WO2008131650A1 - Dhcp snooping method and device thereof - Google Patents

Abstract

A DHCP snooping method is disclosed, which can transmit the DHCP message for triggering the users to reinitiate the first address application to the users, and makes the users initiate the first address application after receiving the DHCPNAK message when the received users message can not hit the DHCP binding list due to the abnormal loss of the DHCP binding list. With the solution, the DHCP binding list can be rebuilt without being aware of the users, therefore realizing accessing network as usual. A DHCP snooping device is also disclosed.

Description

 DHCP monitoring method and device thereof

 The present invention relates to the field of communication network technologies, and in particular, to a DHCP listening method and device thereof. Background technique

 With the expansion of the network scale and the increase of network complexity, the Dynamic Host Configuration Protocol (DHCP) has been widely used. However, DHCP encounters many security problems in the application process. To solve these problems, the current common method is to enable DHCP Snooping on the access device's network device, such as the gateway switch.

 DHCP snooping establishes a DHCP binding table by listening to DHCP messages. The DHCP binding table entries include: Internet Protocol (IP) address, Media Access Control (MAC) address, inbound port number, and Virtual LAN (VLAN) number. When forwarding a packet, the DHCP binding table is used to check the address resolution protocol (ARP) packet and the IP packet to solve the above-mentioned spoofing attack security problem. The schematic diagram of the basic scheme is shown in Figure 1. The MAC address and IP address of User B are: B, 10.1.1.2; The MAC address and IP address of User C are: C, 10.1.1.3; MAC address and IP of network device A The address is: A, 10.1.1.1. If DHCP snooping is enabled on the gateway switch of the access user, the normal user, such as user B or other users who may have attack behavior, such as user C, must first apply for DHCP first address. The gateway switch listens to user B and user C. The DHCP binding table shown in Table 1 below is established by analyzing all DHCP messages in the application process by analyzing the monitored DHCP messages.

 Table 1

When the attacker initiates a spoofing attack, for example, the user C initiates a gratuitous ARP packet to the user B. The IP address of the gateway is 10.1.1.1. The MAC address of the gateway is C. The gateway switch detects the ARP packet. The information carried in the ARP packet is used to find the DHCP binding table, where the ARP packet is sent. The information carried in the file includes the source MAC address, the source IP address (or the IP address declared in the ARP payload), and the ingress port information. In this example, the gateway switch is based on the MAC address and the IP address is 10.1.1.1. If the inbound port number is E2 and the VLAN ID is 3, look for the DHCP binding table and find that it cannot hit the DHCP binding table. (The MAC address is C in the DHCP binding table, the IP address is 10.1.1.1, and the inbound port number is E2, the entry with the VLAN number is 3. The gateway switch discards the ARP packet. Therefore, the spoofed ARP packet cannot reach any other user including user B, thereby suppressing user C's attack behavior.

 For normal users, such as user B, there is no problem in using the network, because all the messages sent by them will follow the information when the DHCP address is applied, that is, the MAC address is B and the source IP address is 10丄1.2. Under normal circumstances, the DHCP binding table will be correctly hit at the gateway switch to access the external network normally. After the DHCP snooping scheme is used, the user can access the Internet after the user successfully requests the IP address through DHCP. It depends on whether the user packet can hit a DHCP binding table of the gateway switch (that is, it can be extracted from the user packet). The related information is the same as the one in the DHCP binding table on the gateway switch. If no DHCP binding table entry matches the related information extracted in the user packet, the user packet will be lost. abandoned.

 According to the normal situation, as long as the user can still use this address (for example, the applied address is within the lease period), the corresponding DHCP binding table should exist on the gateway switch, but the DHCP binding table or some of the entries are It may be abnormally lost, such as:

 1. Because a gateway needs to access a large number of users, and the space for storing the DHCP binding table is limited, it is necessary to age the DHCP binding table that has not been hit for a long time (to invalidate the DHCP binding table), or The DHCP binding table of the new user cannot be created normally due to insufficient space;

 2. The DHCP snooping-enabled network device is restarted. The original DHCP binding table loses some entries during the save recovery process.

