WO2017054526A1 - Arp entry generation method and device - Google Patents

Abstract

Provided are an address resolution protocol (ARP) entry generation method and device. The method comprises: acquiring a dynamic host configuration protocol request (DHCP REQUEST) message, and parsing a media access control (MAC) address of a client and an Internet protocol (IP) address requested by the client for allocation which are carried in the DHCP REQUEST message, wherein the DHCP REQUEST message is sent by the client to a dynamic host configuration protocol (DHCP) server; judging whether to receive a first dynamic host configuration protocol acknowledgement (DHCP ACK) message of the DHCP server responsive to the DHCP REQUEST message; and when it is determined that the first DHCP ACK message is received, writing the MAC address and the IP address requested by the client for allocation into an ARP table entry as ARP entries.

Description

Method and device for generating ARP entry Technical field

The present application relates to, but is not limited to, the field of communications, and in particular, to an address resolution protocol ARP entry generation method and apparatus.

Background technique

The Dynamic Host Configuration Protocol (DHCP) is a network configuration protocol that is optimized and extended based on the Bootstrap Protocol (BOOTP). With the development of the network and the expansion of the network, the network complexity is getting higher and higher, and the network configuration is more and more complicated. The network device generally uses the DHCP protocol to allocate the host address.

DHCP snooping (DHCP snooping) is a DHCP security feature that filters untrusted DHCP information by establishing and maintaining a DHCP snooping binding table. This information refers to DHCP information from untrusted areas. The DHCP snooping binding table contains the Media Access Control (MAC) address, the Internet Protocol (IP) address, the lease period, and the virtual local area network identity (Virtual Local Area Network). -Identity, abbreviated as VLAN-ID) interface and other information.

The Address Resolution Protocol (ARP) is a Transmission Control Protocol/Internet Protocol (TCP/IP) that acquires a physical address based on an IP address. When the host sends the information, it broadcasts the ARP request containing the target IP address to all hosts on the network, and receives the return message to determine the physical address of the target. After receiving the return message, the IP address and physical address are stored in the local ARP. The cache keeps a certain amount of time, and the next time the request is made, the ARP cache is directly queried to save resources.

The inventor of the present application found in the research process that the address resolution protocol is based on mutual trust of each host in the network, and the host on the network can independently send an ARP reply message, and other hosts will not receive the response message. Detecting the authenticity of the message will record it in the local ARP cache; thus the attacker can send a pseudo ARP reply message to a host, so that the information sent cannot reach the expected host or reach the wrong host. This constitutes an ARP spoof. A Layer 3 gateway also has ARP entries. After the host obtains an IP address, the host learns ARP through ARP. In the case of the ARP entry, the ARP entry in the network may be overwritten by the ARP entry. The ARP entry on the Layer 3 gateway device may be overwritten. , resulting in a host of abnormal Internet access, reduced call quality and other quality of service defects and security risks.

In view of the low reliability of ARP entries in the related art, no effective solution has been proposed yet.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides a method and a device for generating an ARP entry, which solves the problem that the reliability of the ARP entry in the related art is low.

According to an aspect of the present invention, a method for generating an ARP entry is provided, including: obtaining a dynamic host configuration protocol requesting a DHCP REQUEST message, and parsing a MAC address of the client carried in the DHCP REQUEST message and the client request The assigned IP address, wherein the DHCP REQUEST message is sent by the client to the DHCP server; determining whether the first DHCP ACK message of the DHCP server responding to the DHCP REQUEST message is received; When the first DHCP ACK packet is received, the MAC address and the IP address assigned by the client request are written into the ARP entry as an ARP entry.

Optionally, the method further includes: obtaining a dynamic host configuration protocol requesting a DHCP DISCOVER message in a broadcast form, and parsing the MAC address carried in the DHCP DISCOVER message, before acquiring the DHCP REQUEST message, The DHCP DISCOVER packet is sent by the client to the DHCP server, and one or more dynamic host configuration protocol IP addresses carrying the MAC address are used to supply a DHCP OFFER packet, and the one is parsed. Or one or more IP addresses carried in the multiple DHCP OFFER messages, where the one or more DHCP OFFER messages are sent by the DHCP server to the client.

Optionally, the method further includes: following the DHCP address lease after the MAC address and the IP address assigned by the client request are used as the ARP entry to be written into the ARP entry. Aging time, aging the ARP entry.

