Pre-populating MAC Address Tables in Flooding-Blocked Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networks where MAC address flooding is blocked, existing solutions for pre-populating Media Access Control (MAC) address tables are either costly, insecure, or require extensive maintenance, especially when Customer Premises Equipment (CPE)/Network Interface Device (NID) has multiple MAC addresses, as they rely on manual configuration, IP capabilities, or centralized orchestrators.
Innovation Solution
The method involves sending periodic 'no-operation' packets with the source MAC address using standard Ethernet broadcast/multicast protocols, such as ARP probes or LLDP frames, to automatically populate the Network Termination Equipment (NTE) forwarding databases, ensuring MAC address reachability without unicast flooding, thus reducing maintenance and security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unicast flooding is enabled to populate MAC address tables automatically, then MAC address reachability is improved, but network security is worsened due to unauthorized MAC address propagation
Solution Approach 1:
The patent applies preliminary action by pre-configuring MAC address table entries with a limited set of authorized MAC addresses before normal operation begins. This allows the network to immediately recognize and forward traffic to known devices without needing to flood unknown unicast frames, thereby maintaining security while ensuring reachability for pre-authorized devices.
Solution Approach 2:
The patent uses a simplified, static MAC address table configuration that requires minimal maintenance compared to dynamic flooding mechanisms. Instead of continuously flooding and learning MAC addresses, the system uses a fixed, pre-configured table that is inexpensive to maintain and replace if needed, trading dynamic adaptability for security and operational simplicity.
2Reliability
If static MAC entries are manually configured to resolve forwarding issues, then MAC address reachability is improved, but maintenance complexity and operational expenses are worsened
Solution Approach 1:
The patent implements self-service by automatically populating the MAC address table through pre-configuration during device onboarding or initial network setup. Once configured, the system maintains itself without requiring manual intervention for routine MAC address management, eliminating the need for operators to continuously update static entries while ensuring proper forwarding behavior.
3Object-affected harmful factors
If access lists and anti-spoofing functionality are implemented to improve network security, then network security is improved, but capital expense and operational expense are worsened
Solution Approach 1:
The patent extracts the essential security function from complex access list and anti-spoofing systems by implementing a simplified MAC address filtering mechanism. Instead of deploying expensive, feature-rich security appliances with comprehensive access control lists, the solution uses a focused MAC address table configuration that provides the necessary security functionality without the overhead of maintaining complex security policies and associated hardware costs.
Data Source
AI summary
Systems and methods include, in a node having a plurality of Media Access Control (MAC) addresses with a source MAC address for an application and with the node connected to Network Termination Equipment (NTE) having flooding disabled, configuring the node to periodically send a packet to the NTE with the source MAC address for the application to pre-populate a forwarding database in the NTE; and transmitting the packet to the NTE periodically such that the NTE receives the packet and installs the source MAC address in its forwarding database for reachability thereto despite the disabled flooding. The plurality of Media Access Control (MAC) addresses can include a chassis MAC address and the source MAC address for the application. The packet can be a no-operation packet which requires no processing by the NTE except installation of the source MAC address for the application.