 3. The DHCP snooping-enabled network device may also lose the DHCP binding table due to its internal communication.

 4. After the DHCP snooping function is enabled on the network device, the user who has obtained the address through DHCP before the device is enabled will have no corresponding DHCP binding table on the network device. In this case, the user can also be understood as the DHCP binding table of the user. Abnormally lost.

Once a DHCP binding table or some of its entries are lost, the corresponding user will not be able to pass the network. The switch sends any packet, and can only wait for the address that has been applied for by DHCP to expire or manually release the address, and then initiate the DHCP address application again. After successfully applying for the address, the user can access the Internet.

 As shown in Figure 1, if the DHCP binding table for user B is lost for some reason, the packet of user B does not have a corresponding DHCP binding table on the gateway switch, causing the gateway switch to look for DHCP binding. If the table fails, all the packets sent by user B except the DHCP first address request message are discarded. At this time, if User B needs to continue to access the Internet, there are only two ways:

 1. Manually trigger the NIC to re-apply the DHCP first address request, that is, release the existing address first, and then apply for the first address. Through the first address application, user B regains the new address and establishes a corresponding DHCP binding table on the gateway switch.

 2. Wait until the current application address expires and then go online. At this time, the DHCP client software will detect the event because the address expires, and then automatically apply for the first address. Through the first address application, user B regains the new address and establishes a corresponding binding table on the gateway switch.

 Both of the above prior art methods cause the user to interrupt the Internet for a long time and lose the message. Summary of the invention

 The technical problem to be solved by the present invention is to provide a DHCP listening method and device. When the DHCP binding table is abnormally lost, the Internet access function is quickly restored when the user barely perceives.

 In order to solve the above technical problem, the present invention provides a DHCP snooping method, including: receiving a user packet and determining whether it hits the first DHCP binding table, and when the determining result is that the user packet misses the first A DHCP binding table is sent to the user to trigger the user to re-initiate the DHCP request for the first address request.

 Correspondingly, the present invention provides a DHCP listening device, which is configured to listen to user messages received by a network device, and includes:

 a binding table storage unit, configured to store a DHCP binding table;

 a hitting determining unit, configured to search the DHCP binding table according to the information in the user packet, and determine whether the user packet hits the first DHCP binding table;

 The anti-confirmation unit is configured to: when the judgment result of the hit determination unit is that the user packet misses the first DHCP binding table, send a DHCP to the user to trigger the user to re-initiate the first address request Message.

The implementation of the present invention has the following beneficial effects: The DHCP snooping method and the device thereof may be configured to send a DHCPNAK packet to the user after the received user packet fails to hit the DHCP binding table, so that the user initiates the first address after receiving the DHCPNAK packet. Apply, and then re-establish the DHCP binding table, and continue to access the Internet if the user does not know. DRAWINGS

 1 is a schematic diagram of application of a DHCP snooping method in the prior art;

 2 is a schematic flowchart of Embodiment 1 of a DHCP snooping method according to the present invention;

 3 is a schematic flowchart of Embodiment 3 of a DHCP listening method in the present invention;

 4 is a schematic flow chart of an embodiment of S3003 in FIG. 3;

 5 is a schematic diagram of the functional module of the first embodiment of the DHCP listening device of the present invention; FIG. 6 is a schematic diagram of the functional module of the second embodiment of the DHCP monitoring device of the present invention; FIG. 7 is a schematic diagram of the third embodiment of the DHCP monitoring device of the present invention. Schematic diagram of module composition. detailed description

 The present invention will be further described in detail with reference to the accompanying drawings.

 FIG. 2 shows a flow of Embodiment 1 of the DHCP snooping method of the present invention, and the embodiment includes the following steps:

S2001: Receive a user packet and determine whether it hits the DHCP binding table. If the determination result is yes, the user packet is forwarded according to the prior art; otherwise, S2002 is performed;