Optionally, the method further includes: after the MAC address and the IP address assigned by the client request are used as the ARP entry to be written into the ARP entry, obtaining a DHCP REQUEST carrying the MAC address. a renewal lease message, wherein the DHCP REQUEST renewal message is sent by the client to the DHCP server; and determining whether the DHCP server receives a second DHCP response to the DHCP REQUEST renewal message The ACK packet is updated, and the aging time of the ARP entry is updated when it is determined that the second DHCP ACK packet is received.

Optionally, the method further includes: after the MAC address and the IP address assigned by the client request are used as the ARP entry, the dynamic host that carries the MAC address is obtained. The configuration protocol releases the DHCP RELEASE message; the ARP entry is deleted.

Optionally, the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol.

Optionally, the method further includes: receiving an ARP learning report sent by the client after the MAC address and the IP address assigned by the client request are used as the ARP entry to be written into the ARP entry. Determining whether the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client request; determining the ARP learning The source MAC address and the source IP address carried in the packet are the same as the MAC address recorded in the ARP entry and the IP address allocated by the client, and the ARP response packet is sent to the client.

Optionally, the method further includes: after aging the ARP entry according to the aging time of the DHCP address lease, determining whether the ARP entry has aged; and determining that the ARP entry is aged, Checking whether the client is online; in the case that the client is checked to be online, the ARP entry is converted into a dynamic ARP entry; and when it is checked that the client is not online, the ARP entry is deleted.

An ARP entry generating apparatus includes: a first processing module, a first determining module, and a writing module.

The first processing module is configured to obtain a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address allocated by the client request Address, wherein the DHCP REQUEST message is sent by the client to a DHCP server.

The first determining module is configured to determine whether the first DHCP ACK message of the DHCP server in response to the DHCP REQUEST message is received.

Writing to the module, configured to: when the first determining module determines that the first DHCP ACK message is received, writing the MAC address and the IP address allocated by the client request to the ARP table as an ARP entry item.

Optionally, the first processing module is further configured to:

Before obtaining the DHCP REQUEST packet, the dynamic host configuration protocol in the broadcast form requests the DHCP DISCOVER packet, and parses the MAC address carried in the DHCP DISCOVER packet, where the DHCP DISCOVER packet is The client sends the message to the DHCP server.

Acquiring one or more dynamic host configuration protocol IP addresses carrying the MAC address to provide a DHCP OFFER message, and parsing one or more IP addresses carried in the one or more DHCP OFFER messages, where One or more DHCP OFFER messages are sent by the DHCP server to the client.

Optionally, the device further includes: an aging module.

An aging module, configured to: after the write module writes the MAC address and the IP address assigned by the client request to the ARP entry as the ARP entry, according to a DHCP address lease aging time, ARP entries are aged.

Optionally, the device further includes: a first obtaining module, a second determining module, and an updating module.

a first obtaining module, configured to acquire, after the writing module writes the MAC address and the IP address that is requested by the client as the ARP entry into the ARP entry, acquiring the MAC address A DHCP REQUEST renewal message, wherein the DHCP REQUEST renewal message is sent by the client to the DHCP server.

The second determining module is configured to determine whether the second DHCP ACK message of the DHCP server in response to the DHCP REQUEST renewal message is received.

And an update module, configured to update an aging time of the ARP entry if it is determined that the second DHCP ACK message is received.

Optionally, the device further includes: a second acquiring module.

a second obtaining module, configured to acquire, after the writing module writes the MAC address and the IP address that is requested by the client to the ARP entry as the ARP entry, to obtain the MAC address DHCP RELEASE message.

Delete the module and set to delete the ARP entry.

Optionally, the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol.

Optionally, the device further includes: a receiving module, a third determining module, and a sending module.

The receiving module is configured to receive the ARP learning report sent by the client after the writing module writes the MAC address and the IP address that the client requests to be the ARP entry to the ARP entry. Text.

The third determining module is configured to determine whether the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client request.

a sending module, configured to determine, by the third determining module, a source MAC address and a source IP address carried in the ARP learning packet, and the MAC address recorded in the ARP entry and the IP address allocated by the client request If the addresses are the same, an ARP response packet is sent to the client.

Optionally, the device further includes: a fourth determining module.

The fourth judging module is configured to determine whether the ARP entry has aged after the aging module ages the ARP entry according to the aging time of the DHCP address lease.

