Cisco Technology, Inc.

Silviu Dobrota

Adam James Sweeney

Premkumar Jonnala

Dehua Huang

Pradeep S Sudame

Neha M Shah

Sivakumar Narayanan

Richard A Johnson

Marco E Foschiano

Protocol status information is used to perform traffic filtering by dropping messages that are not consistent with the protocol status information. In one embodiment, a method involves comparing message information and protocol status information. The message information is associated with a first message. The protocol status information is obtained in response to one or more second messages, which are conveyed according to a protocol used to assign network addresses to clients. The method also involves determining whether to discard the first message, based on an outcome of the comparison of the message information and the protocol status information. For example, it can be determined that the first message should be discarded, if the message information does not match the protocol status information.

System and method for filtering network traffic

A method of protecting a data network from denial of service (DOS) attacks is described. The method may use various network tools to selectively block or disable portions of a data trunk experiencing a DOS attack, thereby preventing the DOS attack from reaching at least some resources on the network. In one embodiment, a network switch identifies a virtual LAN (VLAN) carrying suspect data on a data trunk. The network switch then adjusts a spanning tree for the network so that one or more ports on the compromised VLAN are blocked or disabled, while non-compromised VLANs are allowed to continue carrying data. Other approaches are also presented for avoiding the loss of valid data when a network blocks one or more VLANs or other portions of a network in response to a DOS attack or other intrusion.

Method and apparatus for preventing DOS attacks on trunk interfaces

Users are allowed to specify per-interface rate limits for inter-layer binding protocol traffic. If the user-specified rate limit is exceeded on a given interface, inter-layer binding protocol messages received via that interface are caused to be dropped (e.g., by selectively dropping ILBP messages, or by simply shutting down the interface). If the rate is not exceeded, inter-layer binding protocol messages received via that interface can be validated (e.g., by comparing an inter-layer binding included in the body of an inter-layer binding protocol message to protocol status information obtained by snooping protocol messages). If the inter-layer binding does not match the protocol status information, the inter-layer binding protocol message is dropped. If a match is found, the inter-layer binding protocol message is allowed to be forwarded normally. Such systems and methods may be used to inhibit various undesirable network behavior, such as man-in-the-middle attacks.

System and method for performing security actions for inter-layer binding protocol traffic

A method may involve: maintaining protocol status information for a network protocol, where the protocol status information includes protocol information generated by a protocol server and network traffic information indicative of how messages are conveyed from the protocol client to a network, and updating the protocol status information in response to intercepting a protocol message being conveyed between a protocol client and a protocol server. For example, the network protocol can be DHCP (Dynamic Host Configuration Protocol) and the protocol status information can be updated to include an IP (Internet Protocol) address assigned to the protocol client by the protocol server in the protocol message. Such a method may inhibit the misuse of one or more network protocols and/or attacks on protocol servers.

Growing community of inventors

San Jose, CA, United States of America

Silviu Dobrota