Safety protecting method for digital user line cut-in multiplexing device

Abstract

The present invention discloses a safety protection method for digit user line accessing multiplexer, referring to computer network and telecommunication network technology field. Said method includes single board hard ware catching special protocol message from corresponded each XDSL port and sending to single board CPU; single board CPU detecting received special protocol message and judging in unit time whether said special protocol message flow rate exceeding predetermined threshold, if it is not then single board CPU uploading said special protocol message to host computer CPU processing, otherwise single board CPU stopping uploading said special protocol message to host computer CPU. The present invention does not need manually configuring MAC address or MAC address maximum learning number in subscriber access port, reducing maintenance quantity and important protocol message lose, and reducing CPU use rate.

Description

[technical field] [0001] The invention relates to the technical fields of computer network and telecommunication network, in particular to a safety protection method for a digital subscriber line access multiplexer. [Background technique] [0002] As operators put forward the demand for broadband network flattening (that is, the reduction of network layers) to save investment, DSLAM (Digital Subscriber Line Access Multiplexer) realizes more high-level protocol message processing, and Functions such as IP forwarding and other Layer 2 and Layer 3 switches or routers can only be implemented. Since a large number of protocol packets need to be analyzed by software modules, the CPU load of the DSLAM device is usually very high. If too many protocol packets are processed, the As a result, the CPU occupancy rate is 100%, which in turn causes other important processes to be "starved to death" because they cannot be processed in time. The harm brought is unpredictable and may cause v...

AI Technical Summary

Problems solved by technology

The main defect of using this method is that there is no subdivision of packet types, and some packets that are not attack packets but need to be processed by the CPU may also be discarded, resulting in the disorder of important protocol states. At the same time, the packets are unified Processed by the host, its CPU usage is still high

[0006] Attack packets on the current network are generally initiated from the user side, that is, the ADSL access side. Illegal users use some packet sending tools of the computer to send a large number of packets to the upper network, and the DSLAM device mainly processes ARP from the user side. (Address Resolution Protocol), IGMP (Internet Group Management Protocol), PPPOE (PPP over Ethernet Point-to-Point Protocol) and DHCP (Dynamic Host Configuration Protocol). If the user side Sending a large number of these protocol packets to the DSLAM, and if the DSLAM needs to be processed, the CPU usage of the DSLAM device will be very high, which may lead to the danger of device reset, even if the above two methods can be used to a certain extent However, it is difficult to manage or may cause the loss of other important protocol packets, which is not a complete solution to the problem.

Images