The checking module is configured to check whether the client is online if the fourth determining module determines that the ARP entry has aged.

a second processing module, configured to: when the check module checks that the client is online, convert the ARP entry into a dynamic ARP entry; if the check module detects that the client is offline , delete the ARP entry.

A computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the address resolution protocol ARP entry generation method.

The solution of the embodiment of the present invention is to obtain a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address requested by the client, where the DHCP REQUEST packet is sent by the client to the DHCP server. Determining whether the first DHCP ACK message of the DHCP server responding to the DHCP REQUEST message is received; if it is determined that the first DHCP ACK message is received, the MAC address and the IP address assigned by the client request are written as the ARP entry. The method of entering ARP entries solves the problem of low reliability of ARP entries in related technologies and improves the reliability of ARP entries.

BRIEF abstract

1 is a flowchart of a method for generating an ARP entry according to an embodiment of the present invention;

2 is a structural block diagram of an ARP entry generating apparatus according to an embodiment of the present invention;

3 is a block diagram 1 of a preferred structure of an ARP entry generating apparatus according to an embodiment of the present invention;

4 is a block diagram 2 of a preferred structure of an ARP entry generating apparatus according to an embodiment of the present invention;

FIG. 5 is a block diagram 3 of a preferred structure of an ARP entry generating apparatus according to an embodiment of the present invention; FIG.

6 is a block diagram 4 of a preferred structure of an ARP entry generating apparatus according to an embodiment of the present invention;

7 is a block diagram 5 of a preferred structure of an ARP entry generating apparatus according to an embodiment of the present invention;

FIG. 8 is a block diagram 1 of a networking structure according to an alternative embodiment of the present invention; FIG.

9 is a block diagram 2 of a networking structure according to an alternative embodiment of the present invention;

10 is a timing diagram of a method for generating an ARP entry in accordance with an alternative embodiment of the present invention;

11 is a flowchart of an ARP learning method according to an alternative embodiment of the present invention;

12 is a flow chart of an ARP entry aging method in accordance with an alternate embodiment of the present invention.

Embodiments of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

It should be noted that the terms "first", "second" and the like in the specification and claims of the embodiments of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. order.

In this embodiment, a method for generating an ARP entry is provided. FIG. 1 is a flowchart of a method for generating an ARP entry according to an embodiment of the present invention. As shown in FIG. 1, the process includes steps S101-S103:

Step S101: Acquire a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address that the client requests to allocate, where the DHCP REQUEST packet is sent by the client to the DHCP server.

Step S102: Determine whether the first DHCP ACK message of the DHCP server in response to the DHCP REQUEST message is received.

Step S103: In the case that it is determined that the first DHCP ACK message is received, the MAC address and the IP address assigned by the client request are written into the ARP entry as an ARP entry.

After the first DHCP ACK message is received, the client MAC address carried in the DHCP REQUEST packet and the IP address that has been confirmed to be assigned to the client are written into the ARP entry as the ARP entry. The ARP entry generated by the method only updates the ARP entry when the client requests the IP address allocation from the DHCP server. Therefore, there is no problem that the reliability of the ARP entry caused by learning ARP in the address resolution protocol is low. It can be seen that the above steps solve the problem that the reliability of the ARP entry in the related art is low, and the reliability of the ARP entry is improved.

Optionally, the ARP entry includes the VLAN and the interface information of the virtual local area network. The VLAN and the interface information are information about the VLAN and interface used by the client to send DHCP packets.

Optionally, the foregoing method may be applied to a Layer 3 gateway device, where the Layer 3 gateway may be a DHCP relay or a DHCP server.

Optionally, before the step S101, the MAC address of the client carried in the DHCP DISCOVER packet can be obtained. The DHCP server that receives the DHCP DISCOVER packet sends a DHCP OFFER packet to the client, so that the client can be obtained. One or more DHCP OFFER packet methods of the MAC address, and parsing one or more IP addresses carried in one or more DHCP OFFER packets.

Optionally, in order to ensure that the DHCP request messages that are received by the Layer 3 gateway device that carry the same MAC address are from the same interface or the VLAN, the access information consistency check may be performed after intercepting the DHCP request message; Reaching DHCP with the same MAC address If the access information is inconsistent, the ARP entry is not generated based on the intercepted two DHCP DISCOVER messages and the DHCP REQUEST message.

