Method, device and system for preventing DHCP (Dynamic Host Configuration Protocol) attacks in flat network

Abstract

The invention discloses a method, a device and a system for preventing DHCP (Dynamic Host Configuration Protocol) attacks in a flat network. The method comprises the following steps: setting an interface ID, a Supervlan ID and a corresponding user limit value in DHCP snooping; receiving a discover message sent by a client through the DHCP snooping, and judging whether the client is online or not; if the client is not online, determining the corresponding user limit value according to the interface ID and the Supervlan ID in the discover message; judging whether a quantity of current online users exceeds the user limit value or not; if so, not forwarding the discover message; and otherwise, adding the quantity of the current online users with 1, and forwarding the discover message. Through adoption of the method, the device and the system, address exhausting caused by the DHCP attacks can be prevented; the network security is enhanced; and the availability and user experience of a whole scheme are improved.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, device and system for preventing DHCP attacks in a flat network. Background technique [0002] VLAN is the abbreviation of Virtual Local Area Network (Virtual Local Area Network), which is a logical network divided on a physical network, and the effect is the same as that of a normal local area network. The unicast, broadcast and multicast frames of the second layer are forwarded and diffused in a VLAN, and will not directly enter other VLANs. Therefore, if a host connected to a port wants to communicate with other hosts not in the same VLAN, it must pass through a layer-3 device. [0003] Supervlan, that is, super vlan, also called vlan aggregation, is defined in RFC (RequestForComments, request for comment document) 3069. Its principle is to assign the IP of a network segment to different subVLANs (SubVLAN), and these SubVLANs belong to the same SuperVLAN. Ea...

AI Technical Summary

Problems solved by technology

[0006] Through Supervlan, vlan isolation, DHCPserver and DHCPSnooping, a flat network can be established, but in this network, users may perform DHCP attacks to exhaust the address pool; for example, most of the current campus networks use flat network extensions, and Configure a large address pool for the Supervlan. At this time, if the user conducts a DHCP attack, all available addresses under the Supervlan will inevitably be exhausted, resulting in no address available for users in the remaining sub-vlans under the Supervlan.

Images