Changeoption82
option82 时间:2021-04-04 阅读:()
2009InfosysTechnologiesLimitedSANOGXIV2009InfosysTechnologiesLimitedSANOGXIVTacklingSpoofingAttacksinBroadbandAccessNetworksBharatJoshi(bharat_joshi@infosys.
com)PavanKurapati(pavan_kurapati@infosys.
com)RamakrishnaRaoDTV(ramakrishnadtv@infosys.
com)2009InfosysTechnologiesLimitedSANOGXIVAgendaSpoofing–What,WhyandHowTypesofuserconnectionsinBroadbandAccessConcentratorsTypesofspoofingHowtocollectdatatodoAnti-spoofinginAccessNetworkAnti-spoofingHowtorecoveranti-spoofingdataafterBACcrash/reboot2009InfosysTechnologiesLimitedSANOGXIVWhatisSpoofiingSpoofingisaprocesswherebyoneentitymasqueradesasanotherentityWhyisspoofingdoneSpoofingAbyBisdoneforvariouspurposesBseekstheprivilegesofABintendstohideitstracksAsanattackonAHowisspoofingdoneWeshallseeincomingslides2009InfosysTechnologiesLimitedSANOGXIVTheultimategoalofspoofingUnauthorizedServiceGetserviceonsomeoneelse'sexpenseLossofServiceonTargetMakesurethatthetargetdoesnotgetanyserviceDifficulttotracetheattackerMakesurethatpeoplecannotfindwhoattackedthem.
UnnecessarypacketscloggingthenetworkMakesurethatnobodygetsagoodservice.
SecondaryvictimPrimarytargetrespondstospoofpacketandoverwhelmthesourcewhichbecomessecondaryvictim.
2009InfosysTechnologiesLimitedSANOGXIVTypesofuserconnectionsforanIPbasedDSLAMBridgedIPRoutingRFC2684basedbridgedencapsulationbetweenEndUserandDSLAMDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fDynamicIPallocationusingDHCPPPPoE/APPPterminationinDSLAMIPallocationfromlocalpoolDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fIPoARFC2684basedroutedencapsulationbetweenEndUserandDSLAMDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fDynamicIPallocationusingDHCPL3DSLAMxDSLHomeHubxDSLHomeHubMPLSCloudPEPRouterPRouterBRASL3n/wDataCenterL3DSLAMInternetservices2009InfosysTechnologiesLimitedSANOGXIV6DSLAML3AxDSLHomeHubL3n/wDHCP2UnicastDISCOVER+Option82populatedwithRemote-ID/Circuit-ID1BroadcastDHCPDISCOVERUnicastDHCPOFFERwithoption82echoed3SendDHCPOFFERtothehostafterremovingoption8246UnicastREQUEST+Option82populatedwithRemote-ID/Circuit-ID5BroadcastDHCPREQUESTUnicastDHCPACKtotheclientwithoption827SendDHCPACKtothehostafterremovingoption828AddressallocationmechanismsforIPDSLAM–DHCP2009InfosysTechnologiesLimitedSANOGXIVTypesofuserconnectionsforaLayer2DSLAM1:1VLANsMapeveryuserconnectiontooneunique802.
