Message processing method, electronic equipment and readable storage medium

Abstract

The invention discloses a message processing method, electronic equipment and a readable storage medium, and belongs to the field of communication. The message processing method disclosed by the invention is applied to network equipment and comprises the following steps: aiming at a first target address resolution message, acquiring a first duration of a specified number of times of MAC address change in the first target address resolution message; and in response to the fact that the first duration is smaller than a threshold value, stopping address resolution learning for a second target address resolution message in a target time period. The method and the device are used for preventing address resolution attacks.

Description

Technical Field

[0001] The present application belongs to the field of communications, and specifically relates to a message processing method, an electronic device and a readable storage medium. Background Art

[0002] Address Resolution Protocol (ARP) is a TCP / IP protocol that resolves physical addresses based on IP addresses.

[0003] Since there is a security verification vulnerability in the design of the ARP protocol, current attackers often exploit this vulnerability to conduct address resolution attacks in the network by forging ARP packets.

[0004] After being attacked by address resolution, network devices often occupy a large amount of CPU resources for ARP learning. In order to prevent address resolution attacks, related technologies limit ARP learning sessions by setting CPU usage. However, in this way of preventing address resolution attacks, the CPU usage will fluctuate greatly due to address resolution attacks, affecting the stability of network devices. Summary of the invention

[0005] The embodiments of the present application provide a message processing method, an electronic device, and a readable storage medium to solve the problem in the related art that the CPU usage rate fluctuates greatly due to address resolution attacks, thereby affecting the stability of network devices.

[0006] In a first aspect, an embodiment of the present application provides a message processing method, which is applied to a network device, including: For the first target address resolution message, obtaining a first duration of a specified number of MAC address changes in the first target address resolution message; In response to the first duration being less than a threshold, stopping address resolution learning for a second target address resolution message within a target time period.

[0007] In a second aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores a program or instructions, and when the program or instructions are executed by the processor, the method described in the first aspect is implemented.

[0008] In a third aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the method described in the first aspect is implemented.

[0009] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0010] In an embodiment of the present application, the first duration of the specified number of MAC address changes in the first target address resolution message is obtained; in response to the first duration being less than a threshold, the address resolution learning for the second target address resolution message is stopped within the target time period. In this way, the first duration of the specified number of MAC address changes is used as a measure. When the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short period of time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing address resolution messages, and the CPU usage rate will not fluctuate greatly due to address resolution attacks. It can solve the problem in the related technology that the CPU usage rate fluctuates greatly due to address resolution attacks, affecting the stability of network devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flow chart of a message processing method provided by an embodiment of the present application; Figure 2 is a flowchart of another message processing method provided in an embodiment of the present application; Figure 3 is a flowchart of another message processing method provided in an embodiment of the present application; Figure 4 It is a schematic diagram of an example network implementation environment of the message processing method in the embodiment of the present application; Figure 5 It is a schematic diagram of a message processing method provided in an embodiment of the present application; Figure 6 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0013] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0014] The host broadcasts the ARP request containing the target IP address information to all hosts in the network and receives the return message to determine the physical address corresponding to the target IP address, that is, the Media Access Control (MAC) address; after receiving the return message, the IP address and physical address are stored in the local ARP cache and retained for a certain period of time so that the ARP cache can be directly queried on the next request to save resources.

[0015] The message processing method provided in the embodiment of the present application can be executed by a network device, and the network device can be a message processing device. The message processing device can specifically be a message forwarding device, such as a router or a switch. The message processing method provided in the embodiment of the present application can be used to prevent address resolution attacks, such as address resolution attacks in a local area network. After the network device receives an address resolution message (such as an ARP request message / neighbor discovery request message), if the MAC address corresponding to the target IP address contained in the message does not exist in the IP and MAC address correspondence table of the network device, the network device triggers address resolution learning (such as ARP learning and ARP change), and counts the duration of the MAC (MAC is legal) in the address resolution message to change a specified number of times (such as M times). When the duration of the MAC change specified number of times is less than the threshold, the device will not trigger address resolution learning (such as ARP learning and ARP change) within the target time period (a period of time); when the duration of the MAC change specified number of times exceeds the threshold time, the network device resumes address resolution learning (such as resuming the triggering ARP learning and change mechanism).

