ARP Packet Filter for Storm Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
During an ARP storm, network devices face issues where they receive more ARP packets than they can process, leading to discarded packets and subsequent removal of entries from the ARP table, resulting in unnecessary IP traffic drops and potential network outages.
Innovation Solution
Implementing a device that determines IP traffic monitoring criteria, updates an ARP packet filter based on active IP traffic flows, and uses IP keepalive messages to maintain ARP table entries during storms, ensuring continuous communication with devices having active IP flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the device processes all received ARP packets during an ARP storm, then the ARP table remains updated, but the device becomes overwhelmed and discards packets leading to network outages
Solution Approach 1:
The device performs preliminary actions by establishing IP traffic flow tables and ARP packet filters before the ARP storm occurs. These pre-established structures enable the device to quickly identify legitimate traffic patterns and filter out storm packets without needing to process each ARP packet during the storm, thus maintaining reliability while preserving processing capacity.
Solution Approach 2:
The patent introduces an intermediary mechanism - the ARP packet filter - that acts as a mediator between incoming ARP packets and the ARP table. This filter selectively permits legitimate ARP packets while blocking storm packets, allowing the device to maintain ARP table updates without being overwhelmed by excessive packets, thus resolving the contradiction between reliability and processing capacity.
2Productivity
If the device filters ARP packets to maintain processing capacity, then packet discard rate decreases, but ARP table entries may expire causing IP traffic drops
Solution Approach 1:
The device implements feedback mechanisms by continuously monitoring IP traffic flows and using this information to dynamically update the ARP packet filter. This feedback loop ensures that legitimate traffic patterns are learned and preserved in the filter, allowing the device to maintain processing capacity while preventing false positives that would cause ARP table entry expiration and network connectivity issues.
Solution Approach 2:
The device performs preliminary action by establishing IP traffic flow tables that capture legitimate communication patterns before the ARP storm occurs. These pre-established flow tables serve as a reference for the ARP packet filter to distinguish legitimate ARP packets from storm packets, ensuring that filtering does not cause legitimate entries to expire and maintain network reliability.
3Measurement precision
If the device monitors IP traffic to update ARP filters, then filtering accuracy improves, but device complexity increases
Solution Approach 1:
The device achieves universality by making the IP traffic flow table and ARP packet filter serve multiple functions simultaneously. The same data structures are used for both traffic monitoring and ARP packet filtering decisions, eliminating the need for separate complex systems. This multi-functionality improves filtering accuracy while avoiding the complexity increase that would result from implementing entirely separate monitoring and filtering mechanisms.
Data Source
AI summary
A device may determine internet protocol (IP) traffic monitoring criteria and may monitor IP traffic based on the IP traffic monitoring criteria. The device may update, based on monitoring the IP traffic, a table of currently active IP traffic flows and may update, based on the table of currently active IP traffic flows, an address resolution protocol (ARP) packet filter. The device may receive one or more ARP packets from a different device and may determine whether to accept or discard the one or more ARP packets based on the ARP packet filter. The device may update an ARP table based on determining to accept the one or more ARP packets.