1qbasedVLANNoneedofanyMAClearningofindividualhostsDownstreamtrafficmappingdonebasedonVLANsQinQorStackedVLANsAnouterServiceVLANidentifyingaspecificserviceisaddedDownstreammappingdonebasedoncombinationofCVLANandSVLANN:1TransparentBridgedVLANsMultipleusersmappedtoacommonVLANDownstreammappingdonebasedonVLANandDstMACcombinationMAClearningisrequiredforoperationL2DSLAMxDSLHomeHubxDSLHomeHubMPLSCloudPEPRouterPRouterBRASAccessAggregationDataCenterL2DSLAMInternetservices2009InfosysTechnologiesLimitedSANOGXIV8DSLAML2RAxDSLHomeHubBRASL3RAMetroDHCP2BroadcastDISCOVER+Option82populatedwithRemote-ID/Circuit-ID1BroadcastDHCPDISCOVER3UnicastDISCOVERwith'giaddr'populatedUnicastDHCPOFFERwithoption82echoed45BroadcastDHCPOFFERwithoption82andwithout'giaddr'SendDHCPOFFERtothehostafterremovingoption8268BroadcastREQUEST+Option82populatedwithRemote-ID/Circuit-ID7BroadcastDHCPREQUEST9UnicastREQUESTwith'giaddr'populatedUnicastDHCPACKtotheclientwithoption8210SendDHCPACKtothehostafterremovingoption8211AddressallocationmechanismsforL2DSLAM–DHCP2009InfosysTechnologiesLimitedSANOGXIV9DSLAML2RAxDSLHomeHubBRASL3RAMetroDHCPRADIUSPortEnabled1EAPOLStart2IdentityRequest3IdentityResponse4IdentityDetails5EAPMD5Challenge6MD5ChallengeResponse7AuthSuccess8AuthSuccess9DHCPAuthentication&AddressallocationmechanismsforL2DSLAM–DHCP+802.
1x2009InfosysTechnologiesLimitedSANOGXIV10DSLAMxDSLHomeHubBRASMetroRADIUS2PADI+IntermediateAgentpopulatedwithRemote-ID/Circuit-ID1PADIPADO+IntermediateAgentechoed35PADR6PADR+IntermediateAgentpopulatedwithRemote-ID/Circuit-IDPADS+IntermediateAgentechoed79PPPNegotiationsAuthentication&AddressallocationmechanismsforL2DSLAM-PPPoEPADOafterremovingagentinformationoption4PADSafterremovingagentinformationoption82009InfosysTechnologiesLimitedSANOGXIVTypeofSpoofingMACSpoofingIPSpoofingARPSpoofingControlprotocolinternalheaderspoofingPPPoEsession-idspoofingDHCPchaddr,ciaddr,relay-agent-informationoptionspoofing2009InfosysTechnologiesLimitedSANOGXIV12DSLAMAttackerChangeSrcMACaddressandfloodtrafficSimulates1000sofMACaddressatfasterratexDSLMACTablemaximumlimitreachedLegitimatetrafficdroppedduetoMACtableexhaustionChangingSourceMACaddresstoanillegitimateaddressAttackerxDSLMACI/FB2A2FloodtrafficwithbothMACAandMACBMACBLegitimatetrafficblockedMACAMACspoofing2009InfosysTechnologiesLimitedSANOGXIVIPspoofingChangingSourceIPaddresstoanillegitimateaddressAttackerxDSLIPBDoSattackonIPAIPASendtrafficwithIPAandMACBRepliesfloodedtoIPA12PingofDeathServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVARPspoofingRespond/sendARPResponsewithillegitimateIPaddressABCDARP:WhoisIPB1ARPReply:IamIPB:MACA2IPMACAABATrafficflowingtohostAARPTableABCDGratuitousARP:IamIPB:MACA1IPMACAABATrafficflowingtohostAARPTableServiceProvider'sNetworkServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVDHCPHeaderDHCPHeaderspoofingOp(1)Htype(1)Hlen(1)Hops(1)Xid(4)Secs(2)Flags(2)Ciaddr(4)Yiaddr(4)Siaddr(4)Giaddr(4)Chaddr(16)Sname(64)File(128)Options(Variable)ClientIdenrtifierRelayAgentOptionDSLAMAttackerxDSLL2RAL3RADHCPServerABDHCPRelease:MACB:SrcIP:BChaddr:A2Spoof'chaddr'fieldDHCPRelease:MACB:SrcIP:BClientId:A3Spoof'ClientIdentifier'fieldDHCPRelease:MACB:SrcIP:BOption82RemoteId:A4SpoofOption82fieldChangingInternalfieldswithinDHCPheaderDHCPRelease:MACB:SrcIP:BCiaddr:A1Spoof'ciaddr'field2009InfosysTechnologiesLimitedSANOGXIVSimilarlyPPPoESession-IDfieldidentifiesauniquesession.
