Method and apparatus for preventing spoofing of network addresses

An apparatus for preventing spoofing of network addresses, comprising:

• means for establishing one or more bindings outside an Address Resolution Protocol (ARP) table, wherein each of the one or more bindings is between an Internet Protocol (IP) address, a Media Access Control (MAC) address, and a port identifier, and wherein said IP address and said MAC address identify a device that is the only device physically connected to a port of a second device which port is identified by said port identifier;
• means for determining whether there is a particular binding among the one or more bindings,
• wherein said particular binding is between a first IP address, a first MAC address, and a first port identifier,
• wherein said first IP address and said first MAC address identify a first device that is the only device connected to a particular port of said second device which particular port is identified by said first port identifier,
• wherein at least one of (i) that said first IP address is different from a second IP address, (ii) that said first MAC address is different from a second MAC address, or (iii) that said first port identifier is different from a second port identifier, is true,
• wherein at least one of (i) that said first IP address is same as said second IP address, (ii) that said first MAC address is same as said second MAC address, or (iii) that said first port identifier is same as said second port identifier, is true, and
• wherein said second IP address, said second MAC address, and said second port identifier comprise a claim for a binding relationship therebetween;
• means for determining that said particular port of said second device is under attack, in response to determining that there is a particular binding among the one or more bindings;
• and
• means for updating said ARP table in memory based on said particular binding.

An apparatus for preventing spoofing of network addresses, comprising:

• a network interface that is coupled to a data network for receiving one or more packet flows therefrom;
• a processor;
• and
• one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
• establishing one or more bindings outside an Address Resolution Protocol (ARP) table, wherein each of the one or more bindings is between an Internet Protocol (IP) address, a Media Access Control (MAC) address, and a port identifier, and wherein said IP address and said MAC address identify a device that is the only device physically connected to a port of a second device which port is identified by said port identifier;
• determining whether there is a particular binding among the one or more bindings,
• wherein said particular binding is between a first IP address, a first MAC address, and a first port identifier,
• wherein said first IP address and said first MAC address identify a first device that is the only device connected to a particular port of said second device which particular port is identified by said first port identifier,
• wherein at least one of (i) that said first IP address is different from a second IP address, (ii) that said first MAC address is different from a second MAC address, or (iii) that said first port identifier is different from a second port identifier, is true,
• wherein at least one of (i) that said first IP address is same as said second IP address, (ii) that said first MAC address is same as said second MAC address, or (iii) that said first port identifier is same as said second port identifier, is true, and
• wherein said second IP address, said second MAC address, and said second port identifier comprise a claim for a binding relationship therebetween;
• in response to determining that there is said particular binding among the one or more bindings, determining that said particular port of said second device is under attack;
• and
• updating said ARP table in memory based on said particular binding.

A computer-readable medium carrying one or more sequences of instructions for preventing spoofing of network addresses, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

• establishing one or more bindings outside an Address Resolution Protocol (ARP) table, wherein each of the one or more bindings is between an Internet Protocol (IP) address, a Media Access Control (MAC) address, and a port identifier, and wherein said IP address and said MAC address identify a device that is the only device physically connected to a port of a second device which port is identified by said port identifier;
• determining whether there is a particular binding among the one or more bindings,
• wherein said particular binding is between a first IP address, a first MAC address, and a first port identifier,
• wherein said first IP address and said first MAC address identify a first device that is the only device connected to a particular port of said second device which particular port is identified by said first port identifier,
• wherein at least one of (i) that said first IP address is different from a second IP address, (ii) that said first MAC address is different from a second MAC address, or (iii) that said first port identifier is different from a second port identifier, is true,
• wherein at least one of (i) that said first IP address is same as said second IP address, (ii) that said first MAC address is same as said second MAC address, or (iii) that said first port identifier is same as said second port identifier, is true, and
• wherein said second IP address, said second MAC address, and said second port identifier comprise a claim for a binding relationship therebetween;
• in response to determining that there is said particular binding among the one or more bindings, determining that said particular port of said second device is under attack;
• and
• updating said ARP table in memory based on said particular binding.