Optionally, the DHCP address lease and the ARP entry are controlled by the aging time. To make the DHCP address lease and the ARP entry aging process uniform and avoid conflicts, the ARP entry can be obtained according to the DHCP address lease aging time after the step S103. Perform aging.

Optionally, since the ARP entry can be aged according to the aging time of the DHCP address lease, the client can send a DHCP REQUEST renewal request to the DHCP server. Therefore, the second DHCP can be received by the DHCP server in response to the DHCP REQUEST renewal message. In the case of the ACK packet, the aging time of the ARP entry is updated according to the client's renewal request. For example, after the step S103, the DHCP REQUEST renewal message carrying the MAC address may be acquired, where the DHCP REQUEST renews the lease. The message is sent by the client to the DHCP server; it is determined whether the second DHCP ACK message of the DHCP server responding to the DHCP REQUEST renewal message is received; and the ARP entry is updated when it is determined that the second DHCP ACK message is received. Aging time.

Optionally, in the case that the client sends a DHCP RELEASE message to the DHCP server, the DHCP server may release the IP address assigned to the client. Therefore, the ARP entry corresponding to the MAC address of the client may be deleted, for example, in the foregoing steps. After S103, the DHCP RELEASE packet carrying the MAC address may also be obtained; and the ARP entry is deleted.

Optionally, the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol, wherein the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol, and the ARP entry cannot be represented as an ARP entry according to the address resolution protocol. The generated dynamic ARP entry is overwritten.

Optionally, after the step S103, the ARP learning packet sent by the client may be received, and the validity of the client is confirmed according to the MAC address and the IP address of the client, and the ARP response is sent to the client when the client is legal. The packet is not acknowledged if the client is not legal. For example, the ARP learning packet sent by the client can be received. The source MAC address and the source IP address carried in the ARP learning packet are recorded in the ARP entry. The MAC address is the same as the IP address assigned by the client request. The source MAC address and source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address assigned by the client request. Send an ARP response packet to the client.

Optionally, the ARP entry may be aged according to the aging time of the DHCP address lease, and the ARP entry may be aged. If the ARP entry is aged, the aging ARP entry may be processed according to whether the client is online. For example, after aging the ARP entry according to the aging time of the DHCP address lease, you can determine whether the ARP entry is aged. If the ARP entry is aged, check whether the client is online. Check the client online. In the case of ARP entries, the ARP entries are converted to dynamic ARP entries; in the case where the client is not online, the ARP entries are deleted.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium (such as ROM/RAM, disk). The optical disc includes a plurality of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method described in various embodiments of the present invention.

An ARP entry generating device is also provided in this embodiment, and the device is configured to implement the foregoing embodiments and optional embodiments, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes: a first processing module 21, a first judging module 22, and a writing module 23, wherein the first processing module 21: Set to obtain a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address assigned by the client request, where the DHCP REQUEST packet is sent by the client to the DHCP server; The module 22 is coupled to the first processing module 21 and configured to determine whether the first DHCP ACK message of the DHCP server is received in response to the DHCP REQUEST message. The writing module 23 is coupled to the first determining module 22 and configured to determine When the first DHCP ACK message is received, the MAC address is The IP address that the client requests to be assigned is the ARP entry to be written to the ARP entry.

Optionally, the device may further include: a third processing module, configured to obtain a DHCP DISCOVER message, and parse the MAC address carried in the DHCP DISCOVER message, where the DHCP DISCOVER message is sent by the client to the DHCP server; The fourth processing module is coupled to the third processing module and the first processing module 21, configured to acquire one or more DHCP OFFER messages carrying the MAC address, and parse the one or more DHCP OFFER messages. One or more IP addresses, where one or more DHCP OFFER messages are sent by the DHCP server to the client.

FIG. 3 is a block diagram of an optional structure of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 3, preferably, the apparatus further includes: an aging module 31 coupled to the writing module 23, configured to follow a DHCP address. Aging entries are aged and the ARP entries are aged.

FIG. 4 is a block diagram 2 of an optional structure of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus further includes: a first obtaining module 41, a second determining module 42, and an updating module 43. The first obtaining module 41 is coupled to the aging module 31 and configured to obtain a DHCP REQUEST renewal message carrying a MAC address, where the DHCP REQUEST renewal message is sent by the client to the DHCP server; The module 42 is coupled to the first obtaining module 41, and configured to determine whether the second DHCP ACK message of the DHCP server responding to the DHCP REQUEST renewal message is received. The updating module 43 is coupled to the second determining module 42 and configured to be When it is determined that the second DHCP ACK packet is received, the aging time of the ARP entry is updated.

