IPv4, IPv6, and ARP spoofing protection method
AssigneeMarvell Israel (M.I.S.L) Ltd.
InventorsDavid Melman, Tsahi Daniel
Life of this patent
Estimating the term…
Abstract
A method of detecting address spoofing includes receiving an ARP packet at a network device. The ARP packet includes a first address associated with a first network layer and a second address associated with a second network layer. The method also includes accessing a first memory searchable by the first address to obtain a memory reference and retrieving a third address associated with the second network layer from a second memory using the memory reference. The method further includes comparing the second address with the third address and detecting address spoofing if a match is not present between the second address and the third address.
Claims12
A method of detecting address spoofing in a network packet, the method comprising:
- receiving, at a Layer 3 device, a network packet having a first source address that is associated with a first network layer and a source IP address that is associated with a second network layer;
- retrieving a destination MAC address by performing a lookup in a Layer 3 table that associates the source IP address with a next hop destination route entry, wherein the next hop destination route entry points to the destination MAC address;
- determining a source MAC address corresponding to the source IP address for the network packet using the retrieved destination MAC address;
- and
- comparing the determined source MAC address to the first source address of the network packet to detect address spoofing when the determined source MAC address fails to match the first source address of the network packet.
A network device comprising:
- an ingress port configured to receive a network packet having a first source address that is associated with a first network layer and a source IP address that is associated with a second network layer;
- a memory interface configured to:
- retrieve a destination MAC address through a lookup in a Layer 3 table that associates the source IP address with a next hop destination route entry, wherein the next hop destination route entry points to the destination MAC address;
- and
- determine a source MAC address corresponding to the source IP address for the network packet using the retrieved destination MAC address;
- and
- a comparator configured to compare the determined source MAC address to the determined first source address of the network packet to detect address spoofing when the determined source MAC address fails to match the first source address of the network packet.
Dependencies are inferred from the claim text.