[0016] Figure 1 1 is a flow chart of a message processing method provided by an embodiment of the present application. Figure 1 As shown, the message processing method provided in the embodiment of the present application includes: Step 110, for a first target address resolution message, obtaining a first duration of a specified number of MAC address changes in the first target address resolution message; In an embodiment of the present application, the first target address resolution message may be an address resolution message received by the network device. The address resolution message may include at least one of an ARP message and a neighbor discovery (ND) message. The address resolution message received by the network device may include at least one of an address resolution request message and an address resolution response message. In one example, the first target address resolution message is a received address resolution request message.

[0017] The first target address resolution message includes a target IP address. After receiving the first target address resolution message, the network device may determine a MAC address change in the first target address resolution message in response to the absence of a MAC address corresponding to the target IP address in the IP and MAC address correspondence table of the network device. In other words, the MAC address change in the first target address resolution message indicates that there is no MAC address corresponding to the target IP address in the IP and MAC address correspondence table of the network device. The target IP address may be a source IP address, and a MAC address change may refer to a change in the source MAC address. The network device may count the number of MAC address changes in the first target address resolution message, and obtain a first duration of a specified number of MAC address changes in the first target address resolution message.

[0018] In one embodiment of the present application, obtaining the first duration of the specified number of MAC address changes in the first target address resolution message in step 110 includes: obtaining a first time point and a second time point, the first time point being the starting statistical time point of the MAC address change; the second time point being the time point when the MAC address change reaches the specified number of times; determining the first time difference between the second time point and the first time point, and using the first time difference as the first duration of the specified number of MAC address changes. Among them, the starting statistical time point of the first change of the MAC address is the timestamp when the network device receives the first target address resolution message, that is, the time point when the first target address resolution message is received can be used as the starting statistical time point of the first change of the MAC address.

[0019] Step 120: In response to the first duration being less than a threshold, stop address resolution learning for a second target address resolution message within a target time period.

[0020] In an embodiment of the present application, the starting time point of the target time period may be the time point when the network device determines that the first duration is less than a threshold value. That is, the target time period may be a period of time calculated from the time point when the first duration is determined to be less than the threshold value. Among them, the target time period may be a fixed value or a continuously changing value. In the case where the target time period is a continuously changing value, the value of the target time period is related to the number of consecutive executions of stop address resolution learning. For example, the value of the target time period increases as the number of consecutive executions of stop address resolution learning increases.

[0021] In an embodiment of the present application, the second target address resolution message may be an address resolution message received by the network device. For example, the second target address resolution message is an address resolution message received by the network device after determining that the first duration is less than a threshold. The address resolution message may include at least one of an ARP message and a neighbor discovery (ND) message.

[0022] In an embodiment of the present application, stopping address resolution learning for the second target address resolution message may mean stopping writing target information into the IP and MAC address correspondence table of the network device, wherein the target information comes from the second target address resolution message. The target information may include at least one of the MAC address and the IP address of the second target address resolution message. The MAC address of the second target address resolution message may be a source MAC address. The IP address of the second target address resolution message may be a source IP address.

[0023] It should also be pointed out that in the embodiment of the present application, stopping the address resolution learning for the second target address resolution message may include stopping at least one of the active learning of address resolution and the passive learning of address resolution. Since the probability of passive learning of address resolution being triggered by an address resolution attack is extremely high, therefore, in one embodiment of the present application, the second target address resolution message may be a received address resolution request message, at which time the address resolution learning for the address resolution request message may be stopped, i.e., the passive learning of address resolution may be stopped. In this way, the address resolution attack of the address resolution request message can be prevented, while the active learning of address resolution is not affected, greatly reducing the probability of accidental injury.

[0024] In the embodiment of the present application, not only can address resolution learning be stopped for all address resolution request messages, but also specific address resolution request messages can be screened out from the address resolution request messages, and address resolution learning for these specific address resolution request messages can be stopped. In a specific embodiment, the address resolution request message includes at least one of a first message and a second message, the first message is a message not in the whitelist, and the second message is a message with a priority level less than a preset level. In this way, address resolution learning can be stopped for the first message (the message not in the whitelist) and the second message (the message with a priority level less than a preset level), further enhancing the targetedness of preventing geological resolution attacks and avoiding the probability of accidental injuries.

