Method for protecting a network through port blocking

A method of protecting a layer 2 switch in a network against a MAC flooding attack, the MAC flooding attack flooding a layer 2 switch with at least one packet, the method which comprises:

• in the layer 2 switch, providing a database for saving MAC addresses and an allocation per physical switch port of the MAC addresses;
• using an interface between the user of the network and a network access to function as a line of demarcation;
• when a limit of the maximum quantity of MAC addresses per physical switch port is reached for a physical switch port, said interface blocking the physical switch port during a blocking time;
• wherein the interface is an optical network terminal interface;
• wherein the blocking time is greater than an aging time;
• and
• wherein the MAC flooding attacks with different MAC addresses.

A system for protecting a layer 2 switch in a network against a Media Access Control (MAC) flooding attack from a user wherein the layer 2 switch is flooded with at least one packet, the system comprising:

• in the layer 2 switch, a database of MAC addresses and an allocation, per physical switch port, of the MAC addresses;
• an interface as a line of demarcation between the user of the network and a network access;
• and
• said interface blocking the switch port during a given blocking time when a limit of the maximum quantity of MAC addresses per physical switch port is reached for a physical switch port;
• wherein the interface is an optical network terminal interface;
• wherein the blocking time is greater than an aging time;
• and
• wherein the MAC flooding attacks with different MAC addresses.