FIG. 5 is a block diagram 3 of an optional structure of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 5, the apparatus further includes: a second obtaining module 51 and a deleting module 52, wherein the second acquiring module 51, coupled to the write module 23, configured to acquire a DHCP RELEASE message carrying a MAC address; the deletion module 52, coupled to the second acquisition module 51, configured to delete the ARP entry.

Optionally, the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol.

FIG. 6 is a block diagram of an optional structure of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 6, the apparatus further includes: a receiving module 61, a third determining module 62, and a sending module 63, where The receiving module 61 is coupled to the writing module 23 and configured to receive the ARP sent by the client. The third message determining module 62 is coupled to the receiving module 61 and configured to determine whether the source MAC address and the source IP address carried in the ARP learning packet are the MAC address recorded in the ARP entry and the IP address assigned by the client request. The sending module 63 is coupled to the third determining module 62, and is configured to determine that the source MAC address and the source IP address carried in the ARP learning packet are the same as the MAC address recorded in the ARP entry and the IP address assigned by the client request. In case, an ARP response packet is sent to the client.

FIG. 7 is a block diagram 5 of an optional structure of an ARP entry generating apparatus according to an embodiment of the present invention. As shown in FIG. 7, the apparatus further includes: a fourth determining module 71, an inspecting module 72, and a second processing module 73. The fourth determining module 71 is coupled to the aging module 31, configured to determine whether the ARP entry has aged; the checking module 72 is coupled to the fourth determining module 71, and configured to check if the ARP entry is aged. Whether the client is online; the second processing module 73, coupled to the checking module 72, is configured to convert the ARP entry to a dynamic ARP entry if the client is checked online; otherwise, delete the ARP entry.

It should be noted that each of the foregoing modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.

The embodiment of the invention further provides a software, which is arranged to perform the technical solutions described in the above embodiments and preferred embodiments.

Optionally, the storage medium is further arranged to store program code arranged to perform the following steps:

S100: Obtain a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address allocated by the client request, where the DHCP REQUEST packet is sent by the client to the DHCP server.

S200. Determine whether the first DHCP ACK message of the DHCP server in response to the DHCP REQUEST message is received.

S300: When it is determined that the first DHCP ACK packet is received, the MAC address and the IP address that the client requests to be assigned are used as ARP entries to be written into the ARP entry.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S110: Acquire a DHCP DISCOVER packet and parse the DHCP DISCOVER packet. The MAC address carried, where the DHCP DISCOVER packet is sent by the client to the DHCP server.

S120: Obtain one or more DHCP OFFER messages carrying a MAC address, and parse one or more IP addresses carried in one or more DHCP OFFER messages, where one or more DHCP OFFER messages are DHCP servers. Sent to the client.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

On the S700, the ARP entry is aged according to the aging time of the DHCP address lease.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S710: Obtain a DHCP REQUEST renewal message carrying a MAC address, where the DHCP REQUEST renewal message is sent by the client to the DHCP server.

S711, determining whether a second DHCP ACK message of the DHCP server responding to the DHCP REQUEST renewal message is received;

S712. Update the aging time of the ARP entry when it is determined that the second DHCP ACK packet is received.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S801. Obtain a DHCP RELEASE packet carrying a MAC address.

S802, deleting an ARP entry.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S610, the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S901. Receive an ARP learning packet sent by the client.

S902: Determine whether the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client request.

S903. If it is determined that the source MAC address and the source IP address carried in the ARP learning packet are the same as the MAC address recorded in the ARP entry and the IP address that is requested by the client, the ARP response packet is sent to the client.

A computer readable storage medium storing computer executable instructions, the computer being executable The address resolution protocol ARP entry generation method is implemented when the row instruction is executed by the processor.

Embodiments of the present invention also provide a storage medium. In this embodiment, the above storage medium may be configured to store program code for performing the following steps:

S741, determining whether the ARP entry has aged.

S742: If it is determined that the ARP entry has deteriorated, check whether the client is online.

S743, converting the ARP entry into a dynamic ARP entry when checking that the client is online; otherwise, deleting the ARP entry.