[0025] In an embodiment of the present application, the first duration of the specified number of MAC address changes in the first target address resolution message is obtained; in response to the first duration being less than a threshold, the address resolution learning for the second target address resolution message is stopped within the target time period. In this way, the first duration of the specified number of MAC address changes is used as a measure. When the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short period of time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing address resolution messages, and the CPU usage rate will not fluctuate greatly due to address resolution attacks. It can solve the problem in the related technology that the CPU usage rate fluctuates greatly due to address resolution attacks, affecting the stability of network devices.

[0026] Figure 2 : is a flow chart of a message processing method provided in an embodiment of the present application. The message processing method provided in an embodiment of the present application can be applied to a network device and may include: Step 210, for the first target address parsing message, obtain a first time point and a second time point, the first time point is the starting time point of MAC address change statistics; the second time point is the time point when the MAC address changes reach a specified number of times; In the embodiment of the present application, once a MAC address change occurs in the first target address resolution message, the network device can record the starting statistical time point of the MAC address change. In this way, the network device can obtain the time point when the MAC address change reaches the specified number of times by recording the time point of each MAC address change. The specified number of times can be set as needed.

[0027] Step 220, determining a first time difference between the second time point and the first time point, and using the first time difference as a first duration for changing the specified number of MAC addresses; Step 230, in response to the first duration being less than the threshold, stopping address resolution learning for the second target address resolution message within the target time period; In an embodiment of the present application, the threshold is in units of time, and the threshold time can be set as needed. The starting time point of the target time period can be the time point when the network device determines that the first duration is less than the threshold. In other words, the target time period can be a period of time calculated from the time point when the first duration is determined to be less than the threshold. Among them, the target time period can be a fixed value or a continuously changing value. In the case where the target time period is a continuously changing value, the value of the target time period is related to the number of consecutive executions of stop address resolution learning. For example, the value of the target time period increases as the number of consecutive executions of stop address resolution learning increases.

[0028] In one embodiment, before step 230, the message processing method provided by the embodiment of the present application may also include: in response to the first duration being less than a threshold, determining the number of consecutive executions of stopping address resolution learning; in response to the number being 0, determining the target time period as a preset time period; in response to the number being an integer greater than 0, determining the target time period based on the duration of the most recent stop of address resolution learning, the first duration and the preset time period.

[0029] In an embodiment of the present application, the rate at which the network device receives messages with changed MAC addresses is less than or equal to the rate at which the network device processes messages with changed MAC addresses. Therefore, there may be an association between the specified number of times and the threshold. The rate at which the network device receives messages with changed MAC addresses can be represented by the ratio of the specified number of times to the threshold, and the rate at which the network device processes messages with changed MAC addresses can be represented by the ratio of the specified number of times to the preset time period.

[0030] In one embodiment of the present application, the specified number of times and the threshold satisfy the following relationship: 0<(M / P)≤n*(M / T); Wherein, M is the specified number of times, P is the threshold, T is the preset time period, and n is a constant determined based on the device stability index. Wherein, the device stability index includes at least one of CPU usage, memory occupancy, and hard disk occupancy. The value of N is, for example, 1.

[0031] It should also be pointed out that in the embodiment of the present application, stopping the address resolution learning for the second target address resolution message may include stopping at least one of the active learning of address resolution and the passive learning of address resolution. Since the probability of passive learning of address resolution being triggered by an address resolution attack is extremely high, therefore, in one embodiment of the present application, the second target address resolution message may be a received address resolution request message, at which time the address resolution learning for the address resolution request message may be stopped, i.e., the passive learning of address resolution may be stopped. In this way, the address resolution attack of the address resolution request message can be prevented, while the active learning of address resolution is not affected, greatly reducing the probability of accidental injury.

[0032] In the embodiment of the present application, not only can address resolution learning be stopped for all address resolution request messages, but also specific address resolution request messages can be screened out from the address resolution request messages, and address resolution learning for these specific address resolution request messages can be stopped. In a specific embodiment, the address resolution request message includes at least one of a first message and a second message, the first message is a message not in the whitelist, and the second message is a message with a priority level less than a preset level. In this way, address resolution learning can be stopped for the first message (the message not in the whitelist) and the second message (the message with a priority level less than a preset level), further enhancing the targetedness of preventing geological resolution attacks and avoiding the probability of accidental injuries.

[0033] Step 240: In response to the second duration being greater than or equal to the threshold, resume address resolution learning for the second target address resolution message; wherein the second duration is the duration of a specified number of MAC address changes in the second target address resolution message.

