Method and device for detecting IP address conflict through ARP data packet

Abstract

The invention relates to the technical field of network communication, and particularly discloses a method and equipment for detecting IP address conflict through an ARP data packet. According to the method, the IP address conflict is detected through the ARP data packet, the corresponding conflict detection process is executed based on the type of the ARP data packet, whether a plurality of devices with the same IP address and MAC address send the ARP data packet exists is judged, and therefore whether the IP address conflict occurs is determined, bypass packet capture analysis is adopted, extra network overhead is not increased, and the method and the device have the advantages of being simple in structure and convenient to operate. And the method is wide in application range and simple in implementation logic.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication, and in particular to a method and device for detecting IP address conflicts through ARP data packets. Background Art

[0002] IP address conflicts are a common problem in computer networks. IP address conflicts can cause abnormal communication between the conflicting hosts, and in serious cases can cause the entire network to slow down or even paralyze the network. Therefore, operation and maintenance personnel hope to be able to promptly detect IP address conflict faults in the network, and quickly locate and repair the faults.

[0003] There are currently some methods for detecting IP address conflicts, but their scope of application is not wide, their implementation logic is complex, and they have certain limitations and shortcomings. Therefore, it is necessary to provide a new and more effective method for IP address conflict detection. Summary of the invention

[0004] In order to overcome the problems existing in the existing methods for detecting IP address conflicts, such as limited application scope and complex implementation logic, the present invention provides a method and device for detecting IP address conflicts through ARP data packets.

[0005] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions: In a first aspect, the present invention provides a method for detecting IP address conflicts through ARP packets, comprising: Obtaining an ARP data packet and a cache table of the ARP data packet, wherein the cache table includes an IP address and a MAC address of a sending host; Execute a corresponding conflict detection process based on the type of the ARP data packet; Wherein, when the ARP data packet is an ARP response packet, the conflict detection process is a first conflict detection process, including: Determine whether there are ARP response packets with the same IP address but different MAC addresses of the sending hosts; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0006] According to a specific implementation, in the above method for detecting IP address conflicts, the cache table also includes the IP address of the target host.

[0007] According to a specific implementation, in the above method for detecting IP address conflicts, when the ARP data packet is a free ARP request packet, the conflict detection process is a second conflict process, including: Determine whether there are gratuitous ARP request packets with the same IP address of the target host and different MAC addresses of the sending host; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0008] According to a specific implementation, in the above method for detecting IP address conflicts, the cache table also includes a MAC address of the target host.

[0009] According to a specific implementation, in the above method for detecting IP address conflicts, when the ARP data packet is a free ARP request packet and a corresponding ARP response packet, the conflict detection process is a third conflict detection process, including: Determine whether there is a situation between the gratuitous ARP request packet and the ARP response packet where the MAC address of the host sending the gratuitous ARP request packet is the same as the MAC address of the target host of the ARP response packet and the IP address of the host sending the gratuitous ARP request packet is the same as the IP address of the target host of the ARP response packet; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0010] According to a specific implementation, in the above-mentioned method for detecting IP address conflicts, when the ARP data packet is an ARP request packet, the first conflict detection process is executed on the ARP response packet contained in the ARP request packet, and after determining that no conflict occurs, the third conflict detection process is executed on the free ARP request packet and the corresponding ARP response packet contained in the ARP request packet.

[0011] According to a specific implementation, in the above method for detecting IP address conflicts, when it is determined that an IP address conflict occurs after the conflict detection process, an alarm is triggered and the conflicting ARP data packet is deleted.

[0012] According to a specific implementation, in the above method for detecting IP address conflicts, when it is determined that no conflict occurs after the conflict detection process, a record is inserted into the cache table.

[0013] According to a specific implementation, in the above method for detecting IP address conflicts, the judgment period of the conflict detection process is 100ms.

