# US 8,544,088 B2 · Method for protecting a network through port blocking

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,088 B2
- Document ID: US8544088B2
- Status: Granted
- Kind: B2
- Application number: 12/667,175
- Filed: 2008-06-19
- Published: 2010-07-15
- Granted: 2013-09-24
- Earliest claimed: 2007-06-29
- Assignees: Adtran, Inc.
- Applicants: Uwe Schmidtke
- Inventors: Uwe Schmidtke
- Web page: https://patentgrep.com/patent/US8544088B2

## CPC

- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1458: {Denial of Service}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for protecting a network against a security attack from an user, and in particular, for a layer 2 switch, against a MAC flooding attack. Here, the MAC flooding attack floods the layer 2 switch with at least one packet, a database is provided which saves a MAC address and its allocation and the database has a maximum quantity. According to the method, an interface between the user of the network and a network access functions as a line of demarcation. When the limit of the maximum quantity for a port is reached, the port is blocked during a blocking time. This not only protects the first access node, but also the following network nodes and users respectively, against a security attack.

## Claims

### Claim 1

A method of protecting a layer 2 switch in a network against a Media Access Control (MAC) flooding attack from a user wherein the layer 2 switch is flooded with at least one packet, the method which comprises:
in the layer 2 switch, providing a database for saving MAC addresses and an allocation, per physical switch port, thereof;
establishing an interface between the user of the network and a network access as a line of demarcation;
when a limit of the maximum quantity of MAC addresses per physical switch port is reached for a physical switch port, said interface blocking the physical switch port during a given blocking time;
wherein the interface is an optical network terminal interface;
wherein the blocking time is greater than an aging time; and
wherein the MAC flooding attacks with different MAC addresses.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the limit of the maximum quantity is a limit per configuration.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the limit of the maximum quantity is a per default-provided limit.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the given blocking time is greater than an aging time.

### Claim 5 (depends on 4)

The method according to claim 4, wherein the aging time is alterable.

### Claim 6 (depends on 4)

The method according to claim 4, wherein the aging time is 200 seconds.

### Claim 7 (depends on 1)

The method according to claim 1, wherein the given blocking time is a separately adjustable blocking time.

### Claim 8 (depends on 1)

The method according to claim 1, wherein the blocking time can comply with its own aging time.

### Claim 9 (depends on 1)

The method according to claim 1, which comprises providing a hysteresis between a blocking and an unblocking of the port.

### Claim 10 (depends on 9)

The method according to claim 9, which comprises providing two different limits for blocking and unblocking of the port, respectively.

### Claim 11 (depends on 1)

The method according to claim 1, wherein the method may be selectively switched off.

### Claim 12

A method of protecting a layer 2 switch in a network against a MAC flooding attack, the MAC flooding attack flooding a layer 2 switch with at least one packet, the method which comprises:
in the layer 2 switch, providing a database for saving MAC addresses and an allocation per physical switch port of the MAC addresses;
using an interface between the user of the network and a network access to function as a line of demarcation;
when a limit of the maximum quantity of MAC addresses per physical switch port is reached for a physical switch port, said interface blocking the physical switch port during a blocking time;
wherein the interface is an optical network terminal interface;
wherein the blocking time is greater than an aging time; and
wherein the MAC flooding attacks with different MAC addresses.

### Claim 13

A system for protecting a layer 2 switch in a network against a Media Access Control (MAC) flooding attack from a user wherein the layer 2 switch is flooded with at least one packet, the system comprising:
in the layer 2 switch, a database of MAC addresses and an allocation, per physical switch port, of the MAC addresses;
an interface as a line of demarcation between the user of the network and a network access; and
said interface blocking the switch port during a given blocking time when a limit of the maximum quantity of MAC addresses per physical switch port is reached for a physical switch port;
wherein the interface is an optical network terminal interface;
wherein the blocking time is greater than an aging time; and
wherein the MAC flooding attacks with different MAC addresses.