[0034] In an embodiment of the present application, the second target address resolution message may be an address resolution message received by the network device. For example, the second target address resolution message is an address resolution message received by the network device after determining that the first duration is less than a threshold. The address resolution message may include at least one of an ARP message and a neighbor discovery (ND) message.

[0035] It should be understood that if the time point when the second duration is greater than or equal to the threshold falls within the target time period, the address resolution learning for the second target address resolution message can be resumed after the target time period is met. If the time point when the second duration is greater than or equal to the threshold falls outside the target time period, the address resolution learning for the second target address resolution message can be resumed immediately.

[0036] In an embodiment of the present application, after the address resolution learning for the second target address resolution message is stopped within the target time period, the duration of the MAC address change for a specified number of times, i.e., the second duration, can be obtained based on the received address resolution message. If the obtained second duration is greater than or equal to the threshold, step 240 can be executed.

[0037] The second duration being greater than or equal to the threshold value may indicate that the received address resolution message is most likely not an address resolution attack but a normal address resolution message. At this time, the address resolution learning for the second target address resolution message may be restored, so that the address resolution learning may be avoided from being suppressed for a long time, thereby avoiding affecting the normal address resolution learning.

[0038] In the embodiment of the present application, the first duration of the specified number of MAC address changes is used as a measure. When the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short period of time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing address resolution messages, and the CPU usage rate will not fluctuate greatly due to address resolution attacks. It can solve the problem in the related technology that the CPU usage rate fluctuates greatly due to address resolution attacks, affecting the stability of network devices. In addition, after the address resolution learning for the second target address resolution message is stopped within the target time period, the address resolution learning for the second target address resolution message can be resumed under certain conditions to avoid affecting the normal address resolution learning.

[0039] Figure 3 : is a flow chart of a message processing method provided in an embodiment of the present application. The message processing method provided in an embodiment of the present application can be applied to a network device and may include: Step 310: acquiring an address resolution message for a designated object from the received address resolution message, and determining the address resolution message for the designated object as a first target address resolution message; The designated object includes at least one of a designated board of the network device, a designated physical interface of the network device, and a designated virtual local area network (VLAN) interface of the network device. In this way, the designated object can be set as needed, and address resolution attacks can be prevented for the designated object.

[0040] In an embodiment of the present application, after receiving an address resolution message, the network device may first determine whether the message needs to be protected against attacks. If protection against attacks is required, it supports counting address resolution messages (such as address resolution request messages) received by the network device based on at least one of a single board, a VLAN interface, and a physical interface. By default, the address resolution messages received by the entire device can be counted.

[0041] Step 320, for the first target address parsing message, obtain a first time point and a second time point, the first time point is the starting time point of the MAC address change statistics; the second time point is the time point when the MAC address changes reach a specified number of times; Among them, the first target address resolution message includes a target IP address. When there is no MAC address corresponding to the target IP address in the IP and MAC address correspondence table of the network device, it is determined that the MAC address in the first target address resolution message has changed.

[0042] Step 330, determining a first time difference between the second time point and the first time point, and using the first time difference as a first duration for changing the specified number of MAC addresses; Step 340, in response to the first duration being less than a threshold, determining the number of times the address resolution learning is stopped in succession; Step 350, in response to the number being 0, determining the target time period to be a preset time period; Step 360, in response to the number being an integer greater than 0, determining a target time period based on the duration of the most recent stop of address resolution learning, the first duration, and the preset time period.

[0043] In the embodiment of the present application, the value of the target time period may be related to the number of times the address resolution learning is continuously executed. For example, the value of the target time period increases as the number of times the address resolution learning is continuously executed increases.

[0044] In a specific embodiment, the target time period is determined by: T i =|T i-1 -δt|+T; Among them, T i is the target time period for stopping address resolution learning for the ith consecutive execution, T i-1 is the duration of stopping address resolution learning for the i-1th time, δt is the first duration, and T is the preset time period; Wherein, i is an integer greater than 0. i is the target time period determined this time, T i-1 The duration of the most recent stop of address resolution learning.

[0045] By determining the target time period through the above formula, it can be ensured that the obtained target time period has better applicability and achieves a good effect of preventing address resolution attacks.