[0014] In a second aspect, the present invention provides an electronic device, the device comprising a memory and a processor; The memory is used to store a computer program; the processor is used to call and execute the computer program so that the device executes any one of the above methods for detecting IP address conflicts through ARP data packets.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention detects IP address conflicts through ARP data packets, including executing a corresponding conflict detection process based on the type of the ARP data packet, judging whether there are multiple devices with the same IP address and MAC address sending ARP data packets, thereby determining whether an IP address conflict has occurred. The present invention adopts bypass packet capture analysis, does not increase additional network overhead, can make timely judgments, has a wide range of applications, and has simple implementation logic. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of the ARP message format provided by an embodiment of the present invention; Figure 2 A flowchart of a method for detecting IP address conflicts through ARP packets provided by an embodiment of the present invention; Figure 3 A flowchart of a method for detecting IP address conflicts through ARP packets provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below in conjunction with test examples and specific implementation methods. However, this should not be understood as the scope of the above subject matter of the present invention being limited to the following embodiments, and all technologies realized based on the content of the present invention belong to the scope of the present invention.

[0018] The terms "first", "second", etc. in the embodiments of the specification, claims, and drawings of the present invention are used only for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, including a series of steps or units. The method, system, product, or device is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0019] In order to better introduce and illustrate the technology provided by the present invention, the problems existing in the existing methods for detecting IP address conflicts are briefly introduced below.

[0020] In an existing method for detecting IP address conflicts, it includes broadcasting request messages to other network devices in the local area network at regular intervals; determining whether a reply message to the request message is received; if it is determined that a reply message is received, it is determined that there is an IP address conflict, and conflict location information is sent to the network management station; wherein the conflict location information includes: the IP address of the network device that caused the conflict in other network devices. This method requires regular packet detection of devices in the network, which causes additional network overhead.

[0021] Another existing method for detecting IP address conflicts includes obtaining the address to be used and the routing table configuration information of the level where the address is located, and the routing table configuration information includes: the destination address, using the address to be used and the destination address, determining the cross-comparison result, and if the cross-comparison result is a conflict, determining the target device corresponding to the destination address. In this method, the routing table information is dynamically updated, and there is a time difference between the acquisition time and the update time, resulting in untimely judgment of IP address conflicts.

[0022] In another existing method for detecting IP address conflicts, which is based on the SDN architecture, the controller uniformly calculates whether there is an address conflict. If there is an address conflict, it notifies the low-priority switch to modify the IP address without exchanging free ARP packets. This method is only applicable to the SDN architecture and has a limited scope of use.

[0023] Another existing method for detecting IP address conflicts includes obtaining an allocated IP address, identifying the allocated IP address as an IP address that may be in a dormant conflict state; detecting the IP address that may be in a dormant conflict state, and determining whether the IP address that may be in a dormant conflict state has activity; when the IP address that may be in a dormant conflict state has activity, continuously detecting the IP address in a normal use state at an activity state detection time interval; when the IP address that may be in a dormant conflict state has no activity, detecting the IP address that may be in a dormant conflict state at a variable detection time interval. However, the implementation logic of this method is complex.

[0024] It should be noted that the main function of the ARP protocol is to obtain the MAC address of the target host through the IP address of the target host to achieve the correct transmission of data packets. In network communication, when the sending host needs to send data to the target host, if there is no mapping relationship between the IP address and MAC address of the target host in the ARP cache of the sending host, the sending host will broadcast an ARP request message to request other hosts in the network segment to respond to its MAC address. If the IP address of the host that receives the request matches the target IP address in the request, it will reply with an ARP reply message to inform its own MAC address. In this way, the sending host can obtain the MAC address of the target host and then send data directly to the target host.

[0025] It is understandable that ARP (Address Resolution Protocol) is a TCP / IP protocol that obtains physical addresses based on IP addresses. When a host sends information, it broadcasts an ARP request containing the target IP address to all hosts on the local area network and receives a return message to determine the target's physical address; after receiving the return message, the IP address and physical address are stored in the local ARP cache and retained for a certain period of time. The next request directly queries the ARP cache to save resources.

[0026] ARP messages are divided into ARP request and ARP reply messages. The message format is as follows: Figure 1 As shown, Hardware Type: indicates the type of hardware address. Its value is 1, indicating Ethernet address; Protocol Type: indicates the type of protocol address to be mapped. Its value is 0x0800, indicating IP address; Hardware Address Length and Protocol Address Length indicate the length of hardware address and protocol address respectively, in bytes. For ARP request or reply of IP address on Ethernet, their values ​​are 6 and 4 respectively; Operation Type (OP): 1 indicates ARP request, 2 indicates ARP reply; Sender MAC Address: hardware address of sender device; Sender IP Address: IP address of sender device; Target MAC Address: hardware address of receiver device. Target IP Address: IP address of receiver device.

