Protecting address resolution protocol neighbor discovery cache against denial of service attacks
In one embodiment, a device (e.g., switch or registry) maintains a binding table for all internet protocol (IP) addresses in a particular subnet associated with the device, and in response to receiving a neighbor solicitation (NS) lookup message from a router for a particular address, determines whether the particular address is within the binding table. When the particular address is not within the binding table, the device causes the router to not store the particular address in a neighbor discovery (ND) cache at the router (e.g., by responding to clear the cache, or ignoring to prevent state from being created). In another embodiment, the ND-requesting router ensures that the particular address is not kept in an ND cache at the router in response to the device indicating that the particular address is not within its binding table (e.g., an explicit response to clear, or absence of instruction to store state).
1. A method, comprising:
maintaining a binding table at a device for all internet protocol (IP) addresses in a particular subnet associated with the device;
receiving a neighbor solicitation (NS) lookup message from a router for a particular address;
determining whether the particular address is within the binding table; and
when the particular address is not within the binding table, causing the router to clear the particular address in a neighbor discovery (ND) cache at the router prior to cache expiry of the particular address in the ND cache of the router.
2. The method as in claim 1 , wherein causing comprises:
responding to the router with a negative status to cause the router to clear the particular address from the ND cache prior to cache expiry of the particular address.
3. The method as in claim 1 , wherein the device is a registry device.
4. The method as in claim 1 , wherein the device is a switch configured to intercept the NS lookup message.
5. The method as in claim 4 , further comprising:
revalidating the particular address with a registry prior to responding to the router on behalf of the registry.
6. A method, comprising:
receiving a message at a router to a particular address within a particular subnet;
storing the particular address in a neighbor discovery (ND) cache at the router in response to receiving the message;
generating a neighbor solicitation (NS) lookup message for the particular address;
transmitting the NS lookup message toward a registry to cause a device, with a binding table of all internet protocol (IP) addresses in the particular subnet, to determine whether the particular address is within the subset; and
clearing the particular address from the ND cache prior to cache expiry of the particular address in response to receiving a negative status from the device.
7. The method as in claim 6 , wherein the device is a switch.
8. An apparatus, comprising:
one or more network interfaces to communicate within a computer network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
maintain a binding table for all internet protocol (IP) addresses in a particular subnet associated with the apparatus;
receive a neighbor solicitation (NS) lookup message from a router for a particular address;
determine whether the particular address is within the binding table; and
when the particular address is not within the binding table, cause the router to clear the particular address in a neighbor discovery (ND) cache at the router prior to cache expiry of the particular address in the ND cache of the router.
9. The apparatus as in claim 8 , wherein the process when executed to cause is further operable to:
respond to the router with a negative status to cause the router to clear the particular address from the ND cache prior to cache expiry of the particular address.
10. The apparatus as in claim 8 , wherein the apparatus is a registry device.
11. The apparatus as in claim 8 , wherein the device is a switch configured to intercept the NS lookup message.
12. The apparatus as in claim 8 , wherein the process when executed is further operable to:
revalidate the particular address with a registry prior to responding to the router on behalf of the registry.
13. An apparatus, comprising:
one or more network interfaces to communicate within a computer network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive a message for a particular subnet;
store the particular address in a neighbor discovery (ND) cache at the apparatus in response to receiving the message;
generate a neighbor solicitation (NS) lookup message for the particular address;
transmit the NS lookup message toward a registry to cause a device with a binding table of all internet protocol (IP) addresses in the particular subnet to determine whether the particular address is within the subnet; and
clear the particular address from the ND cache prior to cache expiry of the particular address in response to receiving a negative status from the device.
14. The apparatus as in claim 13 , wherein the apparatus is a router, and the device is a switch.
15. The apparatus as in claim 13 , wherein the device is a registry device.
16. The apparatus as in claim 13 , wherein the device is a switch configured to intercept the NS lookup message.