IPv4, IPv6, and ARP spoofing protection method
A method of detecting address spoofing includes receiving an ARP packet at a network device. The ARP packet includes a first address associated with a first network layer and a second address associated with a second network layer. The method also includes accessing a first memory searchable by the first address to obtain a memory reference and retrieving a third address associated with the second network layer from a second memory using the memory reference. The method further includes comparing the second address with the third address and detecting address spoofing if a match is not present between the second address and the third address.
1. A method of detecting address spoofing in a network packet, the method comprising:
receiving, at a Layer 3 device, a network packet having a first source address that is associated with a first network layer and a source IP address that is associated with a second network layer;
retrieving a destination MAC address by performing a lookup in a Layer 3 table that associates the source IP address with a next hop destination route entry, wherein the next hop destination route entry points to the destination MAC address;
determining a source MAC address corresponding to the source IP address for the network packet using the retrieved destination MAC address; and
comparing the determined source MAC address to the first source address of the network packet to detect address spoofing when the determined source MAC address fails to match the first source address of the network packet.
2. The method of claim 1 further comprising generating an alarm indicating the presence of a spoofing attack if a match is not present.
3. The method of claim 1 wherein the first network layer is Layer 2 and the second network layer is Layer 3.
4. The method of claim 1 , wherein the Layer 3 device comprises at least one of a Layer 3 router or a Layer 3 switch.
5. A network device comprising:
an ingress port configured to receive a network packet having a first source address that is associated with a first network layer and a source IP address that is associated with a second network layer;
a memory interface configured to:
retrieve a destination MAC address through a lookup in a Layer 3 table that associates the source IP address with a next hop destination route entry, wherein the next hop destination route entry points to the destination MAC address; and
determine a source MAC address corresponding to the source IP address for the network packet using the retrieved destination MAC address; and
a comparator configured to compare the determined source MAC address to the determined first source address of the network packet to detect address spoofing when the determined source MAC address fails to match the first source address of the network packet.
6. The network device of claim 5 further comprising an address spoofing detector configured to detect address spoofing if a match is not present.
7. The network device of claim 5 wherein the memory interface is further configured to determine the source MAC address corresponding to the source IP address using the retrieved destination MAC address in order to identify the source MAC address without looking up Layer 2 the first source address of the network packet.
8. The network device of claim 7 wherein the first source address is included in at least one of an ARP packet MAC header or an ARP packet payload.
9. The network device of claim 5 wherein the memory interface accesses a first memory and a second memory.
10. The network device of claim 5 , wherein the network device is at least one of a Layer 3 router or a Layer 3 switch.
11. The method of claim 1 , wherein the next hop destination route entry comprises port information related to a next hop destination device and a pointer that points to the destination MAC address.
12. The network device of claim 5 , wherein the next hop destination route entry comprises port information related to a next hop destination device.