S2002: Send a DHCP message to the user to trigger the user to re-initiate the first address request, where the DHCP message may be a DHCPNAK message, but is not limited thereto. In this embodiment, when the user packet cannot hit the DHCP binding table, the packet is not directly discarded as in the prior art. For example, as shown in Figure 1, the access device (the network switch in the figure) receives the packet from user B. Because the DHCP snooping function is enabled on the ingress port, the DHCP snooping unit of the access device receives the user packet. Extract the information such as the source MAC address and the source IP address, and add the inbound port information (that is, the port number) and the VLAN number to find the DHCP binding table on the access device. If no corresponding DHCP binding table is found, If the DHCP binding table of user B is abnormally lost, or the corresponding entry in the DHCP binding table is not found, the access device does not directly discard the user packet. The user message is redirected to the DHCP snooping unit, and the DHCP snooping unit sends a DHCPNAK message to the user B. The DHCPNAK message is used to enable the access device to notify the user B that the IP address is unavailable. The first address request is re-initiated, and then the access device discards the user packet that misses the DHCP binding table. Then, after receiving the DHCPNAK packet, the user B will automatically re-initiate the first-time address request according to the DHCP protocol. The DHCP snooping unit re-establishes the corresponding user by listening to the DHCP message exchanged during the first-time address application. B's DHCP binding table, user B can go online as usual after successfully applying for an address. The entire process does not require manual operation by the user. The DHCP binding table can be re-established without the user's perception, and the user can quickly access the Internet as usual. The gateway switch mentioned here and below is only a special case, and the access device may include all network devices that support DHCP snooping. The present invention further provides another embodiment of the DHCP snooping method, and the embodiment (Embodiment 2) is different from the previous embodiment in that the method further includes the following steps: from the miss DHCP binding table In the user packet, the inbound port information, the VLAN information, the source MAC address, and the source IP address are extracted to create a DHCP blacklist binding table. The reason why it is called the DHCP blacklist binding table is because the user packet is only an attack packet sent by the hacker. The DHCP binding table corresponding to the hacker is not lost. In this case, in order to facilitate tracking the attack behavior of the hacker, a corresponding DHCP blacklist binding table. The DHCP binding table entry of the prior art includes four fields: a MAC address, an IP address, a port number, and a VLAN number, as shown in Table 1. In this embodiment, in order to better implement the DHCP blacklist binding table, two fields are added to the DHCP binding table (described below in the first DHCP binding table) in the first embodiment: Binding table type The field and hit frequency fields form a new DHCP binding table (described below in the second DHCP binding table). The second binding table is shown in Table 2 below. The binding table type field (the BLK field in the following Table 2) is used to identify whether the second DHCP binding table entry is the first DHCP binding table entry, or the DHCP blacklist binding table table mentioned in the present invention. The entry (the BLK field is true to indicate that the second DHCP binding table entry is a DHCP blacklist binding table entry); the hit frequency field (the RATE field in Table 2 below) is used when the second DHCP binding table entry is When the DHCP blacklist binding table entry is recorded, the frequency information of the DHCP blacklist binding table entry being hit by the user 4 is recorded. (Of course, the frequency of the first DHCP binding table entry being hit by the user packet may also be recorded. information).

MAC address IP address into port number VLAN number BLK RATE B 10.1.1.2 E2 1 YES 1/s

C 10.1.1.3 E2 3 NO 100/s Table 2 After forming the second DHCP binding table, another embodiment (ie, the third embodiment) of the DHCP listening method of the present invention is obtained, and the flowchart thereof is as shown in FIG. Show, including the following steps:

S3001: After forming the second DHCP binding table, receiving a subsequent user packet and determining whether it hits the second DHCP binding table. If the determination result is yes, executing S3002, otherwise, following the DHCP server to the The user sends a DHCPNAK packet.

 S3002: Determine whether the second DHCP binding table entry of the subsequent user packet is the DHCP blacklist binding table entry. If the determination result is yes, go to step S3003. Otherwise, forward the device according to the prior art. Subsequent user messages;

