Method and device for measuring inconsistency of inbound source address verification filtering

Abstract

The invention relates to the technical field of network measurement, in particular to a method and a device for measuring inconsistency of inbound source address verification filtering, and the method comprises the following steps: fixing all flow identifiers in ICMP (Internet Control Message Protocol) unreachable information messages so as to execute multiple rounds of ICMP unreachable information measurement on each measurable target to obtain a first measurement result; changing a preset flow identifier in the ICMP unreachable message so as to execute multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result; and determining whether the load balancing causes instability of the inbound source address verification measurement according to the first measurement result and the second measurement result. Therefore, the problem that the traditional method cannot judge whether the observed filtering inconsistency originates from the real strategy difference in the network or the detection message is distributed to different inlet paths in a load balancing manner is solved.

Description

Technical Field

[0001] This invention relates to the field of network measurement technology, and in particular to a method and apparatus for measuring inconsistencies in Inbound Source Address Validation (ISAV) filtering caused by multipath forwarding based on control flow identifier identification. Background Technology

[0002] Source Address Verification (SAV) is a critical component of internet security architecture, but in actual deployments, inbound SAV (ISAV) exhibits significant heterogeneity: such as Figure 1 As shown, different ingress routers within an Autonomous System (AS) may be configured with different filtering policies. If probe packets enter the same target network from different ingresses due to load balancing, the phenomenon of "the same spoofed packet receiving different filtering results in different rounds" may occur, i.e., inconsistent SAV policies on multiple paths. The core assumption of traditional ISAV measurement is that "probe packets targeting the same target have stable paths in the network." This assumption does not hold when load balancing exists, making it impossible for traditional methods to determine whether the observed filtering inconsistencies stem from actual policy differences within the network or from probe packets being distributed to different ingress paths by load balancing.

[0003] Load balancing is a widely used link expansion and redundancy mechanism in modern networks, typically including:

[0004] (1) Per-destination load balancing: Traffic to the same destination is forwarded along a fixed path; (2) Per-flow load balancing based on flow identifiers: The hash is calculated based on the five flow identifiers to determine the forwarding interface of the traffic; (3) Per-packet load balancing: Each packet selects its own path (relatively rare).

[0005] Existing research indicates that most carrier networks employ a per-flow load balancing mechanism. In this scenario, even minor changes to fields such as the forged source address and ICMP checksum can alter the hash result, thereby changing the probe path. If ingress routers on different paths deploy inconsistent SAV policies, inconsistent results may occur in different rounds of measurements of the same target node.

[0006] Therefore, a new measurement framework is needed that can directly manipulate flow identifiers and attribute inconsistencies based on measured filtering behavior attribution to "whether inconsistency is caused by multipath forwarding" in order to systematically identify multipath inconsistent SAV strategies. Summary of the Invention

[0007] This invention provides a method and apparatus for measuring inconsistencies in incoming source address verification filtering, in order to solve the problem that traditional methods cannot determine whether the observed filtering inconsistencies are due to real policy differences within the network or to the load balancing of probe packets to different entry paths.

[0008] A first aspect of the present invention provides a method for measuring inconsistencies in incoming source address verification filtering, comprising the following steps: All flow identifiers in the ICMP unreachable message are fixed to perform multiple rounds of ICMP unreachable message measurement for each measurable target to obtain the first measurement result; The preset flow identifier in the ICMP unreachable message is changed to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result; Based on the first measurement result and the second measurement result, determine whether load balancing causes instability in the incoming source address verification measurement.

[0009] Optionally, the format of each flow identifier includes a network layer field and / or a transport layer field, wherein, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined according to the type of transport layer protocol carried, specifically, When the transport layer protocol is TCP or UDP, the transport layer field includes the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include an ICMP type field, an ICMP code field, an ICMP identifier field, and / or an ICMP checksum field.