[0027] When sending a free ARP message (to find your own IP address, for example, I need the MAC address of 10.1.1.1, and 10.1.1.1 is your own IP address), you do not expect to receive a response, but only hope to have a declaration effect; if you receive a response, it proves that the other party also uses your current IP address. When all network devices (including computer network cards) are up, they will send such free ARP broadcasts to announce and confirm whether there is any conflict.

[0028] On this basis, the present invention detects IP address conflicts through different types of ARP data packets. Furthermore, the present invention detects IP address conflicts through ARP data packets, including executing a corresponding conflict detection process based on the type of the ARP data packet, judging whether there are multiple devices with the same IP address and MAC address sending ARP data packets, thereby determining whether an IP address conflict has occurred. The present invention adopts bypass packet capture analysis, does not increase additional network overhead, can make timely judgments, has a wide range of applications, and has simple implementation logic.

[0029] The following is a detailed introduction and description of a method for detecting IP address conflicts through ARP packets provided by the present invention. Figure 2 , which shows a flow chart of a method for detecting IP address conflicts through ARP packets provided by an embodiment of the present invention, the method comprising: S1. Obtain an ARP data packet and a cache table of the ARP data packet; S2. Execute a corresponding conflict detection process based on the type of the ARP data packet.

[0030] It should be noted that the cache table of ARP packets stores the correspondence between the IP addresses and MAC addresses of each computer in the network. When a host needs to send data to another host, it first searches its own ARP cache table for the MAC address of the target host. If a matching entry is found, the host can directly use this MAC address to send data, thus saving time and resources for broadcasting requests for the target MAC address. If the MAC address information of the target host is not found in the ARP cache table, the host will send an ARP request broadcast to all hosts on the LAN, requesting the MAC address of the target host. When the target host receives the ARP request, it will send its own IP address and MAC address back to the requesting host, so that the requesting host can obtain the MAC address of the target host and add it to its own ARP cache table so that it can be used directly next time without sending an ARP request again.

[0031] The ARP cache table exists to optimize the network communication process. By caching the mapping relationship between IP addresses and MAC addresses, it reduces unnecessary network broadcasts and improves the efficiency of data transmission. The entries in the ARP cache table have a certain time to live (TTL). When an entry expires, if you need to use it again, you need to re-query ARP to update the information in the cache table.

[0032] In a possible implementation, when the ARP data packet is an ARP response packet, the conflict detection process is a first conflict detection process, including: Determine whether there are ARP response packets with the same IP address but different MAC addresses of the sending hosts; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0033] In a possible implementation, based on the fact that the cache table also includes the IP address of the target host, when the ARP data packet is a free ARP request packet, the conflict detection process is a second conflict process, including: Determine whether there are gratuitous ARP request packets with the same IP address of the target host and different MAC addresses of the sending host; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0034] In a possible implementation, based on the cache table further including the MAC address of the target host, when the ARP data packet is a free ARP request packet and a corresponding ARP response packet, the conflict detection process is a third conflict detection process, including: Determine whether there is a situation between the gratuitous ARP request packet and the ARP response packet where the MAC address of the host sending the gratuitous ARP request packet is the same as the MAC address of the target host of the ARP response packet and the IP address of the host sending the gratuitous ARP request packet is the same as the IP address of the target host of the ARP response packet; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

[0035] The above-mentioned conflict detection process is provided by an embodiment of the present invention for performing corresponding conflict detection based on different types of ARP data packets. On this basis, when the ARP data packet is an ARP request packet, the first conflict detection process is executed on the ARP response packet contained in the ARP request packet, and after determining that no conflict occurs, the third conflict detection process is executed on the free ARP request packet and the corresponding ARP response packet contained in the ARP request packet.

[0036] It should be noted that, in the judgment of the above ARP data packet, the judgment is made through the decoded content of the ARP protocol, wherein an operation code (Opcode) of 1 indicates a request packet, and 2 indicates a response packet.

[0037] In order to complete the entire conflict detection process, the embodiment of the present invention also includes: When an IP address conflict is determined after the conflict detection process, an alarm is triggered and the conflicting ARP data packet is deleted; And, when it is determined that no conflict occurs after the conflict detection process, a record is inserted into the cache table.