Optionally, in this embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a read-only memory (ROM), a random access memory (RAM), and a mobile device. A variety of media that can store program code, such as hard disks, disks, or optical disks.

In order to make the description of the embodiments of the present invention more clear, the following description and description are given in conjunction with the preferred embodiments.

An alternative embodiment of the present invention provides a method for generating an ARP entry on a Layer 3 gateway device. The device intercepts and intercepts DHCP packets, and extracts the IP and MAC information required for the ARP entry. When the host obtains an IP address, the Layer 3 The gateway device adds the ARP entry to the ARP entry. The ARP entry is aged according to the address assigned by the DHCP. The ARP entry aging time is updated. The priority of the ARP entry is greater than the dynamic ARP entry priority and cannot be overwritten by the dynamic ARP entry. Therefore, the legality of the ARP entry is ensured, the security is improved, and the burden of the device for dynamic host ARP learning is also reduced.

The optional embodiments of the present invention are described below with reference to the accompanying drawings.

FIG. 8 is a block diagram of a networking structure according to an alternative embodiment of the present invention. As shown in FIG. 8, the Layer 3 gateway may be a DHCP relay.

FIG. 9 is a block diagram 2 of a networking structure according to an alternative embodiment of the present invention. As shown in FIG. 9, a Layer 3 gateway may also be deployed on a same device as a DHCP server.

FIG. 10 is a timing diagram of a method for generating an ARP entry according to an alternative embodiment of the present invention. As shown in FIG. 10, the flow includes steps S1001-S1007:

In step S1001, the host (equivalent to the above client) provides DHCP to the DHCP protocol. The device sends a DHCP DISCOVER packet, and listens to or intercepts the DHCP DISCOVER packet on the Layer 3 gateway device to extract the legal access information and MAC information of the host.

Step S1002: The DHCP server receives the DHCP DISCOVER message for protocol processing, and returns a DHCP OFFER message to the host, and listens to or intercepts the DHCP OFFER message on the Layer 3 gateway device to extract the MAC information, performs matching, finds the entry generated in step S1002, and extracts the entry. The IP address information is written to the entry.

In step S1003, the host receives the DHCP OFFER packet for protocol processing, and sends a DHCP REQUEST packet to the DHCP server, and listens to or intercepts the DHCP REQUEST packet on the Layer 3 gateway device to extract the MAC information, and finds the entry generated in step S1002, and performs the connection. Into the information consistency check.

Step S1004: After receiving the DHCP REQUEST, the DHCP server performs protocol processing to return a DHCP ACK message to the host, and listens to or intercepts the DHCP ACK message on the Layer 3 gateway device to extract the MAC information, and matches the entry generated in step S1002, and simultaneously obtains the IP address. Performs a consistency check and writes the legal IP and MAC address information to the ARP entry.

In step S1005, the host sends a DHCP REQUEST renewal packet to the DHCP server, and the DHCP REQUEST packet is extracted or intercepted on the Layer 3 gateway device to extract the MAC address, and the entry is found to be found in step S1001, and the access information consistency check is performed.

Step S1006: After receiving the DHCP REQUEST renewal packet, the DHCP server returns a DHCP ACK packet to the host, and listens to or intercepts the DHCP ACK packet on the Layer 3 gateway device to extract the MAC information, and performs matching to find the entry generated in step S1002. At the same time, the IP is checked for consistency, and the aging time of the ARP entry is updated.

Step S1007: The host sends a DHCP RELEASE packet to the DHCP server, and the DHCP RELEASE packet is intercepted or intercepted on the Layer 3 gateway device to extract the MAC address, and the entry generated in step S1001 is found, and the access information consistency check is performed, and the corresponding information is deleted. ARP entry.

FIG. 11 is a flowchart of an ARP learning method according to an alternative embodiment of the present invention. As shown in FIG. 11, the process includes steps S1101-S1104:

Step S1101: The Layer 3 gateway device receives the ARP learning packet of the user terminal.

Step S1102, according to the IP and MAC and the ARP entry added in the ARP table. Correct.

In step S1103, if it is legal, the ARP response is returned.

In step S1104, if it is illegal, no response is received.

FIG. 12 is a flowchart of an ARP entry aging method according to an alternative embodiment of the present invention. As shown in FIG. 12, the process includes steps S1201-S1204:

In step S1201, the ARP entry added in the ARP table is aged according to the DHCP lease, and the aging time is up.

