IPv6 Packet Forwarding With Hop-Limit Multicast Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPv6 packet forwarding systems are vulnerable to attacks that generate numerous ICMPv6 error packets when the hop limit field is set to 1 or 0, leading to wastage of network bandwidth and security breaches.
Innovation Solution
Implement a network device that checks the hop limit field of IPv6 packets and avoids forwarding multicast packets when the value is less than or equal to a preset threshold, thereby reducing the generation of ICMPv6 error packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network device forwards IPv6 packets with hop limit value less than or equal to 1, then the packet forwarding function is maintained, but a large quantity of ICMPv6 error packets are generated causing network bandwidth waste and security issues
Solution Approach 1:
The network device performs preliminary judgment on the hop limit field value before forwarding the IPv6 packet. When the hop limit value is less than or equal to the threshold (greater than or equal to 2), the device determines that the packet should not be forwarded and does not generate ICMPv6 error packets, thus preventing bandwidth waste and security issues before they occur
Solution Approach 2:
The invention changes the threshold parameter for hop limit judgment from the conventional value of 1 to a value greater than or equal to 2. This parameter change enables the device to identify and block potentially malicious packets with hop limit values of 0 or 1, preventing the generation of unnecessary ICMPv6 error packets while maintaining normal packet forwarding
2Reliability
If the network device checks the hop limit field and avoids forwarding when value is less than or equal to threshold, then security is improved and ICMPv6 error packets are reduced, but the device complexity increases
Solution Approach 1:
The invention applies a localized quality check only to the hop limit field of IPv6 packets, rather than performing comprehensive packet analysis. This focused approach on a specific field (hop limit) with a simple threshold comparison maintains low device complexity while effectively improving security by blocking packets with suspicious hop limit values
3Loss of energy
If the preset threshold is set to a value greater than or equal to 2, then the generation of ICMPv6 error packets is reduced, but normal packet forwarding with hop limit 1 or 0 may be affected
Solution Approach 1:
The invention converts the potentially harmful practice of forwarding packets with hop limit values of 0 or 1 (which generates malicious ICMPv6 error packets) into a beneficial security measure. By setting the threshold to greater than or equal to 2, the device identifies and blocks these abnormal packets, transforming what would have been a security vulnerability into an active security feature that protects the network
Data Source
AI summary
An IPv6 packet sending method, a device, and a system is provided. The method includes a first network device receives a first IPv6 packet, where the first IPv6 packet includes a packet header and an inner packet, and the packet header includes a hop limit field. The network device further determines whether a value of the hop limit field is less than or equal to a preset threshold, determines whether the inner packet is a multicast packet, and avoids forwarding the first IPv6 packet when the value of the hop limit field is less than or equal to the preset threshold and the inner packet is the multicast packet.