Network Switch Port Segmentation for DHCP Traffic Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing number of devices in data networks leads to unnecessary consumption of network resources and security risks due to broadcast DHCP messages, as they are sent to all devices on the network, including uninterested entities, and can be intercepted by rogue servers.

Innovation Solution

The implementation of tools that identify trusted ports and prevent data packets from egressing non-trusted ports by classifying ports as trusted based on configuration communications and marking reply ports as trusted, thereby forwarding only necessary DHCP messages to trusted servers and withholding them from uninterested entities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If broadcast DHCP messages are sent to all devices on the network, then DHCP clients can obtain network addresses, but network resources are needlessly consumed and security risks increase

Engineering Contradiction:

ImproveDHCP address assignment reliabilityVSAvoidnetwork resource consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The network is segmented into trusted and non-trusted port groups. DHCP messages are selectively forwarded only to trusted ports that lead to legitimate DHCP servers, rather than broadcasting to all ports. This segmentation reduces unnecessary network resource consumption while maintaining reliable address assignment for authorized devices.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different quality of service is applied to different network segments. Trusted ports receive full DHCP broadcast traffic, while non-trusted ports have DHCP traffic filtered or limited. This local differentiation ensures reliable DHCP functionality where needed while conserving network resources in areas where it is not required.

Inventive Principle:

Principle #3Local quality

2Reliability

If broadcast DHCP messages are sent to all devices on the network, then DHCP clients can obtain network addresses, but rogue servers can intercept and misuse requests

Engineering Contradiction:

ImproveDHCP address assignment reliabilityVSAvoidsecurity risks from rogue servers

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The network switch acts as an intermediary that filters and controls DHCP message forwarding. It identifies trusted ports through configuration communications and reply messages, then selectively forwards DHCP broadcasts only to these trusted ports. This intermediary function prevents rogue servers on non-trusted ports from intercepting DHCP requests while maintaining reliable address assignment.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Loss of energy

If a limit is placed on the number of broadcast messages, then network bandwidth consumption is reduced, but legitimate DHCP messages are unintentionally discarded

Engineering Contradiction:

Improvenetwork bandwidth consumptionVSAvoidDHCP message delivery reliability

Core Design Contradiction:

Loss of energyVSReliability

Solution Approach 1:

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

Inventive Principle:

Principle #1Segmentation

4Adaptability or versatility

If DHCP messages are broadcast to all ports, then all devices can receive address assignments, but uninterested entities consume network resources

Engineering Contradiction:

Improvenetwork device connectivityVSAvoidnetwork resource consumption

Core Design Contradiction:

Adaptability or versatilityVSLoss of energy

Solution Approach 1:

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS7869394B1Limiting data packet forwarding to trusted ports

Publication Date: 2011.01.11 WORLD WIDE PACKETS INC

AI summary

This document describes tools that forward data packets to trusted ports and prevent data packets from egressing non-trusted ports. To do so, the tools receive a data packet having a destination address specifying that the data packet be forwarded to a set of ports associated with a domain. The tools identify a subset of the set of ports as trusted ports and forward the data packet to the subset. The tools prevent the data packet from egressing non-trusted ports of the set. In one embodiment, the tools may classify a port as trusted. To do so, the tools receive a configuration communication identifying trusted devices. The tools broadcast a request to the trusted devices and receive a reply from a reply device on a reply port. The tools determine that the reply device is one of the trusted devices and mark the reply port as a trusted port.