Layer 2 Switch Port Blocking for MAC Flooding Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting layer 2 switches against MAC flooding attacks primarily focus on safeguarding the access node, leaving subsequent network nodes and users vulnerable as packets identified as dangerous can still reach further into the network.
Innovation Solution
Implementing an interface between the network user and access point that blocks a port for a configurable blocking time when the maximum MAC address limit is reached, preventing further packet transmission and thus safeguarding the entire network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a limited number of MAC addresses are allowed per switch port, then the switch is protected from MAC flooding attacks, but legitimate traffic may be blocked and network connectivity is reduced
Solution Approach 1:
The patent implements dynamic port blocking that automatically activates when MAC address limit is reached and deactivates after a predetermined blocking time expires. This dynamic mechanism allows the system to adapt between protective mode (when attack is detected) and normal operational mode (after blocking time), resolving the contradiction between continuous protection and maintained connectivity.
Solution Approach 2:
The patent introduces a periodic blocking mechanism where ports are blocked for a predetermined blocking time after reaching the MAC address limit. This periodic action allows the system to repeatedly protect against flooding attacks while periodically restoring normal traffic flow, balancing security with productivity.
2Reliability
If the port is blocked for a predetermined blocking time, then network security is enhanced, but traffic interruption occurs during the blocking period
Solution Approach 1:
The patent implements preliminary blocking action that activates automatically when the MAC address limit is reached, before the attacker can flood the network further. By acting preemptively at the threshold, the system prevents additional harmful traffic while limiting the blocking duration to only the necessary predetermined time, minimizing traffic interruption.
3Reliability
If MAC address learning is disabled, then protection against MAC flooding is improved, but the switch cannot perform normal packet forwarding based on learned MAC addresses
Solution Approach 1:
The patent segments the MAC address table into per-port limits, allowing different behavior for different ports. When a port reaches its MAC address limit, only that specific port is blocked while other ports continue to learn and forward packets normally. This segmentation preserves overall network functionality while providing targeted protection.
Solution Approach 2:
The system dynamically enables or disables MAC address learning on a per-port basis. When the limit is reached, learning is disabled for that port to prevent flooding, but remains enabled for other ports. After the blocking time expires, learning is re-enabled. This dynamic control maintains packet forwarding functionality while providing protection when needed.
Data Source
AI summary
A method for protecting a network against a security attack from an user, and in particular, for a layer 2 switch, against a MAC flooding attack. Here, the MAC flooding attack floods the layer 2 switch with at least one packet, a database is provided which saves a MAC address and its allocation and the database has a maximum quantity. According to the method, an interface between the user of the network and a network access functions as a line of demarcation. When the limit of the maximum quantity for a port is reached, the port is blocked during a blocking time. This not only protects the first access node, but also the following network nodes and users respectively, against a security attack.