US 8,942,234 B2 · DAD-NS triggered address resolution for DOS attack protection

Abstract

A first network element that receives an appropriation message from a second network element that indicates a target address which the second network element intends to appropriate for its use. In response to the appropriation message, the first network element broadcasts a discovery message to a plurality of network elements on the network to request a link-layer address in association with the first target address. The first network element receives a discovery response from the second network element with the first target address and the link-layer address of the second network element. Then the first network element updates a neighbor cache to include a pre-cached neighbor cache entry associating the link-layer address to the first target address. This prevents one or more future neighbor cache misses associated with the first target address.

Claims21

Dependent claims

A method performed by a first network element coupled with a plurality of network elements within a network supporting IPv6, the method comprising:

determining a link-layer address of a second network element in response to the second network element joining the network, the determining comprising,
broadcasting, in response to an appropriation message from the second network element indicating an intent to use a first target IP address, a discovery message to the plurality of network elements including the second network element, wherein the discovery message indicates the first target IP address and is broadcast to request the link-layer address in association with the first target IP address.

A network element, to be coupled to a network that supports IPv6, configured to receive packets, process those packets, and maintain a neighbor cache to associate internet protocol (IP) addresses of network elements of the network with their corresponding link-layer addresses, the network element comprising:

one or more network interfaces configured to receive the packets from network elements of the network;
a set of one or more microprocessors coupled to the one or more network interfaces;
and
a non-transitory computer readable medium, coupled with the set of microprocessors, that has stored therein instructions that, when executed by the set of microprocessors, cause the network element to,
determine the link-layer addresses of network elements joining the network, the determination including,
a broadcast by the network element, in response to an appropriation message that is from another network element joining the network and that indicates an intent o use a target IP address, of a discovery message to network elements of the network including the another network element, wherein the discovery message indicates the target IP address and is broadcast to request the link-layer address used by the another network element joining the network.

3 more elements

A tangible non-transitory machine-readable storage medium comprising instructions for at least one microprocessor of a processing device within a network supporting IPv6, which, when executed by the microprocessor, cause the microprocessor to perform operations comprising:

determining a link-layer address of second network element in response to the second network element joining the network, the determining comprising,
broadcasting, in response to an appropriation message from the second network element indicating an intent to use a first target IP address, a discovery message to a plurality of network elements including the second network element, wherein the discovery message indicates the first target IP address and is broadcast to request the link-layer address in association with the first target IP address.

Dependencies are inferred from the claim text.

DAD-NS triggered address resolution for DOS attack protection

Life of this patent

DAD-NS triggered address resolution for DOS attack protection

Life of this patent

Abstract

Claims21