Method for protecting a network configuration set up by a spanning tree protocol
View Patent ↗A method for protecting a network configuration set up by a spanning tree protocol, STP, by selecting one of a plurality of bridges ( 2 to 11 ) of a computer network ( 1 ) as a root bridge ( 2 ) and by selecting one of a plurality of bridge ports ( 2 a to 11 a , 3 b, 4 b , 6 b, 7 b, 9 b, 10 b ) of each of the plurality of bridges ( 2 to 11 ) as a root port ( 2 a to 11 a ), the method comprising the steps of: setting a sub-state of at least one bridge port ( 2 a to 11 a, 3 b, 4 b, 6 b, 7 b, 9 b, 10 b ) of at least one of the bridges ( 2 to 11 ) to an active sub-state in case that bidirectional traffic passes through the bridge port ( 2 a to 11 a, 3 b, 4 b, 6 b, 7 b, 9 b, 10 b ), receiving an STP message, in particular a Bridge Protocol Data Unit, BPDU, in one of the bridge ports ( 2 a to 11 a, 3 b, 4 b, 6 b, 7 b, 9 b, 10 b ) being in the active sub-state, and protecting the network configuration by discarding the STP message and/or by sending an alarm message to a network management unit ( 27 ) in case that the STP message indicates a change of the root bridge ( 2 ) of the network configuration.
1. A method for protecting a network configuration set up by a spanning tree protocol, STP, by selecting one of a plurality of bridges of a computer network as a root bridge and by selecting one of a plurality of forwarding bridge ports of each of the plurality of bridges as a root port, wherein the selected one of the plurality of forwarding bridge ports is in a forwarding state, the method comprising the steps of:
splitting the forwarding state of the bridge port to an active and a passive sub-state through an additional state machine unit added to each of the forwarding bridge ports;
setting a sub-state of at least one forwarding bridge port of at least one of the bridges to an active sub-state as long as bidirectional payload traffic is conveyed through the forwarding bridge port;
receiving an STP message, in particular a Bridge Protocol Data Unit, BPDLT, in one of the forwarding bridge ports being in the active sub-state, and
protecting the network configuration by discarding the STP message and by sending an alarm message to a network management unit in case that the STP message indicates a change of the root bridge of the network configuration;
wherein the change of the root bridge is indicated by a bridge port ID of the BPDU which is smaller than the bridge port ID of the root bridge of the network configuration.
2. Method according to claim 1 , further comprising the step of checking the root path costs of the STP message for plausibility in case that the STP message indicates a change of the root port and a decrease of the root path costs.
3. Method according to claim 2 , wherein checking of the root path costs for plausibility is performed by comparing the root path costs of the STP message with the actual root path costs, taking into account the topology of the network and/or a permitted range of root path costs set by the network management unit.
4. Bridge for operating in a network configuration of a computer network set up by a spanning tree protocol, STP, by selecting one of a plurality of forwarding bridge ports of the bridge as a root port and by selecting one of a plurality of bridges of the computer network as a root bridge, the bridge comprising:
a sub-state setting unit for splitting a forwarding state of the bridge port to an active and a passive sub-state through an additional state machine unit added to each of the forwarding bridge ports and for setting the sub-state of the forwarding state of at least one of the forwarding bridge ports to an active sub-state as long as bidirectional payload traffic passes through the forwarding bridge port,
a receiving unit for receiving a STP message, in particular a Bridge Protocol Data Unit, BPDU, in one of the forwarding bridge ports being in the active sub-state, and
a network configuration protection unit for protecting the network configuration by discarding the STP message and by sending an alarm message to a network management unit in case that the STP message indicates a change of the root bridge of the network configuration;
wherein a change of the root bridge is indicated in the network configuration protection unit by a bridge port ID of the BPDU which is smaller than the bridge port ID of the root bridge.
5. Bridge according to claim 4 , wherein the network configuration protection unit is adapted to check the root path costs of the STP message for plausibility in case that the STP message indicates a change of the root port and a decrease of the root path costs.
6. Bridge according to claim 5 , wherein the network configuration protection unit is adapted to check the root path costs for plausibility by comparing the root path costs of the STP message with the actual root path costs, taking into account the topology of the network and/or a permitted range of root path costs set by the network management unit.
7. Computer network comprising a plurality of bridges according to claim 4 , the computer network operating in a network configuration set up by a spanning tree protocol, STP, by selecting one of the plurality of bridges as a root bridge and by selecting one of a plurality of forwarding bridge ports of each of the plurality of bridges as a root port.
8. Computer network according to claim 7 , further comprising a network management unit.