Automatic anti-spoof for multicast routing

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall;
• determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall;
• replacing the source address with a rendezvous point address;
• using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall;
• and,
• identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base;
• comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join;
• and,
• identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall;
• determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall;
• replacing the source address with a rendezvous point address;
• using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall;
• and,
• identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base;
• comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join;
• and,
• identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join.