Detecting and preventing router-solicitation flood attacks
An electronic device may receive a control packet from the second electronic device with a request for information about a router. Then, the electronic device may provide a response to the second electronic device with the information about the router, where the response is provided using unicast communication. Next, the electronic device may receive an optional acknowledgment from the second electronic device. Furthermore, the electronic device may store response information that indicates the response was provided to the second electronic device and the optional acknowledgment was received. When the electronic device receives one or more subsequent control packets from the second electronic device with the request for the information about the router, the electronic device may determine that there is malicious activity based at least in part on the response information and may perform a remedial action.
1. An electronic device, comprising:
an interface circuit configured to wirelessly communicate with a second electronic device, wherein the electronic device is configured to:
receive, at the interface circuit, a control packet associated with the second electronic device, wherein the control packet comprises a request for information about a router;
access the information about the router based at least in part on the control packet;
provide, from the interface circuit, a response addressed to the second electronic device with the information about the router, wherein the response is provided using unicast communication;
store response information that indicates that the response was provided to the second electronic device;
receive, at the interface circuit, one or more subsequent control packets associated with the second electronic device, wherein the one or more subsequent control packets comprise the request for the information about the router;
determine that there is malicious activity based at least in part on the one or more subsequent control packets and the response information; and
perform a remedial action.
2. The electronic device of claim 1 , wherein the electronic device comprises an access point.
3. The electronic device of claim 1 , wherein the control packet comprises a router solicitation.
4. The electronic device of claim 3 , wherein the router solicitation is compatible with Internet Protocol version 6 (IPv6).
5. The electronic device of claim 1 , wherein the malicious activity comprises a router-solicitation flood attack.
6. The electronic device of claim 1 , wherein the remedial action comprises one or more of: providing a message to a controller; providing a second message to a second access point; or de-authenticating the second electronic device from a wireless local area network (WLAN), so that the second electronic device is disconnected from the WLAN.
7. The electronic device of claim 1 , wherein the information about the router comprises one or more of: an Internet Protocol (IP) address of the router, or specification information for the router.
8. The electronic device of claim 1 , wherein, prior to receiving the control packet, the electronic device is configured to:
receive, at the interface circuit, a router advertisement from the router, wherein the router advertisement is communicated using broadcast communication, and the router advertisement includes the information about the router; and
store the information about the router.
9. The electronic device of claim 1 , wherein the electronic device is further configured to receive, at the interface circuit, an acknowledgment associated with the second electronic device; and
wherein the stored response information further comprises an indication that the acknowledgment was received.
10. The electronic device of claim 1 , wherein the electronic device is further configured to count a number of times that responses addressed to the second electronic device with the information about the router were provided without receiving acknowledgments from the second electronic device; and
wherein the determination that there is malicious activity is based at least in part on the count.
11. A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by the electronic device, cause the electronic device to perform operations, comprising:
receiving, at an interface circuit in the electronic device, a control packet associated with a second electronic device, wherein the control packet comprises a request for information about a router;
accessing the information about the router based at least in part on the control packet;
providing, from the interface circuit, a response addressed to the second electronic device with the information about the router, wherein the response is provided using unicast communication;
storing response information that indicates that the response was provided to the second electronic device;
receiving, at the interface circuit, one or more subsequent control packets associated with the second electronic device, wherein the one or more subsequent control packets comprise the request for the information about the router;
determining that there is malicious activity based at least in part on the one or more subsequent control packets and the response information; and
performing a remedial action.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the control packet comprises a router solicitation.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the router solicitation is compatible with Internet Protocol version 6 (IPv6).
14. The non-transitory computer-readable storage medium of claim 11 , wherein the malicious activity comprises a router-solicitation flood attack.
15. The non-transitory computer-readable storage medium of claim 11 , wherein the remedial action comprises one or more of: providing a message to a controller; providing a second message to a second access point; or de-authenticating the second electronic device from a wireless local area network (WLAN), so that the second electronic device is disconnected from the WLAN.
16. The non-transitory computer-readable storage medium of claim 11 , wherein the information about the router comprises one or more of: an Internet Protocol (IP) address of the router, or specification information for the router.
17. The non-transitory computer-readable storage medium of claim 11 , wherein, prior to receiving the control packet, the operations comprise:
receiving, at the interface circuit, a router advertisement from the router, wherein the router advertisement is communicated using broadcast communication, and the router advertisement includes the information about the router; and
storing the information about the router.
18. The non-transitory computer-readable storage medium of claim 11 , wherein the operations comprise receiving, at the interface circuit, an acknowledgment associated with the second electronic device; and
wherein the stored response information further comprises an indication that the acknowledgment was received.
19. The non-transitory computer-readable storage medium of claim 11 , wherein the operations comprise counting a number of times that responses addressed to the second electronic device with the information about the router were provided without receiving acknowledgments from the second electronic device; and
wherein the determination that there is malicious activity is based at least in part on the count.
20. A method for detecting a router-solicitation flood attack, comprising:
by an electronic device:
receiving, at an interface circuit in the electronic device, a control packet associated with a second electronic device, wherein the control packet comprises a request for information about a router;
accessing the information about the router based at least in part on the control packet;
providing, from the interface circuit, a response addressed to the second electronic device with the information about the router, wherein the response is provided using unicast communication;
storing response information that indicates that the response was provided to the second electronic device;
receiving, at the interface circuit, one or more subsequent control packets associated with the second electronic device, wherein the one or more subsequent control packets comprise the request for the information about the router;
determining that there is malicious activity based at least in part on the one or more subsequent control packets and the response information; and
performing a remedial action.