[0010] Optionally, the step of changing the preset flow identifier in the ICMP unreachable message to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result includes: Select a preset number of source addresses from the ICMP unreachable message; The preset number of source addresses are expanded with the corresponding / 29 prefix to obtain forged source addresses; Based on the forged source address, multiple rounds of ICMP unreachable message measurement are performed on each measurable target to obtain the second measurement result.

[0011] Optionally, determining whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result and the first measurement result includes: Calculate the first percentage value that remains completely consistent in the first measurement result and the second percentage value that remains completely consistent in the second measurement result, respectively; A consistency comparison is performed between the first percentage value and the second percentage value. If the first percentage value and the second percentage value are inconsistent, it is determined that the load balancing has caused instability in the incoming source address verification measurement.

[0012] A second aspect of the present invention provides a measuring device for measuring inconsistencies in incoming source address verification filtering, comprising: The comparison measurement module is used to fix all flow identifiers in the ICMP unreachable message message to perform multiple rounds of ICMP unreachable message measurement for each measurable target and obtain the first measurement result; The experimental measurement module is used to change the preset flow identifier in the ICMP unreachable message to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result; The determination module is used to determine whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result and the second measurement result.

[0013] Optionally, the format of each flow identifier includes a network layer field and / or a transport layer field, wherein, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined according to the type of transport layer protocol carried, specifically, When the transport layer protocol is TCP or UDP, the transport layer field includes the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include an ICMP type field, an ICMP code field, an ICMP identifier field, and / or an ICMP checksum field.

[0014] Optionally, the experimental measurement module includes: The selection unit is used to select a preset number of source addresses from the ICMP unreachable message; An extension unit is used to extend the preset number of source addresses to the corresponding / 29 prefix to obtain a forged source address; The measurement unit is configured to perform multiple rounds of ICMP unreachable message measurement on each measurable target based on the forged source address to obtain the second measurement result.

[0015] Optionally, the determining module includes: The calculation unit is used to calculate the first proportion value that is completely consistent in the first measurement result and the second proportion value that is completely consistent in the second measurement result, respectively. The comparison unit is used to compare the consistency between the first percentage value and the second percentage value. If the first percentage value and the second percentage value are inconsistent, it is determined that the load balancing has caused instability in the incoming source address verification measurement.

[0016] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for measuring inconsistencies in incoming source address verification filtering as described in the above embodiments.

[0017] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for measuring inconsistencies in incoming source address verification filtering.

[0018] The method and apparatus for measuring inconsistency in incoming source address verification filtering proposed in this invention actively manipulates the flow identifier, designs a control group and an experimental group, and performs matching measurements on the same target to determine whether the filtering result is sensitive to changes in the flow identifier. In turn, it detects whether probe packets trigger different SAV filtering strategies on different paths, thereby realizing the identification, quantification and interpretation of multi-path inconsistent SAV behavior in complex network environments.

[0019] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A diagram illustrating how load balancing causes packets with the same spoofed source address to enter the target network via different ingress routers; Figure 2 A flowchart illustrating a method for measuring inconsistencies in incoming source address verification filtering, provided in an embodiment of the present invention; Figure 3 The diagram shows the experimental results of the flow identifier control provided in the embodiment of the present invention, where (a) is the distribution of the SAV score of the control group, and (b) is the consistency of the experimental group (containing only stable control samples). Figure 4A block diagram of a measurement device for verifying inconsistencies in incoming source address filtering provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0021] Explanation of reference numerals in the attached figures: 40-Measurement device for verifying inconsistency of incoming source address filtering, 401-Control measurement module, 402-Experimental measurement module and 403-Determination module, 501-Memory, 502-Processor, 503-Communication interface. Detailed Implementation

[0022] Embodiments of the present invention are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0023] The following description, with reference to the accompanying drawings, describes a method and apparatus for measuring inconsistencies in incoming source address verification filtering according to embodiments of the present invention.

