Network device and its access control method

Abstract

The present invention provides a network equipment and its access control methods. Said network equipment comprises an address resolution protocol (ARP) data frame filter module which is used for searching for access control list on the basis of identification information in the address resolution protocol data frames received by the network equipment, and filtrating the address resolution protocol data frames according to the corresponding states of the identification information in the access control list. Said network equipment comprises further an address resolution protocol (ARP) data frame inspection module which is used for inspecting the validity and correctness of the address resolution protocol data frames before the address resolution protocol data frame filter module filtrates the address resolution protocol data frames; and an address resolution protocol (ARP) data frame treatment module which is used for dealing with the address resolution protocol data frames permited by the address resolution protocol (ARP) data frame filter module. The present invention is capable of preventing an illegal equipment attacking viciously network equipments through address resolution protocol data frames, with improved security and reliability.

Description

technical field [0001] The invention relates to the communication field, in particular to a network device and an access control method thereof. Background technique [0002] Access Control List (ACCESS CONTROL LIST, referred to as ACL) uses packet filtering technology to read the information in the third layer and fourth layer packet header on the network device, such as source address, destination address, source port, destination port, etc. , according to the pre-defined rules to filter the data packets, so as to achieve the purpose of access control. In the early days, only routers supported this technology. In recent years, Layer 3 switches can also support this technology. At present, some Layer 2 switches (including access devices) also begin to provide support for access control lists. [0003] There are many types of access control lists, and different types of access control lists can be applied in different occasions. Among them, the simplest is the standard acc...

AI Technical Summary

Problems solved by technology

On the other hand, if network device B maliciously sends ARP request frames, network device A must process them one by one, which will greatly reduce the processing ability of network device A to process other packets and other functions, and even cause network failure in serious cases. The abnormal operation of equipment A causes more serious consequences

[0006] Since the usual access control list function only filters IP data packets, it does not filter ARP data frames encapsulated in Ethernet data frames, which may reduce the processing capacity of network devices, and even cause malicious attacks on network devices possibility of

Images