Methods, systems and computer program products for detecting a spoofed source address in IP datagrams

• US 7,134,012 B2
• Filed: 08/15/2001
• Issued: 11/07/2006
• Est. Priority Date: 08/15/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Doyle, Ronald P., Hind, John R., Peters, Marcia L., Narten, Thomas
• Primary Examiner(s): Louis-Jacques, Jacques
• Assistant Examiner(s): Powers, William S.
• Application Number:
  US09/930,351
• Publication Number:
  US 20030043853A1
• Time in Patent Office: 1,910 Days
• Field of Search: 709220-240, 370389-405, 455/428, 380/49, 380/21, 713150- 4, 713150-154
• US Class Current: 713/151
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Methods, systems and computer program products are provided for determining if a packet has a spoofed source Internet Protocol (IP) address. A source media access control (MAC) address of the packet and the source IP address are evaluated to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet. The packet is determined to have a spoofed source IP address if the evaluation indicates that the source IP address is not bound to the source MAC address. Such an evaluation may be made for packets having a subnet of the source IP address which matches a subnet from which the packet originated.

Claims

1. A method of determining if a packet has a spoofed source Internet Protocol (IP) address, comprising:

evaluating a source media access control (MAC) address of the packet and the source IP address to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet; and

determining that the source IP address is spoofed if the source IP address is not bound to the source MAC address and the source MAC address is not associated with a gateway routing device,

wherein evaluating a source MAC address of the packet and the source IP address further comprises;

identifying an entry in an address resolution protocol (ARP) table corresponding to the source MAC address;

comparing an IP address of the identified entry to the source IP address to determine if the IP address of the identified entry corresponds to the source IP address;

identifying the source IP address as bound to the source MAC address at the source device if the IP address of the identified entry corresponds to the source IP address;

sending an ARP request to the source IP address if no entry in the ARP table is identified as corresponding to the source MAC address; and

incorporating an entry corresponding to the MAC address into the ARP table if a response is received to the ARP request.

2. The method of claim 1, further comprising:

determining if the source MAC address is identified in an ARP table as a MAC address of a routing device to determine if the source MAC address is associated with a gateway routing device.

3. The method of claim 2, wherein determining if the source MAC address is identified in an ARP table is preceded by:

determining if an IP address of a gateway routing device is to be added to a routing table;

sending an ARP request to the IP address of the gateway routing device;

receiving a response to the ARP request that identifies a MAC address of the gateway routing device;

updating the ARP table with the MAC address of the gateway routing device; and

identifying the MAC address in the ARP table as associated with a gateway routing device.

4. The method of claim 1, further comprising:

determining IP addresses associated with the source MAC address in an ARP table;

determining if the IP addresses associated with the source MAC address in the ARP table are associated with a gateway routing device to determine if the source MAC address is associated with a gateway routing device; and

determining that the source IP address is not spoofed if the source MAC address is associated with a gateway routing device.

5. The method of claim 4, wherein determining if the IP addresses associated with the source MAC address in the ARP table are associated with a gateway routing device comprises searching a routing table for the IP addresses to determine if any of the IP addresses are associated with a gateway routing device in the routing table to determine if the source MAC address is associated with a gateway routing device.

6. The method of claim 1, further comprising identifying the source IP address as not bound to the source MAC address if a response is not received to the ARP request.

7. The method of claim 1, further comprising discarding the packet if no entry in the ARP table corresponding to the MAC address has an IP address which corresponds to the source IP address.

8. The method of claim 7, further comprising logging MAC addresses of discarded packets.

9. The method of claim 7, wherein a destination device of the packet comprises a network attached storage device and wherein discarding the packet if no entry in the ARP table corresponding to the MAC address has an IP address which corresponds to the source IP address is carried out so that the packet is not forwarded to an Internet Protocol (IP) layer of the network attached storage device so as to increase the availability of the network attached storage device in the event of a denial of service attack.

10. The method of claim 1, further comprising:

determining if the source IP address is associated with a routing device;

forwarding the packet if the source IP address is associated with a routing device; and

discarding the packet if the source IP address is not associated with a routing device and if no entry in the ARP table corresponding to the MAC address has an IP address which corresponds to the source IP address.

11. The method of claim 1, further comprising discarding the packet if the source MAC address is associated with more than a predefined number of IP addresses.

12. The method of claim 11, wherein the predefined number of IP addresses is associated with the source device.

13. The method of claim 11, wherein the predefined number of IP addresses is associated with a subnet associated with the MAC address.

