Method for defending against denial-of-service attack on the IPV6 neighbor cache

1. A method for use in a network node of a computer network of defending against a denial-of-service attack on a neighbor cache, the method comprising the steps of:

determining a number of neighbor cache entries currently stored in the neighbor cache;

determining whether the number of entries exceeds a neighbor cache threshold that is less than a neighbor cache limit defining a maximum capacity of the neighbor cache; and

initiating stateless neighbor resolution when the number of entries in the neighbor cache exceeds the neighbor cache threshold, wherein stateless neighbor resolution includes sending a neighbor solicitation to resolve an address for an incoming packet without logging a corresponding entry in the neighbor cache.

2. The method as claimed in claim 1 wherein the neighbor cache is an IPv6 neighbor cache.

3. The method as claimed in claim 2 further comprising a step of adjusting the neighbor cache threshold.

4. The method as claimed in claim 3 wherein the neighbor cache threshold is tunable as a percentage of the neighbor cache limit.

5. The method as claimed in claim 2 further comprising a step of adjusting the neighbor cache limit.

6. The method as claimed in claim 2 further comprising a step of presetting a reserved entry in the neighbor cache that is reserved for dynamic discovery of Layer 3 to Layer 2 address mapping.

7. The method as claimed in claim 2 further comprising a step of presetting a static entry in the neighbor cache that provides a static Layer 3 to Layer 2 address mapping.

8. The method as claimed in claim 2 further comprising a step of shortening an incomplete-status timer whereby an entry having a status designated as incomplete times out in less than 3 seconds.

9. The method as claimed in claim 2 further comprising a step of reducing to less than 3 a number of retransmissions of the neighbor solicitations that are retried before timing out.

10. The method as claimed in claim 2 further comprising a step of prioritizing neighbor cache entries according to a prioritization list which gives highest priority to packets from trusted sources and which gives least priority to neighbor cache entries designated as incomplete.

11. The method as claimed in claim 2 further comprising a step of purging neighbor cache entries designated as incomplete when the number of neighbor cache entries reaches a second threshold that is higher than the neighbor cache threshold that triggers stateless neighbor resolution but is less than the neighbor cache limit.

12. The method as claimed in claim 11 further comprising a step of stopping queuing of incoming packets when the number of neighbor cache entries reaches a third threshold that is higher than the second threshold but is less than the neighbor cache limit.

13. The method as claimed in claim 2 further comprising a step of deactivating the stateless neighbor resolution when the number of neighbor cache entries in the neighbor cache falls beneath a shut-off threshold.

14. The method as claimed in claim 13 wherein the shut-off threshold is different from the threshold for initiating stateless neighbor resolution.

15. The method as claimed in claim 14 wherein the shut-off threshold is lower than the threshold for initiating stateless neighbor resolution.

16. The method as claimed in claim 2 wherein the neighbor cache limit (NCL) satisfies the condition that NCL=N×NCON where NCON represents the number of neighbor connections for a given node, the neighbor connections including all link-local addresses and all global addresses where N is a total of all link-local addresses and all global addresses.

17. A network node in a computer network configured to resist a denial-of-service attack, the node comprising:

a neighbor cache for storing a plurality of neighbor cache entries describing a current state of each incoming data packet as a neighbor address is resolved for that data packet; and

a cache manager for monitoring a number of neighbor cache entries currently stored in the neighbor cache and for triggering a denial-of-service defence when the number of neighbor cache entries exceeds a neighbor cache threshold set by a denial-of-service policy,

wherein the denial-of-service defence comprises initiation of stateless neighbor resolution whereby a neighbor solicitation is sent to resolve an address for an incoming packet without logging a corresponding entry in the neighbor cache.

18. The node as claimed in claim 17 wherein the neighbor cache is an IPv6 neighbor cache.

19. The node as claimed in claim 18 wherein the denial-of-service defence further comprises purging neighbor cache entries according to a prioritization list which gives highest priority to packets from trusted sources and which gives least priority to neighbor cache entries designated as incomplete.

20. The node as claimed in claim 18 comprising a plurality of IPv6 neighbor caches for storing the neighbor cache entries requiring address resolution at the node.

21. The node as claimed in claim 18 comprising a plurality of interfaces and wherein the IPv6 neighbor cache stores neighbor cache entries for at least two of the interfaces.

22. The node as claimed in claim 18 comprising at least one interface, each interface having at least one IPv6 neighbor cache.

23. The node as claimed in claim 18 comprising at least one interface, each interface having a plurality of IPv6 neighbor caches.