Method for defending against denial-of-service attack on the IPV6 neighbor cache
View Patent ↗A method of defending against a denial-of-service (DoS) attack on an IPv6 neighbor cache includes steps of determining a number of neighbor cache entries currently stored in the neighbor cache and then determining whether the number of entries exceeds a neighbor cache threshold that is less than a neighbor cache limit defining a maximum capacity of the neighbor cache. When the number of entries in the neighbor cache exceeds the neighbor cache threshold, stateless neighbor resolution is triggered. Stateless neighbor resolution entails sending a neighbor solicitation to resolve an address for an incoming packet without logging a corresponding entry in the neighbor cache. Additional techniques that complement the above method involve purging of neighbor cache entries designated as incomplete, prioritization of the entries based on trustworthiness, shortening the incomplete-status timer to less than 3 seconds, and curtailing the number of retransmissions of the neighbor solicitations.
1. A non-transitory storage medium storing instructions for execution by at least one processor to defend against a denial of service attack in a computer network, the instructions comprising instructions executable by the at least one processor:
to determine a number of neighbor cache entries currently stored in a neighbor cache;
to determine whether the number of entries exceeds a neighbor cache threshold; and
to initiate stateless neighbor resolution when the number of entries in the neighbor cache exceeds the neighbor cache threshold, the stateless neighbor resolution including sending a neighbor solicitation to resolve an address for an incoming packet.
2. The storage medium of claim 1 , wherein the neighbor cache threshold is less than a neighbor cache limit defining a maximum capacity of the neighbor cache.
3. The storage medium of claim 1 , wherein the instructions further comprise instructions to send a neighbor solicitation to resolve an address for an incoming packet without logging a corresponding entry in the neighbor cache.
4. The storage medium of claim 1 , wherein the neighbor cache is an Ipv6 neighbor cache.
5. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to adjust the neighbor cache threshold,
6. The storage medium of claim 2 , wherein the instructions further comprise instructions executable to adjust the neighbor cache limit.
7. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to preset a reserved entry in the neighbor cache that is reserved for dynamic discovery of Layer 3 to Layer 2 address mapping.
8. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to preset a static entry in the neighbor cache configured to provide a static Layer 3 to Layer 2 address mapping.
9. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to shorten an incomplete-status timer whereby an entry having a status designated as incomplete times out in less than 3 seconds.
10. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to reduce to less than 3 a number of retransmissions of the neighbor solicitations that are retried before timing out.
11. The storage medium of claim 1 , wherein the instructions further comprise instructions executable to prioritize neighbor cache entries according to a prioritization list that gives highest priority to packets from trusted sources and which gives least priority to neighbor cache entries designated as incomplete.
12. The storage medium of claim 2 , wherein the instructions further comprise instructions executable to purge neighbor cache entries designated as incomplete when the number of neighbor cache entries reaches a second threshold that is higher than the neighbor cache threshold that triggers stateless neighbor resolution but is less than the neighbor cache limit.
13. The storage medium of claim 1 , herein the instructions further comprise instructions executable to deactivate the stateless neighbor resolution when the number of neighbor cache entries in the neighbor cache falls beneath a shut-off threshold.
14. The storage medium of claim 13 , wherein the shut-off threshold is different from the threshold for initiating stateless neighbor resolution.
15. The storage medium of claim 14 , wherein the shut-off threshold is lower than the threshold for initiating stateless neighbor resolution.
16. The storage medium of claim 12 , wherein the instructions further comprise instructions executable to stop queuing of incoming packets when the number of neighbor cache entries reaches a third threshold that is higher than the second threshold but is less than the neighbor cache limit.
17. The storage medium of claim 2 , wherein the neighbor cache limit (NCL) satisfies the condition that NCL≧N×NCON where NCON represents a number of neighbor connections for a given node, the neighbor connections including all link-local addresses and all global addresses and N represents a number of addresses.
18. The storage medium of claim 5 , wherein the neighbor cache threshold is tunable as a percentage of a neighbor cache limit defining a maximum capacity of the neighbor cache.
19. A method for use in a network node of a computer network to defend against a denial of service attack, the method comprising:
determining a number of neighbor cache entries currently stored in a neighbor cache;
determining whether the number of entries exceeds a neighbor cache threshold; and
initiating stateless neighbor resolution when the number of entries in the neighbor cache exceeds the neighbor cache threshold, the stateless neighbor resolution including sending a neighbor solicitation to resolve an address for an incoming packet.
20. The method of claim 19 , further comprising:
adjusting the neighbor cache threshold.
21. The method of claim 20 , wherein the neighbor cache threshold is tunable as a percentage of a neighbor cache limit defining a maximum capacity of the neighbor cache.
22. The method of claim 19 , wherein the neighbor cache threshold is less than a neighbor cache limit defining a maximum capacity of the neighbor cache.
23. The method of claim 22 , further comprising:
adjusting the neighbor cache threshold.
24. The method of claim 22 , further comprising:
purging neighbor cache entries designated as incomplete when the number of neighbor cache entries reaches a second threshold that is higher than the neighbor cache threshold that triggers stateless neighbor resolution but is less than the neighbor cache limit.
25. The method of claim 24 , further comprising:
stopping a queueing of incoming packets when the number of neighbor cache entries reaches a third threshold that is higher than the second threshold but is less than the neighbor cache limit.
26. The method of claim 22 , wherein the neighbor cache limit (NCL) satisfies the condition that NCL≧N×NCON where NCON represents a number of neighbor connections for a given node, the neighbor connections including all link-local addresses and all global addresses and N represents a number of addresses.
27. The method of claim 19 , further comprising:
sending a neighbor solicitation to resolve an address for an incoming packet without logging a corresponding entry in the neighbor cache.
28. The method of claim 19 , wherein the neighbor cache is an IPv6 neighbor cache.
29. The method of claim 19 , further comprising:
presetting a reserved entry in the neighbor cache that is reserved for dynamic discovery of Layer 3 to Layer 2 address mapping.
30. The method of claim 19 , further comprising:
presetting a static entry in the neighbor cache configured to provide a static Layer 3 to Layer 2 address mapping.
31. The method of claim 19 , further comprising:
shortening an incomplete-status timer whereby an entry having a status designated as incomplete times out in less than 3 seconds.
32. The method of claim 19 , further comprising:
reducing, to less than 3, a number of retransmissions of the neighbor solicitations that are retried before timing out.
33. The method of claim 19 , further comprising:
prioritizing neighbor cache entries according to a prioritization list that gives highest priority to packets from trusted sources and that gives least priority to neighbor cache entries designated as incomplete.
34. The method of claim 19 , further comprising:
deactivating the stateless neighbor resolution when the number of neighbor cache entries in the neighbor cache falls beneath a shut-off threshold.
35. The method of claim 34 , wherein the shut-off threshold is different from the threshold for initiating stateless neighbor resolution.
36. The method of claim 35 , wherein the shut-off threshold is lower than the threshold for initiating stateless neighbor resolution.