Detecting neighbor discovery denial of service attacks against a router

An apparatus comprising:

• an Internet Protocol (IP) network interface circuit configured for receiving a data packet specifying an IP destination address having an address prefix assigned to the apparatus;
• a neighbor cache circuit configured for storing IP addresses of IP nodes having been determined as reachable by the apparatus;
• a plurality of pending message queue circuits, each indexed by a corresponding hash index value;
• and
• a neighbor discovery circuit configured for initiating neighbor discovery in response to detecting an absence of the IP destination address within the neighbor cache circuit, the neighbor discovery circuit configured for initiating neighbor discovery based on generating a neighbor solicitation message targeting the IP destination address and for output by the IP network interface circuit into a network served by the apparatus, generating the hash index value for the data packet based on a combination of the IP destination address with a randomized token stored in the apparatus, and storing the data packet in a selected one of the pending message queue circuits based on the corresponding hash index value for the data packet matching the corresponding hash index value of the selected one pending message queue circuit, each pending message queue circuit configured for storing stored data packets having the corresponding hash index value and awaiting respective solicited neighbor advertisement messages from the network;
• the neighbor discovery circuit further configured for detecting a neighbor discovery denial of service attack based on a determined distribution of the stored data packets among the pending message queue circuits.

An apparatus comprising:

• means for receiving a data packet specifying an Internet Protocol (IP) destination address having an address prefix assigned to the apparatus;
• a neighbor cache circuit configured for storing IP addresses of IP nodes having been determined as reachable by the apparatus;
• means for storing a plurality of data packets awaiting respective solicited neighbor advertisement messages, each data packet indexed within the means for storing based on a corresponding hash index value;
• and
• means for initiating neighbor discovery in response to detecting an absence of the IP destination address within the neighbor cache circuit, the means for initiating configured for initiating neighbor discovery based on generating a neighbor solicitation message targeting the IP destination address and for output by the means for receiving into a network served by the apparatus, generating the hash index value for the data packet based on a combination of the IP destination address with a randomized token stored in the apparatus, and storing the data packet in means for storing based on the corresponding hash index value for the data packet;
• the means for initiating further configured for detecting a neighbor discovery denial of service attack based on a determined distribution of the stored data packets in the means for storing, relative to the hash index values.