[0024] Figure 2 This is a flowchart illustrating a method for measuring inconsistencies in incoming source address verification filtering, provided in an embodiment of the present invention.

[0025] like Figure 2 As shown, the method for measuring inconsistencies in the incoming source address verification filter includes the following steps: In step S201, all flow identifiers in the ICMP unreachable message are fixed to perform multiple rounds of ICMP unreachable message measurement for each measurable target to obtain the first measurement result.

[0026] In some embodiments, the format of each flow identifier includes network layer fields and / or transport layer fields, wherein, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined based on the type of transport layer protocol being carried; specifically, When the transport layer protocol is TCP or UDP, the transport layer fields include the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include the ICMP type field, the ICMP code field, the ICMP identifier field, and / or the ICMP checksum field.

[0027] In actual execution, a measurement control group is constructed. Specifically, all flow identifiers in the ICMP unreachable message are kept unchanged to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain the first measurement result, which is a set including multiple true and multiple false values.

[0028] It should be noted that the flow identifier is the default setting for routers. The default flow identifiers vary between different manufacturers, but the default setting typically includes both network layer and transport layer fields. Network administrators may also modify this setting, adding or deleting fields as flow identifiers. In addition to the default source and destination IP addresses, some router manufacturers also include the protocol field as the flow identifier.

[0029] In step S202, the preset flow identifier in the ICMP unreachable message is changed to perform multiple rounds of ICMP unreachable message measurement for each measurable target to obtain a second measurement result.

[0030] In some embodiments, a preset flow identifier in the ICMP unreachable message is changed to perform multiple rounds of ICMP unreachable message measurement for each measurable target, resulting in a second measurement result, including: Select a preset number of source addresses in the ICMP unreachable message; The preset number of source addresses are expanded with the corresponding / 29 prefix to obtain forged source addresses; Based on the forged source address, multiple rounds of ICMP unreachable message measurement are performed on each measurable target to obtain a second measurement result.

[0031] In actual implementation, a measurement experiment group is constructed. Specifically, 20 source addresses can be selected as the basis in ICMP unreachable message packets. Each source address is expanded to the corresponding / 29 prefix (a total of 8 available addresses. The expansion to the / 29 prefix is ​​based on the assumption of previous load balancing work: it is difficult for inconsistent policies to appear at the same / 29 prefix level in the routing table). Based on the forged source address, a total of 20 × 8 = 160 rounds of ICMP unreachable message measurement are performed for each measurable target. In each round, only the source address is changed, so that the load balancing hash result changes. This may trigger the load balancing mechanism to cause the forged source address packet to pass through the path of different filtering policies, and obtain the second measurement result. The first measurement result is a set including multiple true and multiple false values.

[0032] It should be noted that, considering the versatility of the measurement scheme, this embodiment of the invention only changes the source address in the ICMP unreachable message and keeps the ICMP checksums other than the source address and the fields that affect the load balancing hash calculation unchanged in all flow identifiers. However, those skilled in the art can also change the ICMP checksums other than the source address and the fields that affect the load balancing hash calculation in the ICMP unreachable message according to the actual situation.

[0033] In step S203, it is determined whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result and the second measurement result.

[0034] In some embodiments, determining whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result includes: Calculate the first proportion value that remains completely consistent in the first measurement result and the second proportion value that remains completely consistent in the second measurement result; A consistency comparison is performed between the first and second percentage values. If the first and second percentage values ​​are inconsistent, it is determined that the load balancing has caused instability in the incoming source address verification measurement.

[0035] In actual execution, a first proportion value that remains completely consistent is calculated based on the number of true and false values ​​in the first measurement result. Then, based on the first proportion value, it can be determined whether there are stable samples. If there are, there are no other factors that cause the SAV measurement results to be unstable, which is thought to be caused by per-packet load balancing, but this has not been verified.