SpoofingthiscanalsocauseservicedisruptionPPPoEHeaderPPPoEHeaderspoofingVERTYPECODESESSION_IDLENGTHPAYLOADChangingSESSION_IDfieldinPPPoEHeaderAttackerxDSLIPBIPAPPPoEIABRAS1PADT:SESSION_ID:ASessionDisconnectedServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVAnti-spoofingWhatisanti-spoofingMechanismtoidentifyspoofingandstoppingit.
Howanti-spoofingisdoneBydroppingthespoofedpacketsHowtoidentifythespoofedpacketsByverifyingIPAddressofthereceivedpacket.
ByverifyingMACaddressofthereceivedpacket.
ByverifyingthecombinationofIPandMACaddressforagiveninterfaceByverifyingtheIPaddress,MACaddressandothersessionbasedidentificationintheprotocolheader.
2009InfosysTechnologiesLimitedSANOGXIVDatarequiredforAnti-spoofingForeachuserconnectionListofValidIPaddressesassignedListofValidMACaddressesandifpossiblethecombinationofMACandIPaddresses,TimeforwhicheachIPaddressisvalid.
2009InfosysTechnologiesLimitedSANOGXIVWhyanti-spoofinginBroadbandAccessConcentrator(BAC)BACisattherightplace:Itknowsalltherequiredinformationtodoanti-spoofing.
Anti-spoofingbecomesdifficultandlesseffectiveifitisnotdoneasnearthesourceaspossible.
Itisnotonlyimportanttodropspoofedpackets,itisimportanttodropthemasearlyaspossible.
2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC-PPPoE1xDSLHomeHubBRASL3RAMetroRADIUS2PADIPADO34PADRPADSBACObtainSession-IDfromPADSIPMACSession-IDI/FAA1011BB1022PPPLCPPPPIPCPBACObtainIPinformationfromIPCP567PADTBACDeletethespoofingentry2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC-DHCPxDSLHomeHubBRASL3RAMetroDHCPIPMACLeaseI/FAA2001BB120212DHCPDISCOVERDHCPOFFER34DHCPREQUESTDHCPACKBACObtainIP/MAC/LeasetimefromDHCPACKMessage6DHCPRELEASEBACRemovetheentryfromtableLeaseEXPIREBACRemovetheentryfromtable2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC–802.
1x+DHCP1xDSLHomeHubBRASL3RAMetroDHCP2InitialEAPNegotiationsEAPAuthSuccess34DHCPMessageexchangeDHCPACKBACObtaintheMACaddressfromEAPAuthSuccessmessageIPMACLeaseI/FAA2001BB1202RADIUSBACObtainIP&LeasetimefromDHCPACKMessage2009InfosysTechnologiesLimitedSANOGXIVMACAntispoofingDSLAMAttackerAttackerxDSLMACI/FB2A1FloodtrafficwithbothMACAandMACBMACBNoImpactonAMACAMACBIPMACLeaseI/FBB1202Floodtrafficwith1000'sofSrcMACsinadditiontoMACBCompareAntispooftableanddiscardnonmatchingentriesNoMACtableExhaustion!
MACI/FB2MACTableAntiSpoofTableIPMACLeaseI/FAA2001BB1202CompareAntispooftableanddiscardnonmatchingentriesNospoofingofNeighbor'sMAC!
2009InfosysTechnologiesLimitedSANOGXIVIPAntispoofingAttackerxDSLIPBNoImpactonAIPASendtrafficwithIPAandMACB1IPMACLeaseI/FAA2001BB1202CompareIPagainstthei/finAntispooftableMetro2009InfosysTechnologiesLimitedSANOGXIVARPAntispoofingABCDARP:WhoisIPB1ARPReply:IamIPB:MACA2IPMACAABBARPTableABCDGratuitousARP:IamIPB:MACA1IPMACAABBARPTableIPMACLeaseI/FAA2001BB1202CompareIP/MACagainstthei/finAntispooftableIPMACLeaseI/FAA2001BB1202ServiceProviderN/wServiceProviderN/w2009InfosysTechnologiesLimitedSANOGXIVDHCPHeaderAntispoofingDSLAMAttackerxDSLL2RAL3RADHCPServerABDHCPRelease:MACB:SrcIP:BChaddr:A1AntiSpooffilterdiscardDHCPRelease:MACB:SrcIP:BOption82RemoteId:A3Option82fromuntrustedentity.