[0038] In a possible implementation, in the above method for detecting IP address conflicts, the judgment period of the conflict detection process is 100ms. This time is considered that the time interval of ARP request response is basically within this period. In addition, if the period is too long, more data packets will be detected, affecting the detection performance.

[0039] The present invention improves the accuracy of IP address conflict detection by executing a specific conflict detection process for different types of ARP data packets. The present invention can detect and respond to IP address conflicts in a timely manner, preventing network security problems caused by conflicts, such as ARP spoofing attacks. Furthermore, the periodic conflict detection process of the present invention reduces unnecessary performance overhead and improves the efficiency of network management. At the same time, the automated alarm and processing mechanism reduces the manual intervention of network administrators and reduces human resource costs.

[0040] Please refer to Figure 3 , which shows a flow chart of a method for detecting IP address conflicts through ARP packets provided by another embodiment of the present invention. In this embodiment, the following steps are included: Step 1: Detect the type of the ARP data packet and determine whether the ARP data packet is an ARP request packet; Step 2: If yes, get the list data in the ARP request packet and jump to step 3; if no, jump to step 4; Step 3: performing a first conflict detection process on the ARP response packets in the ARP request packet, including: determining whether there are ARP response packets with the same IP address but different MAC addresses of the sending hosts; If so, it is determined that an IP address conflict has occurred, an alarm is triggered, and the matching record is deleted from the list; otherwise, it is determined that no conflict has occurred, and the process jumps to step 6; Step 4: Determine whether the ARP data packet is a free ARP request packet, if so, jump to step 5, if not, discard the ARP data packet; Step 5, obtaining the list data of the free ARP request packets, and executing the second conflict detection process, including: determining whether there are free ARP request packets with the same IP address of the target host and different MAC addresses of the sending host; If so, it is determined that an IP address conflict occurs, an alarm is triggered, and the matching record is deleted from the list; otherwise, it is determined that no conflict occurs, and the process jumps to step 7; Step 6: Execute a third conflict detection process for the gratuitous ARP request packet and the corresponding ARP response packet in the ARP request packet, including: determining whether there is a conflict between the gratuitous ARP request packet and the ARP response packet, in which the MAC address of the sending host of the gratuitous ARP request packet is the same as the MAC address of the target host of the ARP response packet, and the IP address of the sending host of the gratuitous ARP request packet is the same as the IP address of the target host of the ARP response packet; If so, it is determined that an IP address conflict has occurred, an alarm is triggered, and the matching record is deleted from the list; otherwise, it is determined that no conflict has occurred and if so, jump to step 7; Step 7: Insert the ARP packets that have no IP address conflicts after conflict detection into the list.

[0041] It can be understood that the above-mentioned list is a cache table of ARP data packets, and the contents of the list include the type of the data packet, timestamp, senderMAC (sending host MAC address), senderIP (sending host IP address), TargetMAC (target host MAC address), TragetIP (target host IP address), etc.

[0042] In actual detection, the embodiments of the present invention are mainly applied to the following three scenarios, including: Conflict scene 1: Scenario description: If the SenderMac of two different ARP response packets is different but the SenderIp is the same, it means that the two hosts use the same IP address and there is an IP address conflict.

[0043] Correspondingly, the judgment method includes: two ARP response packets, Packet1.senderIp ==Packet2.senderIp&&Packet1.senderMac != Packet2.senderMac (if the sending host IP address of the first ARP response packet is equal to the sending host IP address of the second ARP response packet, and the sending host MAC address of the first ARP response packet is not equal to the sending host MAC address of the second ARP response packet, then the result of this conditional expression is true; if any of the above two conditions is not met, then the result of the expression is false.).

[0044] Conflict scene 2: Scenario description: Two different free ARP request packets have different senderMacs but the same TargetIP, indicating that two different hosts claim the same IP address, indicating an IP address conflict.

[0045] Correspondingly, the judgment methods include: Packet1.TargetIp == Packet2.TargetIp&&Packet1.senderMac != Packet2.senderMac (if the target host IP address of the first free ARP request packet is equal to the target host IP address of the second free ARP request packet, and the sending host MAC address of the first free ARP request packet is not equal to the sending host MAC address of the second free ARP request packet, then the result of this conditional expression is true; if any of the above two conditions is not met, then the result of the expression is false).