[0046] Step 370, stopping address resolution learning for the second target address resolution message within the target time period; In the embodiment of the present application, stopping the address resolution learning for the second target address resolution message may include stopping at least one of the active learning of address resolution and the passive learning of address resolution. Since the probability of passive learning of address resolution being triggered by an address resolution attack is extremely high, therefore, in one embodiment of the present application, the second target address resolution message may be a received address resolution request message, at which time the address resolution learning for the address resolution request message may be stopped, that is, the passive learning of address resolution is stopped. In this way, the address resolution attack of the address resolution request message can be prevented, while the active learning of address resolution is not affected, greatly reducing the probability of accidental injury.

[0047] In the embodiment of the present application, not only can the address resolution learning be stopped for all address resolution request messages, but also specific address resolution request messages can be screened out from the address resolution request messages, and the address resolution learning for these specific address resolution request messages can be stopped. Specifically, a whitelist or priority function can be set for the address resolution message (such as the address resolution request message), and when performing the action of suppressing the address resolution message, it can be selected whether to suppress the learning of the address resolution message according to the whitelist or priority setting. For example, the address resolution message in the whitelist is not suppressed, or the address resolution message is suppressed according to the priority level (for example, suppressing the address resolution message with a low priority, and then suppressing or not suppressing the address resolution message with a high priority). In a specific embodiment, the address resolution request message includes at least one of a first message and a second message, the first message is a message not in the whitelist, and the second message is a message with a priority level less than a preset level. In this way, address resolution learning can be stopped for the first message (message not in the whitelist) and the second message (message with priority lower than the preset level), further enhancing the targeted prevention of geological resolution attacks, reducing the impact on normal address resolution learning and updating, and avoiding the probability of accidental injury.

[0048] Step 380: In response to the second duration being greater than or equal to the threshold, resuming address resolution learning for the second target address resolution message, the second duration being the duration of a specified number of changes of the MAC address in the second target address resolution message.

[0049] In the embodiment of the present application, the first duration of the specified number of MAC address changes is used as a measure. When the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short period of time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing the address resolution message, and the CPU usage rate will not fluctuate greatly due to the address resolution attack, which can solve the problem that the CPU usage rate fluctuates greatly due to the address resolution attack in the related art, affecting the stability of the network device. Moreover, after the address resolution learning for the second target address resolution message is stopped within the target time period, the address resolution learning for the second target address resolution message can be restored under certain conditions to avoid affecting the normal address resolution learning. In addition, when the number of consecutive executions of stopping address resolution learning is an integer greater than 0, the target time period is determined based on the duration of the most recent stop of address resolution learning, the first duration and the preset time period, which can ensure that the obtained target time period has better applicability, achieve a good effect of preventing address resolution attacks, and further avoid the CPU usage rate from fluctuating greatly due to address resolution attacks.

[0050] It should be pointed out that Figures 1 to 3 References may be made to the same or similar steps in the discussion. Figure 1 The discussion of step 120 in FIG. 1 also applies to Figure 2 Step 230 and Figure 3 Step 370 in . For another example, Figure 2 The discussion of step 240 in the same manner applies to Figure 3 Step 380 in .

[0051] The message processing method provided in the embodiment of the present application is further explained below.

[0052] Reference Figure 4 In the application scenario shown, the normal address resolution message processing flow can be as follows: After receiving the address resolution request message, the network device (such as a router) will determine whether the target IP address contained in the message exists in the network device's IP and MAC address correspondence table. If the target IP address contained in the message exists in the network device's IP and MAC address correspondence table, the network device can perform normal forwarding processing. If the target IP address contained in the message does not exist in the network device's IP and MAC address correspondence table, the network device will trigger address resolution learning. Among them, Figure 4 The connection relationship of the network devices shown is only an example. In fact, any device in the local area network with address resolution and learning function can be used as a network device.

[0053] However, in the scenario of an address resolution message attack, the source IP address in the address resolution request message sent by the message attacker may change 100 times, and the source MAC address may change 10,000 times. At this time, the MAC address corresponding to the source IP cannot be found in the IP and MAC address correspondence table on the network device, which will trigger ARP learning, causing the CPU usage rate to fluctuate greatly due to the address resolution attack, affecting the stability of the network device. The message processing method provided in the embodiment of the present application uses the first duration of the specified number of MAC address changes as a measurement. When the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short period of time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing address resolution messages, and the CPU usage rate will not fluctuate greatly due to address resolution attacks. It can solve the problem in the related art that the CPU usage rate fluctuates greatly due to address resolution attacks, affecting the stability of the network device. The following is combined with Figure 5 Further discussion.

