also be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided in this application, the connection relationship between the modules indicates that there is a communication connection between them, which can be specifically implemented as one or more communication buses or signal lines.

[0175] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memories, special components, etc. In general, all functions performed by computer programs can be easily implemented with corresponding hardware, and the specific hardware structures used to implement the same function can also be diverse, such as analog circuits, digital circuits or special circuits, etc. However, for the present application, software program implementation is a better implementation method in most cases. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer's floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., and includes a number of instructions to enable a computer device (which can be a personal computer, training equipment, or network equipment, etc.) to execute the methods described in each embodiment of the present application.

[0176] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0177] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, a computer, a training device or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website, a computer, a training device or a data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

Claims

1. A message attack testing method, characterized in that: Applied to a message attack test system, the message attack test system includes a test device and a device under test, and the method includes: The test device generates a join message and sends the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast; The device under test receives the join message, parses the join message, and obtains the IP address of the test device; The device under test determines whether the multicast neighbor relationship table contains the IP address of the test device; If the IP address of the test device is included, the device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine a forwarding path for the multicast data sent by the device under test; If the IP address of the testing device is not contained, the device under test generates a neighbor check failure result.

2. The message attack testing method according to claim 1, characterized in that: The test device includes a first test device, the first test device includes a first multicast network device, and the method further includes: The first multicast network device sends a hello message; wherein the protocol of the hello message is protocol-independent multicast; When the device under test receives the hello message, it parses the hello message to obtain the IP address of the first multicast network device; The device under test generates the multicast neighbor relationship table based on the IP address of the first multicast network device.

3. The message attack testing method according to claim 2, characterized in that: The first test device further includes a first terminal. The test device generates a join message and sends the join message to the device under test, including: The first terminal sends a report message to the first multicast network device; wherein the protocol of the report message is Internet Group Management Protocol; The first multicast network device receives the report message and parses the report message to obtain a target multicast group address; wherein the target multicast group address is the multicast group address carried by the device under test when sending the multicast data; The first multicast network device generates a first join message based on the target multicast group address; The first multicast network device sends the first join message to the device under test.

4. The message attack testing method according to claim 3, characterized in that: The device under test generates a multicast data forwarding table entry based on the join message, including: The device under test parses the first join message to obtain the target multicast group address; The device under test generates the multicast data forwarding entry based on the target multicast group address and the interface for receiving the first join message.

5. The message attack testing method according to any one of claims 1 to 4, characterized in that: The test device includes a second test device, the second test device includes a second terminal and a second multicast network device, the test device generates a join message, and sends the join message to the device under test, including: The second terminal generates a plurality of different second join messages based on a plurality of different attack multicast group addresses; wherein the number of the second join messages is the same as the number of the attack multicast group addresses, and the attack multicast group address is different from the multicast group address carried by the device under test when sending the multicast data; The second terminal transmits the plurality of second join messages to the second multicast network device; The second multicast network device sends a plurality of the second join messages to the device under test.

6. A message attack testing system, characterized in that: include: Test equipment and equipment under test; The test device is used to generate a join message and send the join message to the device under test; wherein the protocol of the join message is protocol-independent multicast; The device under test is used to receive the join message, parse the join message, and obtain the IP address of the test device; determine whether the multicast neighbor relationship table contains the IP address of the test device; if the IP address of the test device is contained, the device under test generates a multicast data forwarding table entry based on the join message; wherein the multicast data forwarding table entry is used to determine the forwarding path of the multicast data sent by the device under test; if the IP address of the test device is not contained, the device under test generates a neighbor check failure result.

7. The message attack test system according to claim 6, characterized in that: The testing equipment comprises: a first test device and a second test device; The first test device includes a first terminal and a first multicast network device, and the first terminal is connected to the device under test through the first multicast network device; The second test device includes a second terminal and a second multicast network device, and the second multicast network device is connected to the first multicast network device, the second terminal, and the device under test respectively.

8. A computer program product, characterized in that The method comprises computer-readable instructions, which, when executed on an electronic device, enable the electronic device to implement the message attack testing method according to any one of claims 1 to 5.

9. An electronic device, characterized in that: comprising at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the message attack testing method according to any one of claims 1 to 5.

10. A computer storage medium, characterized in that The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the message attack testing method according to any one of claims 1 to 5.

Images