S3003: Process the subsequent user message according to a predetermined configuration policy. Specifically, when the received subsequent user message cannot hit the second DHCP binding table, in the embodiment, as in the embodiment, the DHCP server sends a DHCPNAK message to the user, triggering the user to re-initiate. The first address is applied, and the corresponding DHCP binding table is re-established. When the received subsequent user packet hits the second DHCP binding table, the subsequent user message is not directly used in the prior art as in the first embodiment. And forwarding, according to the binding table type field in the second DHCP binding table, further determining whether the second DHCP binding table entry that the subsequent user packet hits is a DHCP blacklist binding table entry. If the first DHCP binding table entry is hit, it indicates that the user packet is not a spoofing attack packet, and is forwarded according to the prior art; if the hit is the DHCP blacklist binding table provided by the present invention. The entry indicates that the subsequent user packet may be an attack packet, and the subsequent user packet may be processed according to the predetermined configuration policy, including the record that the corresponding entry of the DHCP blacklist binding table is hit by the user packet. The frequency information, that is, how many times it was hit within a predetermined time period (the predetermined time period can be configured according to actual conditions). The device can process the user packet according to the type of the entry in the DHCP binding table that is hit by the user packet, and enhance the device's ability to identify the attack packet. As an implementation manner, the predetermined configuration policy may be: if the rate at which the user sends the user packet exceeds a preset rate limit value, the packet is discarded; if not, the user is discarded. Send a DHCPNAK packet. The rate of the user packet can be calculated by the frequency information recorded in the hit frequency field of the DHCP blacklist binding table entry. For example, the recorded frequency information is the corresponding entry of the DHCP blacklist binding table. If the internal user packet is hit 4 times, the frequency information recorded in the hit frequency field of the corresponding DHCP blacklist binding table entry is 0.03/s, and the corresponding user packet transmission rate can be obtained (that is, the user report The sending frequency of the text, according to the RATE field expression in the second HDCP table, the sending rate value of the user packet may be taken as 0.03/s.

 Corresponding to the foregoing configuration policy, a flowchart of an implementation manner of S3003 is as shown in FIG. 4, and includes the following steps:

S4001: Record, according to the hit situation of the subsequent user packet, the frequency information that the corresponding entry of the DHCP blacklist binding table is hit by the user packet;

 S4002: Calculate a sending rate of the user packet according to the frequency information, and compare a size relationship between the sending rate and a preset rate limiting value. If the sending rate is greater than the rate limiting value, discard the Describe the subsequent user message, otherwise, execute S4003;

 S4003: Sending a DHCPNAK packet to the user according to the DHCP server;

 Through the above configuration policy, a denial of service attack by a malicious user can be effectively prevented.

 Correspondingly, the present invention further provides an embodiment of a DHCP listening device, and a schematic diagram of a functional module of the DHCP listening device embodiment 1 is shown in FIG. 5. The DHCP monitoring device is configured to listen to user packets received by the network device, and includes a binding table storage unit 4, a hit determination unit 8, and an anti-confirmation unit 1.

 The binding table storage unit 4 is configured to store a DHCP binding table.

 The hit determination unit 8 is configured to search the DHCP binding table stored in the binding table storage unit according to the information in the user packet received by the network device, and determine whether the user packet hits the DHCP binding table, and When the judgment result is yes, the network device is instructed to forward the user message.

The anti-confirmation unit 1 is configured to send, to the user, a DHCP message for triggering the user to re-initiate the first-time address application when the result of the determination by the hit determination unit is that the user message misses the DHCP binding table. When the received user packet cannot hit the DHCP binding table (for example, if the corresponding DHCP binding table is lost), the anti-confirmation unit 1 may send a DHCPNAK message to the user according to the DHCP server, and notify the user of the IP address. The address is no longer available. Please re-initiate the first-time address request. After receiving the DHCPNAK message, the user initiates the first-time address request. The DHCP listening device listens to the DHCP message sent in the first-time address application process and re-establishes the corresponding DHCP binding. table. User application After the address is successful, you can go online as usual.

 In this embodiment, when the DHCP binding table is lost, the DHCP binding table can be automatically re-established without the user being aware of, so that the user can access the Internet as usual.

 The schematic diagram of the function module of the second embodiment of the DHCP monitoring device of the present invention is as shown in FIG. 6. The difference from the first embodiment is that the blacklist binding table unit 2 is further included, and the judgment result of the hit determination unit 8 is When the user packet does not match the DHCP binding table of the first embodiment (described below in the first DHCP binding table), that is, when the received user packet cannot hit the first DHCP binding table, the user is extracted. Create a DHCP blacklist binding table for the inbound port information of the packet and its source MAC address and source IP address. The reason for the DHCP blacklist binding table is that the user packet is only an attack packet sent by the hacker. The DHCP binding table corresponding to the hacker is not lost. In this case, the blacklist binding is used to facilitate tracking of the hacker's attack behavior. Table 2 establishes the corresponding DHCP blacklist binding table. To implement the DHCP blacklist binding table, two fields are added to the DHCP binding table in the first embodiment (described below in the first DHCP binding table): a binding table type field and a hit frequency field. A new DHCP binding table is formed (described below in the second DHCP binding table), and the second binding table is as shown in Table 2 above. The binding table type field (the BLK field in Table 2 above) is used to identify whether the second DHCP binding table entry is the first DHCP binding table entry, or the DHCP blacklist binding table table mentioned in the present invention. item