DiscardIPMACLeaseI/FAA2001BB1202InspectDHCPHeader&comparechaddr&ClientIDwithantispooftableAcceptDHCPwithoption82onlyifitiscomingfromtrustedentityDHCPRelease:MACB:SrcIP:BCiaddr:A2AntiSpooffilterdiscard2009InfosysTechnologiesLimitedSANOGXIVPPPoEHeaderAntispoofingAttackerxDSLIPBIPAPPPoEIABRAS1PADT:SESSION_ID:101IPMACSession-IDI/FAA1011BB1022SessionIDdoesnotmatchNoImpactonAMetro2009InfosysTechnologiesLimitedSANOGXIVLosingdatacollectedforanti-spoofingDatausedinAntispoofingcanbelostduetovariousreasonsPlannedrebootSoftwarecrashPowerfailureReplacementofsystemSoftwareupgrade2009InfosysTechnologiesLimitedSANOGXIVHowtorecoverlostdataStaticconfigurationRequiredDataisavailableintheconfiguration.
PPPoEForPPPoE,thekeep-alivetimersareconfiguredandthesessionisre-initiatediftherearenorepliestothekeep-alivemessagesDHCPDHCPdoesnothavekeepalivemechanisminplace.
DHCPhasa'leasetime'whichisusuallyinorderof'days'.
Howtorecoverfromthissituation2009InfosysTechnologiesLimitedSANOGXIVRecoveringLeaseinformationforDHCPStableStorage:NotveryusefulasnotmanyBACssupportstablestorage.
LimitederasecyclesisalsoabottleneckinthisapproachBroadcastARPs:NeedtowaitfordownstreamtraffictoarriveandinitiateARPrequests.
Willincreasethedelay.
Cannotgetthecompleteinformationinonerequest.
PronetospoofingattacksifamalicioususerrepliestotheARPrequest.
RedundantcontrollersBACcanhaveredundantcontrollersandupononecontrollercrash,theothercontrollercantakeoverwithpre-synchedleasedata.
Notsuitableforpowerfailurescenariosorforupgrades.
Havingredundantcontrollersalsoaddtohardwarecosts2009InfosysTechnologiesLimitedSANOGXIVRecoveringLeaseinformationforDHCPQuerythroughSNMP/LDAPCurrentlynostandardMIBsareavailableforDHCPleaseinformation.
BACstypicallydonotsupportSNMPclientinterfacesQueryleaseinformationfromDHCPserverSolvesmostoftheproblemsstatedabove2009InfosysTechnologiesLimitedSANOGXIVLeasequeryforDHCP(RFC4388)RFC4388introducedanewDHCPrequestLeasequerywhichaBACcanusetoqueryDHCPservertoobtainleaseinformation.
ThreetypesofqueriesaresupportedQuerybyIPaddressOnlyIPaddressispopulatedinthequerymessage.
QuerybyMACaddressOnlyMACaddressispopulatedinthequerymessage.
Ifmorethanoneleaseisavailable,thencorrespondingIPaddressesarereturnedinassociated-ipoption.
BACthengetsadditionaldatabygeneratingquerybyIPaddress.
QuerybyClientidentifierOnlyclientidentifieroptionispopulatedinthequerymessage.
Ifmorethanoneleaseisavailable,thencorrespondingIPaddressesarereturnedinassociated-ipoption.
BACthengetstheadditionaldatabyqueryingbyIPaddress.
2009InfosysTechnologiesLimitedSANOGXIVLeasequeryforDHCP(RFC4388)Threetypesofreplymessagetypesareintroduced:DHCPLEASEACTIVEWhenDHCPserverknowsaboutthequeryidentifier.
DHCPLEASEUNKNOWN:WhenDHCPserverdoesnotknowaboutthequeryidentifier.
AnAccessConcentratorcachethisinformationsothatthiscanbeusedtoavoidgeneratingLeaseQueryforthequeryidentifier.
ThisisknownasNegativeCaching.