In step S1202, the Layer 3 gateway device triggers ARP learning to check whether the host is still online.

In step S1203, if the host is still online, the ARP entry is converted into a normal dynamic ARP entry.

In step S1204, if the host is not online, the ARP entry is deleted.

In summary, the ARP entry generation mode is added by using the foregoing embodiment and the optional embodiment of the present invention. Compared with the related technology, the ARP is extracted by intercepting and intercepting DHCP packets on the Layer 3 gateway device. The IP address, MAC address, VLAN, and interface information of the entry. When the host obtains the IP address, the Layer 3 device adds the ARP entry to the ARP table. The ARP entry is aged according to the address assigned by the DHCP. The priority of the ARP entry is greater than that of the dynamic ARP entry and cannot be overwritten by the dynamic ARP entry. This ensures the validity of the ARP entry, improves the security, and reduces the burden on the device for dynamic host ARP learning.

It will be apparent to those skilled in the art that each of the above-described modules or steps of the present invention can be implemented by a general-purpose computing device, which can be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

The above is only an alternative embodiment of the present invention, and is not intended to limit the embodiments of the present invention. For those skilled in the art, the present invention may be variously modified and changed. Where in this hair Any modifications, equivalent substitutions, improvements, etc. within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The solution of the embodiment of the present invention is to obtain a DHCP REQUEST packet, and parse the MAC address of the client carried in the DHCP REQUEST packet and the IP address requested by the client, where the DHCP REQUEST packet is sent by the client to the DHCP server. Determining whether the first DHCP ACK message of the DHCP server responding to the DHCP REQUEST message is received; if it is determined that the first DHCP ACK message is received, the MAC address and the IP address assigned by the client request are written as the ARP entry. The method of entering ARP entries solves the problem of low reliability of ARP entries in related technologies and improves the reliability of ARP entries.

Claims (17)