(The BLK field is true to indicate that the second DHCP binding table entry is a DHCP blacklist binding table entry); the hit frequency field (the RATE field in Table 2 above) is used when the second DHCP binding table entry is DHCP. When the blacklist is bound to a table entry, the frequency information of the DHCP packet blacklist binding table entry being hit by the user packet is recorded (of course, the frequency information of the first DHCP binding table entry being hit by the user packet may also be recorded) .

 In this embodiment, in addition to the same functions as those in the first embodiment, the behavior information of the attacker can be effectively tracked according to the recorded frequency information and the like, so that the network management can perform analysis.

 On the basis of the second embodiment, the DHCP snooping device can be further improved to fully utilize the function of the blacklist binding table unit 2. FIG. 7 is a schematic diagram showing the structure of a function of the improved DHCP listening device, that is, the function module of the third embodiment. In addition to all the functional units of the second embodiment, the method further includes a type determining unit 5, a first processing unit 6, and a second Processing unit 7.

The type judging unit 5 is configured to: when the judgment result of the hit judging unit 8 is that the subsequent user packet received by the network device hits the second DHCP binding table, that is, when the received subsequent user packet hits When the second DHCP binding table is described, the binding table type field is read, and it is determined whether the second DHCP binding table entry that the subsequent user packet hits is a DHCP blacklist binding table entry. First processing order The element 6 receives the determination result of the type judging unit 5, and when the judgment result of the type judging unit 5 is that the second DHCP binding table entry that the subsequent user packet hits is a DHCP blacklist binding table entry, And processing the subsequent user message according to a predetermined configuration policy. The second processing unit 7 receives the determination result of the type judging unit 5, and the second DHCP binding table entry hit by the subsequent user is not the DHCP blacklist binding table when the type judging unit 5 determines. When the entry is triggered, the network device is triggered to forward the user packet according to the prior art.

 As an embodiment, the first processing unit 6 further includes a recording unit 61, a rate calculating unit 62, and a comparing unit 63. The recording unit 61 is configured to record frequency information that the DHCP blacklist binding table corresponding entry is hit according to the hit situation of the subsequent user message. The rate calculation unit 62 is configured to calculate a transmission rate of the user packet according to the frequency information recorded by the recording unit 61. For example, the recorded frequency information is the user of the DHCP blacklist binding table corresponding to the entry within 2 minutes. When the packet is hit 4 times, the corresponding user packet transmission rate is 0.03/s. The comparing unit 63 is configured to trigger the de-acknowledgment unit 1 to send a DHCP message to the user to trigger the user to re-initiate the first-time address request, otherwise the network device is triggered. The subsequent user message is discarded.

 With this embodiment, the behavior information of the attacker can be tracked, and the attack recognition capability of the device can be enhanced, thereby effectively preventing the denial of service attack by the malicious user.

 The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and the equivalent changes made by the claims of the present invention are still within the scope of the present invention.