[0036] Furthermore, in the absence of load balancing, the results of spoofed source addresses obtained by expanding from one source address to the corresponding / 29 prefix should theoretically be completely consistent. However, the measurement results obtained from different source addresses may be inconsistent. Therefore, in this embodiment of the invention, the number of true and false values ​​for each source address in the second measurement result is calculated to ensure that the result is completely consistent, and a weighted average is taken for each result that is completely consistent as the second proportion value.

[0037] Furthermore, it is determined whether there are inconsistencies in the filtering results of these stable samples in the second proportion value. If there are inconsistencies, it is determined that the instability of the incoming source address verification measurement is caused by load balancing; otherwise, it is not caused by load balancing.

[0038] In other words, we first examine the results of the control group (i.e., the first percentage value). The SAV measurement result is either true or false, and the most direct calculation method is true / (true + false). If the control group results are consistent (greater than 0.9 or less than 0.1), it indicates that the SAV measurement result is stable when the flow identifier is consistent, meaning there are no other factors causing the SAV measurement result to be unstable. It is thought that this might be due to per-packet load balancing, but this has not been verified. If the control group results are consistent, then we examine the results of the experimental group. If the experimental group results differ significantly from the control group results, it can be concluded that the measurement result instability is caused by per-flow load balancing.

[0039] The following detailed description of the measurement method for inconsistency in incoming source address verification filtering proposed in the present invention is illustrated by a specific embodiment.

[0040] This embodiment performed a complete flow identifier control experiment on 4,282,603 ​​measurable targets, covering a total of 250,747 prefixes. The experimental results show that this embodiment can clearly distinguish between filtering inconsistencies caused by load balancing and differences in real network policies, demonstrating significant verification effectiveness.

[0041] As shown in Figure 3, in the control group (with a fixed flow identifier), approximately 68.3% of the measurement results remained completely consistent, indicating that path and filtering behavior were relatively stable without perturbing the flow identifier. For these stable samples, in the experimental group with perturbed flow identifiers, over 87% of the target nodes exhibited inconsistent filtering results in at least 40% of the rounds, demonstrating that simply changing the flow identifier can trigger path drift and cause significant changes in ISAV measurement results. This phenomenon clearly indicates that load balancing is one of the key factors causing ISAV measurement instability.

[0042] For the remaining 31.7% of unstable samples in the control group, this embodiment of the invention speculates that the reasons may include per-packet load balancing or differences in strategies within the target AS itself. Even so, the behavior of this portion of samples can still be further distinguished and explained through the control experiments of this embodiment of the invention.

[0043] In summary, the measurement method for inconsistency in incoming source address verification filtering proposed in the embodiments of the present invention has the following beneficial effects: (1) It can directly verify whether load balancing leads to inconsistency in ISAV filtering results: By comparing the control group and the experimental group, this method can determine the impact of path drift on SAV measurement without additional topology analysis, thus realizing the interpretability of filtering instability; (2) Effectively distinguish between path factors and actual strategy differences: When the control group is stable and the experimental group is unstable, it can be confirmed that the inconsistency comes from load balancing; when the control group itself is unstable, it indicates internal strategy differences or per-packet load balancing, making the measurement results more diagnostic. (3) The experimental parameters are controllable and the structure is simple, making it suitable for large-scale deployment: This invention relies only on the controllable perturbation of the convection identifier and does not rely on external topology information, achieving high scalability and high reproducibility in large-scale Internet measurements; (4) It has good versatility and portability: This technology is not only applicable to ICMP Unreachable measurement, but can also be extended to TCP, UDP or IPv6 environments, providing a basic capability for future SAV deployment assessment and network operation risk analysis.

[0044] Next, referring to the accompanying drawings, a measurement device for verifying inconsistencies in the incoming source address filtering according to an embodiment of the present invention is described.

[0045] Figure 4 This is a block diagram of a measurement device for verifying inconsistencies in incoming source address filtering, provided in an embodiment of the present invention.

