Method and arrangement for preventing illegitimate use of IP addresses

A switch node in an Internet Protocol (IP) network adapted to prevent illegitmate use of an IP address by a subscriber device, the switch node including:

• at least one port for communication with a subscriber device;
• an uplink port for communication with DHCP Dynamic Host Configuration Protocol (DHCP) servers in the network;
• and,
• a filter device having a list of the trusted ones of the DHCP servers, the filter device being associated with the ports;
• wherein the switch node is operative to:
• receive a subscriber IP address request message from a subscriber device, analyse it to be a DHCP request message and transmit it on the uplink port;
• receive a reply message on the uplink port, analyse it to be a DHCP reply message having a source IP address from one of the originating from a trusted DHCP servers on the list server;
• dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message;
• receive a frame with a source IP address from a subscriber device;
• compare in the filter said source IP address with the stored subscriber IP address for the subscriber device;
• and,
• to discard said frame when said source IP address differs from the stored subscriber IP address.

An IP network system comprising a switch node and one or more Dynamic Host Configuration Protocol (DHCP) servers, said switch node and said one or more DHCP servers being connected to a core network, wherein said switch node comprises:

• at least one port for communication with a subscriber device;
• an uplink port for communication with the one or more DHCP servers in the network;
• and
• a filter device having a list noting trusted ones of the DHCP servers, the filter device being associated with the ports, wherein:
• the switch node is arranged to receive a subscriber IP address request message from a subscriberd device, analyse it to be a DHCP message and transmit it on the uplink port;
• the switch node is arranged to receive a reply message on the uplink port, analyse it to be a DHCP reply message originating from a trusted DHCP server;
• the switch node is arranged to dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message;
• the switch node is arranged to receive a frame with a source IP address from a subscriber device;
• the switch node is arranged to compare in the filter said source IP address with the stored subscriber IP address for the subscriber device;
• the switch node is arranged to discard said frame when said source IP address differs from the stored subscriber IP address;
• and
• the switch node is arranged to accept said frame when said source IP address corresponds to the stored subscriber IP address.