14. A method of determining if a packet has a spoofed source Internet Protocol (IP) address, comprising:

evaluating a source media access control (MAC) address of the packet and the source IP address to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet;

determining that the source IP address of the packet is spoofed if the source IP address is not bound to the source MAC address; and

discarding the packet if the source IP address is associated with at least one MAC address other than the source MAC address,

wherein evaluating a source MAC address of the packet and the source IP address further comprises;

identifying an entry in an address resolution protocol (ARP) table corresponding to the source MAC address;

comparing an IP address of the identified entry to the source IP address to determine if the IP address of the identified entry corresponds to the source IP address;

identifying the source IP address as bound to the source MAC address at the source device if the IP address of the identified entry corresponds to the source IP address;

sending an ARP request to the source IP address if no entry in the ARP table is identified as corresponding to the source MAC address; and

incorporating an entry corresponding to the MAC address into the ARP table if a response is received to the ARP request.

15. The method of claim 14, further comprising forwarding the packet if the source IP address indicates that the packet is a dynamic host configuration protocol (DHCP) request.

16. The method of claim 15, wherein forwarding the packet comprises forwarding the packet if the source IP address indicates that the packet is a dynamic host configuration protocol (DHCP) request and the contents of the packet indicate that the packet is a DHCP request.

17. The method of claim 14, further comprising notifying a system administrator of a subnet of the source device and the presence of a spoofed source IP address in a packet from the source device when no entry in the ARP table corresponding to the MAC address has an IP address which corresponds to the source IP address.

18. A method of determining if a packet has a spoofed source Internet Protocol (IP) address, comprising:

evaluating a source media access control (MAC) address of the packet and the source IP address to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet;

determining that the source IP address of the packet is spoofed if the source IP address is not bound to the source MAC address;

monitoring packets from a source device to determine if the source device has more IP addresses bound to the MAC address of the source device than a predefined limit; and

identifying the source device as having more IP addresses bound to its MAC address than the predefined limit so as to allow corrective action to be taken to reduce network degradation as a result of a denial of service attack utilizing the spoofed source IP address bound to the MAC address of the source device,

wherein evaluating a source MAC address of the packet and the source IP address further comprises;

identifying an entry in an address resolution protocol (ARP) table corresponding to the source MAC address;

comparing an IP address of the identified entry to the source IP address to determine if the IP address of the identified entry corresponds to the source IP address;

identifying the source IP address as bound to the source MAC address at the source device if the IP address of the identified entry corresponds to the source IP address;

sending an ARP request to the source IP address if no entry in the ARP table is identified as corresponding to the source MAC address; and

incorporating an entry corresponding to the MAC address into the ARP table if a response is received to the ARP request, and

wherein the corrective action to be taken to reduce network degradation as a result of a denial of service attack utilizing the spoofed source IP address bound to the MAC address of the source device comprises discarding packets from the source device and notifying a system administrator that the source has more IP address bound to its MAC address than the predefined limit.

19. The method of claim 18, further comprising establishing the predefined limit based on characteristics of the source device.

20. The method of claim 18, further comprising establishing the predefined limit as a common limit for all devices on a subnet of the source device.

21. A method of determining if a packet has a spoofed source Internet Protocol (IP) address, comprising:

evaluating a source media access control (MAC) address of the packet and the source IP address to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet;

determining that the source IP address of the packet is spoofed if the source IP address is not bound to the source MAC address;

determining if a source IP address is bound to a MAC address of more than one source device; and

identifying the source devices having the IP address bound to the MAC addresses so as to allow corrective action to be taken to reduce network degradation as a result of a denial of service attack utilizing the spoofed source IP address bound to the MAC addresses of the source devices,

wherein evaluating a source MAC address of the packet and the source IP address further comprises;

identifying an entry in an address resolution protocol (ARP) table corresponding to the source MAC address;

comparing an IP address of the identified entry to the source IP address to determine if the IP address of the identified entry corresponds to the source IP address;

identifying the source IP address as bound to the source MAC address at the source device if the IP address of the identified entry corresponds to the source IP address;

sending an ARP request to the source IP address if no entry in the ARP table is identified as corresponding to the source MAC address; and

incorporating an entry corresponding to the MAC address into the ARP table if a response is received to the ARP request.

22. The method of claim 21, wherein the corrective action to be taken to reduce network degradation as a result of a denial of service attack utilizing the spoofed source IP address bound to the MAC addresses of the source devices comprises discarding packets from the source device.

23. The method of claim 21, wherein the corrective action to be taken to reduce network degradation as a result of a denial of service attack utilizing the spoofed source IP address bound to the MAC addresses of the source devices comprises notifying a system administrator that the IP address is bound to MAC addresses of more than one source device.