[0046] like Figure 4 As shown, the measurement device 40 for verifying inconsistency of incoming source address filtering includes: a control measurement module 401, an experimental measurement module 402, and a determination module 403.

[0047] The control measurement module 401 is used to fix all flow identifiers in the ICMP unreachable message packet to perform multiple rounds of ICMP unreachable message measurement on each measurable target, obtaining a first measurement result. The experimental measurement module 402 is used to change the preset flow identifiers in the ICMP unreachable message packet to perform multiple rounds of ICMP unreachable message measurement on each measurable target, obtaining a second measurement result. The determination module 403 is used to determine whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result and the first measurement result.

[0048] In some embodiments, the format of each flow identifier includes network layer fields and / or transport layer fields, wherein, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined based on the type of transport layer protocol being carried; specifically, When the transport layer protocol is TCP or UDP, the transport layer fields include the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include the ICMP type field, the ICMP code field, the ICMP identifier field, and / or the ICMP checksum field.

[0049] In some embodiments, the experimental measurement module 402 includes: The selection unit is used to select a preset number of source addresses from ICMP unreachable message packets; An extension unit is used to extend a preset number of source addresses to the corresponding / 29 prefix in order to obtain a forged source address; The measurement unit is used to perform multiple rounds of ICMP unreachable message measurement on each measurable target based on a forged source address to obtain a second measurement result.

[0050] In some embodiments, the determining module 403 includes: The calculation unit is used to calculate the first proportion value that is completely consistent in the first measurement result and the second proportion value that is completely consistent in the second measurement result, respectively. The comparison unit is used to compare the consistency between the first proportion value and the second proportion value. If the first proportion value and the second proportion value are inconsistent, it is determined that the load balancing caused instability in the incoming source address verification measurement.

[0051] It should be noted that the explanation of the aforementioned embodiment of the measurement method for inconsistency of incoming source address verification filtering also applies to the measurement device for inconsistency of incoming source address verification filtering in this embodiment, and will not be repeated here.

[0052] The measurement device for verifying inconsistencies in incoming source address filtering according to embodiments of the present invention has the following beneficial effects: (1) It can directly verify whether load balancing leads to inconsistency in ISAV filtering results: By comparing the control group and the experimental group, this method can determine the impact of path drift on SAV measurement without additional topology analysis, thus realizing the interpretability of filtering instability; (2) Effectively distinguish between path factors and actual strategy differences: When the control group is stable and the experimental group is unstable, it can be confirmed that the inconsistency comes from load balancing; when the control group itself is unstable, it indicates internal strategy differences or per-packet load balancing, making the measurement results more diagnostic. (3) The experimental parameters are controllable and the structure is simple, making it suitable for large-scale deployment: This invention relies only on the controllable perturbation of the convection identifier and does not rely on external topology information, achieving high scalability and high reproducibility in large-scale Internet measurements; (4) It has good versatility and portability: This technology is not only applicable to ICMP Unreachable measurement, but can also be extended to TCP, UDP or IPv6 environments, providing a basic capability for future SAV deployment assessment and network operation risk analysis.

[0053] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0054] The electronic device may include: a memory 501, a processor 502, and a computer program stored on the memory 501 and capable of running on the processor 502.

[0055] When the processor 502 executes the program, it implements the measurement method for inconsistency of incoming source address verification filtering provided in the above embodiments.

[0056] Furthermore, electronic devices also include: Communication interface 503 is used for communication between memory 501 and processor 502.

[0057] The memory 501 is used to store computer programs that can run on the processor 502.

[0058] Memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0059] If the memory 501, processor 502, and communication interface 503 are implemented independently, then the communication interface 503, memory 501, and processor 502 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0060] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.

[0061] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0062] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described method for measuring inconsistencies in incoming source address verification filtering.