Claims

Rights request A DHCP snooping method, comprising:  Receiving a user packet and determining whether it hits the first DHCP binding table,  When the result of the determination is that the user packet misses the first DHCP binding table, the DHCP message sent by the user to trigger the user to re-initiate the first address request is sent to the user. The DHCP snooping method according to claim 1, wherein the method further comprises: extracting the user report when the judgment result is that the user packet misses the first DHCP binding table A DHCP blacklist binding table is created, and the second DHCP binding is performed, including the DHCP blacklist binding table entry and the first DHCP binding table entry, and the source MAC address and the source IP address information. Set the table. The DHCP snooping method according to claim 2, wherein the second DHCP binding table includes first indication information indicating whether the corresponding entry is a DHCP blacklist binding table entry, If the result of the determination is that the user packet does not match the DHCP binding table, the inbound port information of the user packet, the source MAC address, and the source IP address information are extracted, and a DHCP blacklist binding table is created, and the The DHCP blacklist binding table entry and the second DHCP binding table of the first DHCP binding table entry further include:  Receiving a subsequent user message and determining whether it hits the second DHCP binding table. If the determination result is yes, performing the next step. Otherwise, sending a DHCP message to the user to trigger the user to re-initiate the first address application. Text  Determining, according to the first indication information, whether the second DHCP binding table entry of the subsequent user packet is the DHCP blacklist binding table entry, and if the determination result is yes, performing the next step, otherwise Forwarding the subsequent user 4 text;  The subsequent user message is processed according to a predetermined configuration policy. The DHCP snooping method according to claim 3, wherein the second DHCP binding table includes second indication information indicating a frequency at which the corresponding entry is hit by the user packet, the predetermined configuration policy. Processing the subsequent user message includes: Recording frequency information that the DHCP blacklist binding table corresponding entry is hit according to the hit situation of the subsequent user packet;  Obtaining, according to the frequency information, a sending rate of the corresponding user packet, and comparing a relationship between a sending rate of the user packet and a preset rate limiting value, if the sending rate of the user packet is greater than If the rate limit value is used, the subsequent user message is discarded, otherwise, the next step is performed;  Sending a DHCP message to the user for triggering the user to re-initiate the first address request. The DHCP snooping method according to any one of claims 1 to 4, wherein the DHCP message is a DHCP NAK message sent by the DHCP server to the user. A DHCP listening device, configured to listen to user packets received by a network device, and is characterized by:  a binding table storage unit, configured to store a DHCP binding table;  a hitting determining unit, configured to search the DHCP binding table according to the information in the user packet, and determine whether the user packet hits the first DHCP binding table;  The anti-confirmation unit is configured to: when the judgment result of the hit determination unit is that the user packet misses the first DHCP binding table, send a DHCP to the user to trigger the user to re-initiate the first address request 4 艮文. The DHCP monitoring device according to claim 6, wherein the DHCP monitoring device further comprises:  a blacklist binding table creating unit, configured to: when the result of the determination by the hitting determining unit is that the user packet misses the first DHCP binding table, extract the ingress port information of the packet and the source MAC address thereof And creating a DHCP blacklist binding table by using the source IP address information, and triggering forming, by using the DHCP blacklist binding table entry and the first DHCP binding table entry, the first stored in the binding table storage unit. Two DHCP binding tables. The DHCP snooping device according to claim 7, wherein the second DHCP binding table includes first indication information indicating whether the corresponding entry is a DHCP blacklist binding table entry, and the DHCP snooping The device also includes: a type judging unit, configured to: when the judgment result of the hit judging unit is that the subsequent user packet received by the network device hits the second DHCP binding table, determine, according to the first indication information, the subsequent user report Whether the second DHCP binding table entry of the file is the DHCP blacklist binding table entry;  a first processing unit, configured to: when the second DHCP binding table entry of the type of the determining unit is that the second DHCP binding table entry of the subsequent user packet is the DHCP blacklist binding table entry, according to the predetermined configuration The policy processes the subsequent user message;  a second processing unit, configured to trigger the network when the second DHCP binding table entry of the subsequent user packet is not the DHCP blacklist binding table entry The device forwards the user packet. The DHCP snooping device according to claim 8, wherein the second DHCP binding table includes second indication information indicating a frequency at which the corresponding entry is hit by the user packet, and the first processing unit includes Have:  The recording unit records the frequency information that the corresponding entry of the DHCP blacklist binding table is hit according to the hit situation of the subsequent user packet;  a user message sending frequency obtaining unit, configured to obtain a corresponding sending rate of the user message according to the recorded frequency information; and, when the sending rate of the user packet is less than the speed limit value, triggering The anti-acknowledgment unit sends a DHCP message to the user to trigger the user to re-initiate the first-time address request, otherwise the network device is triggered to discard the subsequent user message. The DHCP snooping device according to any one of claims 6 to 9, wherein the DHCP message is a DHCP NAK message sent by the DHCP server to the user.