[0046] Conflict scenario three: Scenario description: A free ARP request packet declared an IP address to be used, but a response packet was received, indicating that another host also used the IP address. (A free ARP request packet received a response indicating an IP address conflict) Correspondingly, the judgment method includes: a free ARP request packet, a response packet Request.senderMac == Response.TargetMac&&Request.senderIp ==Response.targetIp (If the MAC address of the sending host of the request packet is equal to the target host MAC address of the response packet, and the IP address of the sending host of the request packet is equal to the target host IP address of the response packet, then the result of this conditional expression is true; if any of the above two conditions is not met, then the result of the expression is false).

[0047] It can be understood that the conflict detection process corresponding to different types of ARP data packets provided by the embodiment of the present invention can be arbitrarily combined or matched during actual use, so as to realize the method of detecting IP address conflicts through ARP data packets provided by the embodiment of the present invention during different data transmission processes, which will not be repeated here.

[0048] Furthermore, an embodiment of the present invention also provides an electronic device, the device comprising a memory and a processor; The memory is used to store a computer program; the processor is used to call and execute the computer program so that the device executes any one of the above methods for detecting IP address conflicts through ARP data packets.

[0049] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0050] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.

[0051] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.

[0052] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.

[0053] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), sync link DRAM (SLDRAM), and direct rambus RAM (DRRAM).

[0054] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0055] Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way for easy understanding.

[0056] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting IP address conflicts through ARP packets, characterized in that: The method comprises: Obtaining an ARP data packet and a cache table of the ARP data packet, wherein the cache table includes an IP address and a MAC address of a sending host; Execute a corresponding conflict detection process based on the type of the ARP data packet; Wherein, when the ARP data packet is an ARP response packet, the conflict detection process is a first conflict detection process, including: Determine whether there are ARP response packets with the same IP address but different MAC addresses of the sending hosts; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

2. The method for detecting IP address conflicts through ARP packets according to claim 1, characterized in that: The cache table also includes the IP address of the target host.

3. The method for detecting IP address conflicts through ARP packets according to claim 2, characterized in that: When the ARP data packet is a free ARP request packet, the conflict detection process is a second conflict process, including: Determine whether there are gratuitous ARP request packets with the same IP address of the target host and different MAC addresses of the sending host; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

4. The method for detecting IP address conflicts through ARP packets according to claim 1, characterized in that: The cache table also includes the MAC address of the target host.

5. The method for detecting IP address conflicts through ARP packets according to claim 4, characterized in that: When the ARP data packet is a free ARP request packet and a corresponding ARP response packet, the conflict detection process is a third conflict detection process, including: Determine whether there is a situation between the gratuitous ARP request packet and the ARP response packet where the MAC address of the host sending the gratuitous ARP request packet is the same as the MAC address of the target host of the ARP response packet and the IP address of the host sending the gratuitous ARP request packet is the same as the IP address of the target host of the ARP response packet; If so, it is determined that an IP address conflict occurs; otherwise, it is determined that no conflict occurs.

6. The method for detecting IP address conflicts through ARP packets according to claim 5, characterized in that: When the ARP data packet is an ARP request packet, the first conflict detection process is performed on the ARP response packet included in the ARP request packet, and after determining that no conflict occurs, the third conflict detection process is performed on the free ARP request packet and the corresponding ARP response packet included in the ARP request packet.

7. A method for detecting IP address conflicts through ARP packets according to any one of claims 1 or 3 or 5 or 6, characterized in that: When an IP address conflict is determined after the conflict detection process, an alarm is triggered and the conflicting ARP packets are deleted.

8. A method for detecting IP address conflicts through ARP packets according to any one of claims 1 or 3 or 5 or 6, characterized in that: When it is determined that no conflict occurs after the conflict detection process, a record is inserted into the cache table.

9. The method for detecting IP address conflicts through ARP packets according to claim 1, characterized in that: The judgment cycle of the conflict detection process is 100ms.

10. An electronic device, characterized in that: The device comprises a memory and a processor; The memory is used to store a computer program; the processor is used to call and execute the computer program, so that the device performs the method according to any one of claims 1 to 9.

Images