An address resolution protocol ARP entry generation method includes: Obtaining a dynamic host configuration protocol requesting a DHCP REQUEST packet, and parsing a media access control MAC address of the client carried in the DHCP REQUEST packet and an Internet Protocol IP address allocated by the client request, where the DHCP REQUEST report The message is sent by the client to a dynamic host configuration protocol DHCP server; Determining whether the DHCP server receives the DHCP ACK message in response to the first dynamic host configuration protocol of the DHCP REQUEST message; When it is determined that the first DHCP ACK message is received, the MAC address and the IP address assigned by the client request are written into the ARP entry as an ARP entry. The method for generating an ARP entry according to claim 1, further comprising: Before obtaining the DHCP REQUEST packet, the dynamic host configuration protocol in the broadcast form requests the DHCP DISCOVER packet, and parses the MAC address carried in the DHCP DISCOVER packet, where the DHCP DISCOVER packet is Said client sends to the DHCP server; Acquiring one or more dynamic host configuration protocol IP addresses carrying the MAC address to provide a DHCP OFFER message, and parsing one or more IP addresses carried in the one or more DHCP OFFER messages, where One or more DHCP OFFER messages are sent by the DHCP server to the client. The method for generating an ARP entry according to claim 1, further comprising: following the DHCP address after the MAC address and the IP address assigned by the client request are written into the ARP entry as the ARP entry. The aging time of the ARP entry is aging. The method for generating an ARP entry according to claim 3, further comprising: After the MAC address and the IP address that is requested by the client are used to write the ARP entry as the ARP entry, the DHCP REQUEST renewal message carrying the MAC address is obtained, where the DHCP The REQUEST renewal message is sent by the client to the DHCP server; Determining whether the DHCP server is received in response to the DHCP REQUEST renewal report Second DHCP ACK message of the text; In the case that it is determined that the second DHCP ACK message is received, the aging time of the ARP entry is updated. The method for generating an ARP entry according to claim 1, further comprising: After the MAC address and the IP address assigned by the client are used to write the ARP entry as the ARP entry, the dynamic host configuration protocol carrying the MAC address is released to release the DHCP RELEASE message. Delete the ARP entry. The ARP entry generating method according to claim 1, wherein the ARP entry has a higher priority than the dynamic ARP entry generated according to the address resolution protocol. The method for generating an ARP entry according to any one of claims 1 to 6, the method further comprising: After the MAC address and the IP address that is requested by the client are used to write the ARP entry as the ARP entry, the ARP learning packet sent by the client is received; Determining whether the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client request; And sending an ARP response packet if the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client requesting To the client. The method for generating an ARP entry according to claim 3, further comprising: After aging the ARP entry according to the aging time of the DHCP address lease, determining whether the ARP entry has aged; In the case that it is determined that the ARP entry has aged, check whether the client is online; The ARP entry is converted to a dynamic ARP entry if it is checked that the client is online; and the ARP entry is deleted if it is checked that the client is not online. An ARP entry generating device includes: a first processing module, a first determining module, and a writing module; The first processing module is configured to obtain a dynamic host configuration protocol request DHCP REQUEST message, and parse the media access control MAC address of the client carried in the DHCP REQUEST message and the Internet Protocol IP address allocated by the client request An address, wherein the DHCP REQUEST message is sent by the client to a dynamic host configuration protocol DHCP server; The first determining module is configured to determine whether the DHCP server receives the DHCP ACK message in response to the first dynamic host configuration protocol of the DHCP REQUEST message; The writing module is configured to: when the first determining module determines that the first DHCP ACK message is received, write the MAC address and the IP address allocated by the client request as an ARP entry. ARP entry. The ARP entry generating apparatus according to claim 9, wherein the first processing module is further configured to: Before obtaining the DHCP REQUEST packet, the dynamic host configuration protocol in the broadcast form requests the DHCP DISCOVER packet, and parses the MAC address carried in the DHCP DISCOVER packet, where the DHCP DISCOVER packet is Said client sends to the DHCP server; Acquiring one or more dynamic host configuration protocol IP addresses carrying the MAC address to provide a DHCP OFFER message, and parsing one or more IP addresses carried in the one or more DHCP OFFER messages, where One or more DHCP OFFER messages are sent by the DHCP server to the client. The ARP entry generating apparatus according to claim 9, further comprising: an aging module; The aging module is configured to: after the write module writes the MAC address and the IP address that the client requests to be the ARP entry to the ARP entry, according to the aging time of the DHCP address lease, The ARP entry is aged. The ARP entry generating apparatus according to claim 11, further comprising: a first obtaining module, a second determining module, and an updating module; The first obtaining module is configured to acquire the port after the write module writes the MAC address and the IP address that the client requests to be the ARP entry to the ARP entry. a DHCP REQUEST renewal message with the MAC address, wherein the DHCP REQUEST renewal message is sent by the client to the DHCP server; The second determining module is configured to determine whether the second DHCP ACK message of the DHCP server in response to the DHCP REQUEST renewal message is received; The update module is configured to update an aging time of the ARP entry if it is determined that the second DHCP ACK message is received. The ARP entry generating apparatus according to claim 9, further comprising: a second acquiring module; The second obtaining module is configured to acquire, after the write module writes the MAC address and the IP address that the client requests to be the ARP entry to the ARP entry, The dynamic host configuration protocol of the address releases the DHCP RELEASE message; Delete the module and set to delete the ARP entry. The ARP entry generating apparatus according to claim 9, wherein said ARP entry has a higher priority than a dynamic ARP entry generated according to an address resolution protocol. The ARP entry generating apparatus according to any one of claims 9 to 14, further comprising: a receiving module, a third determining module, and a transmitting module; The receiving module is configured to receive the ARP sent by the client after the write module writes the MAC address and the IP address that the client requests to be the ARP entry to the ARP entry. Learning message; The third determining module is configured to determine whether the source MAC address and the source IP address carried in the ARP learning packet are consistent with the MAC address recorded in the ARP entry and the IP address allocated by the client requesting ; The sending module is configured to determine, by the third determining module, a source MAC address and a source IP address carried in the ARP learning packet, and the MAC address and the client request allocation recorded in the ARP entry. If the IP addresses are the same, an ARP response packet is sent to the client. The ARP entry generating apparatus according to claim 11, further comprising: a fourth determining module; The fourth determining module is configured to determine, after the aging module ages the ARP entry according to the aging time of the DHCP address lease, to determine whether the ARP entry has aged; An checking module, configured to check whether the client is online if the fourth determining module determines that the ARP entry has aged; a second processing module, configured to: when the check module checks that the client is online, convert the ARP entry into a dynamic ARP entry; if the check module detects that the client is offline , delete the ARP entry. A computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the address resolution protocol ARP entry generation method of any one of claims 1-8.

Images