[0054] Figure 5 Schematic diagram of a method for processing a message provided in an embodiment of the present application. Figure 5 If the number of address resolution messages received by the network device is extremely large, the number of IP address changes is large (for example, 100 times), and the number of MAC address changes is very large (for example, the MAC address changes 10,000 times), then the example flow of processing the messages may be as follows: 1) After receiving the address resolution request message, the network device first determines whether the message needs to be protected against attacks; the judgment conditions can be based on single boards (i.e. certain single boards on the device), based on physical interfaces (i.e. certain physical interfaces on the device), and based on VLAN interfaces (i.e. certain VLAN interfaces on the device); and these conditions are all configurable.

[0055] 2) Messages that do not meet the judgment conditions are processed according to the normal address resolution message processing flow; 3) Messages that meet the judgment conditions will trigger the anti-attack process, record the starting statistical time point of the MAC address change in the message, and the starting statistical time point of the first change in the message can be the timestamp N1 when the message is received, and start counting the number of changes in the MAC address of the received legal message.

[0056] 4) When the number of MAC address changes of the received legal message reaches M times (specified number of times), the timestamp N2 at this time is recorded; where M is an integer greater than 1; 5) Calculate the difference between N2 and N1 to obtain the duration of the MAC address change M times, such as the first duration. When this duration is greater than or equal to the threshold time P, address resolution learning can continue. When this duration is less than the threshold time P, the network device stops address resolution learning, that is, ARP learning and ARP change will not be triggered, and the mechanism continues for the target time period. Among them, the target time period for the first execution of stopping address resolution learning can be represented by T0, and T0=T, T is the preset time period; 6) When the number of MAC address changes in the legitimate message received by the network device reaches M times again, the timestamp N3 is recorded; 7) Calculate the difference between N3 and N2 to obtain the duration of the new MAC address change M times, such as the second duration. When this duration is less than the threshold time P, the network device determines the number of consecutive executions of stopping address resolution learning. The current number of consecutive executions of stopping address resolution learning is 1. In response to the number being an integer greater than 0, based on the duration of the most recent stop of address resolution learning, the first duration and the preset time period, determine the target time period when the number of consecutive executions of stopping address resolution learning is 1, and stop address resolution learning within the target time period, that is, keep the mechanism of not updating the IP and MAC correspondence table. The duration of this mechanism is T1 (that is, the target time period when the number of consecutive executions of stopping address resolution learning is 1), where T1=T0-(N3-N2)+T; 8) When the difference between N3 and N2 is greater than the threshold time P, the network device resumes address resolution learning, that is, the mechanism for triggering ARP learning and ARP change is resumed. At this time, the subsequent process is similar to the above, and the timestamp when the number of MAC address changes in the legal message received by the network device reaches M times again can be obtained, and the duration of the MAC address change M times can be re-recorded. When this duration is less than the threshold time P, the network device determines the number of consecutive executions to stop address resolution learning, and then determines the target time period; the network device stops address resolution learning in the target time period, that is, it will not trigger ARP learning and ARP change.

[0057] In the above process, the number of MAC address changes M, the threshold time P and the preset time period T can all be configured on the network device, and the values ​​of M, P and T conform to the following rule: 0<(M / P)<=n*(M / T). That is, M / P is the rate at which the network device receives messages with MAC changes, and M / T is the rate at which the network device processes messages with MAC address changes. n is a quantitative value and can be formulated based on the performance of its own product. For example, n is a constant determined based on the device stability index.

[0058] It can be seen from the above technical solution that when the duration of the specified number of MAC address changes in the received address resolution message is less than the threshold, the learning and updating of the address resolution message can be suppressed, so that the device CPU will not surge or fluctuate greatly, affecting the system stability.

