System and method for filtering network traffic

A system comprising:

• one or more processors;
• and
• a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
• maintain protocol status information for a network protocol, wherein
• the protocol status information comprises protocol information for the network protocol,
• the protocol status information is generated by a protocol server
• the protocol status information is used to determine an access control rule, and
• the access control rule is applied to a message;
• perform a security action associated with the access control rule to determine whether a message sent from the protocol server to a protocol client comprises a protocol message, wherein
• the security action comprises verifying that information in the message matches the protocol status information;
• based on a determination that the message comprises the protocol message, unicasting the message to the protocol client instead of broadcasting, multicasting, or flooding the message to multiple recipients;
• and
• updating a binding table entry comprising protocol status information associated with the protocol client, the protocol status information comprising information identifying an Internet Protocol (IP) address of the client, a Media Access Control address (MAC) of the client, and an interface coupled to the client.

A non-transitory computer-readable storage medium

• storing program instructions executable to:
• maintain protocol status information for a network protocol, wherein
• the protocol status information comprises protocol information for the network protocol,
• the protocol status information is generated by a protocol server,
• the protocol status information is used to determine an access control rule, and
• the access control rule is applied to a message;
• perform a security action associated with the access control rule to determine whether a message sent from the protocol server to a protocol client comprises a protocol message, wherein
• the security action comprises verifying that information in the message matches the protocol status information;
• based on a determination that the message comprises the protocol message, unicasting the message to the protocol client instead of broadcasting, multicasting, or flooding the message to multiple recipients;
• and
• updating a binding table entry comprising protocol status information corresponding to the protocol client, the protocol status information comprising information identifying an Internet Protocol (IP) address of the client, a Media Access Control address (MAC) of the client, and an interface coupled to the client.