[0063] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0064] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0065] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0066] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0067] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0068] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0069] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0070] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for measuring inconsistencies in incoming source address verification filtering, characterized in that, Includes the following steps: All flow identifiers in the ICMP unreachable message are fixed to perform multiple rounds of ICMP unreachable message measurement for each measurable target to obtain the first measurement result; The preset flow identifier in the ICMP unreachable message is changed to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result; Based on the first measurement result and the second measurement result, determine whether load balancing causes instability in the incoming source address verification measurement.

2. The method for measuring inconsistency in incoming source address verification filtering according to claim 1, characterized in that, Each flow identifier is formatted including network layer fields and / or transport layer fields, where, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined according to the type of transport layer protocol carried, specifically, When the transport layer protocol is TCP or UDP, the transport layer field includes the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include an ICMP type field, an ICMP code field, an ICMP identifier field, and / or an ICMP checksum field.

3. The method for measuring inconsistency in incoming source address verification filtering according to claim 1, characterized in that, The step of changing the preset flow identifier in the ICMP unreachable message to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result includes: Select a preset number of source addresses from the ICMP unreachable message; The preset number of source addresses are expanded with the corresponding / 29 prefix to obtain forged source addresses; Based on the forged source address, multiple rounds of ICMP unreachable message measurement are performed on each measurable target to obtain the second measurement result.

4. The method for measuring inconsistency in incoming source address verification filtering according to claim 1, characterized in that, The step of determining whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result includes: Calculate the first percentage value that remains completely consistent in the first measurement result and the second percentage value that remains completely consistent in the second measurement result, respectively; A consistency comparison is performed between the first percentage value and the second percentage value. If the first percentage value and the second percentage value are inconsistent, it is determined that the load balancing has caused instability in the incoming source address verification measurement.

5. A measuring device for verifying inconsistencies in incoming source address filtering, characterized in that, include: The comparison measurement module is used to fix all flow identifiers in the ICMP unreachable message message to perform multiple rounds of ICMP unreachable message measurement for each measurable target and obtain the first measurement result; The experimental measurement module is used to change the preset flow identifier in the ICMP unreachable message to perform multiple rounds of ICMP unreachable message measurement on each measurable target to obtain a second measurement result; The determination module is used to determine whether load balancing causes instability in the incoming source address verification measurement based on the first measurement result and the second measurement result.

6. The measuring device for verifying inconsistency of incoming source address filtering according to claim 5, characterized in that, Each flow identifier is formatted including network layer fields and / or transport layer fields, where, The network layer fields include the source IP address and the destination IP address; The transport layer field is determined according to the type of transport layer protocol carried, specifically, When the transport layer protocol is TCP or UDP, the transport layer field includes the source port number and the destination port number; When the transport layer protocol is ICMP, the transport layer fields include an ICMP type field, an ICMP code field, an ICMP identifier field, and / or an ICMP checksum field.

7. The measuring device for verifying inconsistency of incoming source address filtering according to claim 5, characterized in that, The experimental measurement module includes: The selection unit is used to select a preset number of source addresses from the ICMP unreachable message; An extension unit is used to extend the preset number of source addresses to the corresponding / 29 prefix to obtain a forged source address; The measurement unit is configured to perform multiple rounds of ICMP unreachable message measurement on each measurable target based on the forged source address to obtain the second measurement result.

8. The measuring device for verifying inconsistency of incoming source address filtering according to claim 5, characterized in that, The determining module includes: The calculation unit is used to calculate the first proportion value that is completely consistent in the first measurement result and the second proportion value that is completely consistent in the second measurement result, respectively. The comparison unit is used to compare the consistency between the first percentage value and the second percentage value. If the first percentage value and the second percentage value are inconsistent, it is determined that the load balancing has caused instability in the incoming source address verification measurement.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method for measuring inconsistencies in incoming source address verification filtering as described in any one of claims 1-4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the method for measuring inconsistencies in incoming source address verification filtering as described in any one of claims 1-4.

Images