[0059] Figure 6 is a structural block diagram of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the embodiment of the present application also provides an electronic device 600. The electronic device 600 includes: a processor 610 and a memory 620, and the memory 620 stores a program or instruction. When the program or instruction is executed by the processor 610, the steps of any method described above are implemented. For example, when the program is executed by the processor 610, the following process is implemented: for the first target address resolution message, the first duration of the MAC address change specified times in the first target address resolution message is obtained; in response to the first duration being less than the threshold, the address resolution learning for the second target address resolution message is stopped within the target time period. In this way, taking the first duration of the MAC address change specified times as a metric, when the first duration is less than the threshold, it means that the first target address resolution message has frequent MAC address changes in a short time. At this time, the address resolution learning for the second target address resolution message is stopped within a certain time period (i.e., the target time period), which greatly reduces the large amount of CPU resources occupied by processing address resolution messages, and the CPU usage rate will not fluctuate greatly due to address resolution attacks, which can solve the problem that the CPU usage rate fluctuates greatly due to address resolution attacks in the related art, affecting the stability of network devices. .

[0060] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of any embodiment of the message processing method are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0061] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0062] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0063] An embodiment of the present application provides a computer program product, including a computer program. When the program is executed by a processor, the various processes of any of the above method embodiments are implemented and the same technical effects can be achieved. To avoid repetition, they are not described here.

[0064] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0065] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0066] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A message processing method, characterized in that: Applied to network equipment, including: For the first target address resolution message, obtaining a first duration of a specified number of changes of a media access control MAC address in the first target address resolution message; In response to the first duration being less than a threshold, stopping address resolution learning for a second target address resolution message within a target time period.

2. The method according to claim 1, characterized in that The obtaining of a first duration of a specified number of changes of a media access control MAC address in the first target address resolution message includes: Obtain a first time point and a second time point, where the first time point is the starting time point for counting MAC address changes; and the second time point is the time point when the MAC address changes reach a specified number of times; A first time difference between the second time point and the first time point is determined, and the first time difference is used as a first duration for changing the MAC address a specified number of times.

3. The method according to claim 1, characterized in that The first target address resolution message includes a target IP address, and the method further includes: in response to the absence of a MAC address corresponding to the target IP address in the IP and MAC address correspondence table of the network device, determining a MAC address change in the first target address resolution message.

4. The method according to claim 1, characterized in that: The specified number of times and the threshold value satisfy the following relationship: 0<(M / P)≤n*(M / T); Wherein, M is the specified number of times, P is the threshold, T is a preset time period, and n is a constant determined based on the equipment stability index.

5. The method according to claim 1, characterized in that The second target address resolution message is a received address resolution request message.

6. The method according to claim 5, characterized in that The address resolution request message includes at least one of a first message and a second message, the first message is a message not in the whitelist, and the second message is a message with a priority lower than a preset level.

7. The method according to any one of claims 1 to 6, characterized in that: Before stopping address resolution learning for the second target address resolution message within the target time period, the method further includes: In response to the first time duration being less than a threshold, determining the number of times the address resolution learning is continuously executed; In response to the number being 0, determining the target time period to be a preset time period; In response to the number being an integer greater than 0, a target time period is determined based on the duration of the most recent stop of address resolution learning, the first time period, and the preset time period.

8. The method according to claim 7, characterized in that In response to the number being an integer greater than 0, determining the target time period based on the duration of the most recent stop of address resolution learning, the first time period, and the preset time period, includes: The target time period is determined as follows: T i =|T i-1 -δt|+T; Among them, T i is the target time period for stopping address resolution learning for the ith consecutive execution, T i-1 is the duration of stopping address resolution learning for the i-1th time, δt is the first duration, and T is the preset time period; Here, i is an integer greater than 0.

9. The method according to any one of claims 1 to 6, characterized in that: Before obtaining a first duration of a specified number of media access control MAC address changes in the first target address resolution message, the method further includes: Obtaining an address resolution message for a specified object from the received address resolution message; Determine the address resolution message for the designated object as the first target address resolution message; The designated object includes at least one of a designated board of the network device, a designated physical interface of the network device, and a designated virtual local area network interface of the network device.

10. The method according to any one of claims 1 to 6, characterized in that: The first target address resolution message includes at least one of an Address Resolution Protocol ARP message and a Neighbor Discovery ND message.

11. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: In response to the second time duration being greater than or equal to the threshold, resuming address resolution learning for the second target address resolution message; The second duration is the duration during which the MAC address in the second target address resolution message changes a specified number of times.

12. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or an instruction, and when the program or the instruction is executed by the processor, the method according to any one of claims 1 to 11 is implemented.

13. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 11 when being executed by a processor.

Images