Access Device VRRP Packet Snooping and Forwarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The network security and service continuity are compromised when a user receives a VRRP packet, leading to potential unauthorized priority modifications and service interruptions.
Innovation Solution
An access device processes multicast packets by identifying protocol types and forwarding VRRP packets only through a snooping port list, preventing broadcast to all users and potential priority modifications, while updating forwarding lists to ensure accurate routing and prevent service disruptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the access device forwards VRRP packets to all users via multicast, then the VRRP packet can be received by users for priority modification, but the network security is compromised and service continuity is affected
Solution Approach 1:
The patent segments the packet forwarding process by distinguishing between VRRP packets and other packets. It creates a separate handling mechanism for VRRP packets that prevents them from being broadcast to all users, while allowing other packet types to continue being forwarded normally. This segmentation resolves the contradiction by selectively limiting VRRP packet distribution to maintain security while preserving overall system functionality.
Solution Approach 2:
The access device acts as an intermediary between the network side and users. It intercepts VRRP packets before they reach users and processes them through a controlled mechanism (snooping port list) that prevents unauthorized priority modifications. This intermediary role allows the system to maintain security while still enabling legitimate VRRP operations between network devices.
2Ease of operation
If the access device broadcasts VRRP packets to all users, then users can receive and modify packet priorities, but bandwidth is wasted and service interruptions occur
Solution Approach 1:
The patent extracts VRRP packets from the general multicast broadcast process. Instead of broadcasting all multicast packets to all users, it separates VRRP packets and handles them through a specific mechanism (snooping port list) that limits distribution to only those ports needing VRRP information. This extraction eliminates unnecessary bandwidth consumption while preserving the ability for authorized priority modifications.
3Reliability
If the access device uses a snooping port list for VRRP packets, then network security is enhanced, but the device complexity increases
Solution Approach 1:
The access device performs preliminary actions by pre-establishing a snooping port list that identifies which ports should receive VRRP packets. This preconfiguration allows the device to automatically filter and forward VRRP packets to the correct ports without requiring complex real-time analysis or user-side modifications. The preliminary setup simplifies the overall processing while maintaining security.
Data Source
Figure 1~2
Figure 3~4
AI summary
Embodiments of the present invention relate to a packet processing method, an access device, and a communication system. The method includes: receiving, by an access device, a multicast packet from a network side via a first network port of the access device; identifying, by the access device, a protocol type of the multicast packet; if identifying that the multicast packet is a virtual router redundancy protocol packet, sending the virtual router redundancy protocol packet via a second network port of the access device to the network side according to a snooping port list used for forwarding the virtual router redundancy protocol packet; and if identifying that the multicast packet is a non-virtual router redundancy protocol packet, sending the non-virtual router redundancy protocol packet via a user port of the access device to a user side. In the embodiments of the present invention, it can be prevented that the access device broadcasts the VRRP packet to all users, so as to save the network bandwidth; and it can also be prevented that the VRRP packet is snooped by a user and is constructed into a VRRP packet with a higher priority to attack a router, so as to enhance the network security and ensure the normal service running.