DHCPLEASEUNASSIGNED:WhenDHCPserverdoesmanagethequeryidentifierbutnoleaseisyetassigned.
NegativeCachingisdoneforthisresponseaswell.
2009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven34DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1MACIPLeaseI/fM1192.
168.
1.
2T1I1AntiSpoofTable123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven35DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerCRASHMACIPLeaseI/fAntiSpoofTable123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven36DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServer1DataTrafficfrom192.
168.
1.
22LeaseQuerybyIPAddress3LeaseActiveM1,T1,I1MACIPLeaseI/fM1192.
168.
1.
2T1I1AntiSpoofTable4DataTrafficfrom192.
168.
1.
25123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching37xDSLHomeHubServiceProviderNetworkDHCPServerCRASH123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching381DataTrafficfrom192.
168.
1.
102LeaseQuerybyIPAddressNegativeCachingxDSLHomeHubServiceProviderNetworkDHCPServer123MACIPThresholdI/fM1192.
168.
1.
10T1I13LeaseUNKNOWN182.
168.
1.
10,M14I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching392DataTrafficfrom192.
168.
1.
103LeaseQuerybyIPAddressNegativeCachingxDSLHomeHubServiceProviderNetworkDHCPServer123MACIPThresholdI/fM1192.
168.
1.
10T1I14LeaseUNKNOWN182.
168.
1.
10,M1Thresholdexpired1I12009InfosysTechnologiesLimitedSANOGXIVIssueswithRFC4388basedleasequeryExistingLeasequerymechanismisdatadriven:LeasequeryisinitiatedonlywhenAccessConcentratorsreceivesdataExistingmethodsuggeststheuseofnegativecaching.
NegativeCachingconsumeslotofresourcesunderspoofattacks.
Resultsinincreasedoutagetimefortheclients.
2009InfosysTechnologiesLimitedSANOGXIVIssueswithRFC4388basedleasequery(contd.
.
)Gettingconsolidatedleaseinformationperconnectionisnotpossible:Existingmechanismdoesn'thaveanymethodstogetconsolidatedleaseinformationforalltheclientsbelongingtoaconnection/circuitMultipleclientscanresideforagivenconnection/circuit.
IfAccessconcentratorhasleaseinformationofalltheclientsforagivenconnection/circuit,anti-spoofingcanbedoneindataplane(fastpath)2009InfosysTechnologiesLimitedSANOGXIVQuerybyremote-idRemote-IDsuboptionidentifyiesaconnection/circuituniquely.
ThisisgloballyuniqueidentifierRemote-IDcanbetrustedastheyarecreatedbyRelayAgent.
AccessConcentratorneednotwaitforthetraffictoarriveandcangenerateLeaseQueryassoonasitcomesupafterareboot.
DHCPServercanprovideconsolidatedLeaseInformationforaspecificconnection/circuit.
Oncealltheleaseinformationforagivenconnection/circuitisobtained,anti-spoofingcanbedoneindataplane(fastpath).
NoneedforNegativeCaching.
2009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId43xDSLHomeHubServiceProviderNetworkDHCPServer123M1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1M3192.
168.
1.
10T3I1MACIPLeaseI/fAntiSpoofTableI12009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId44xDSLHomeHubServiceProviderNetworkDHCPServerCRASH123MACIPLeaseI/fAntiSpoofTableI12009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId451LeaseQuerybyRemoteIdforI12LeaseActiveofallthreeleases*3DataTrafficfrom192.
168.
1.
8xDSLHomeHubServiceProviderNetworkDHCPServer123M1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1M3192.
168.
1.
10T3I1MACIPLeaseI/fAntiSpoofTable4DataTrafficfrom192.
168.
1.
8BACdoesnotneedtowaitforthetraffictoinitiateLQLeasequerybyremote-idresultsinobtainingcompleteinformationonagiveninterface.
NoneedofinitiatingsubsequentqueriesI1*Leaseactiveforoneleaseisreturnedfollowedbyassociated-IPoption.
ThisresultsinsubsequentquerybyIPforremainingleases2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:ServeridentifiesaLeasequerybyremote-idwhentheleasequerymessagehas:Chaddr,siaddr,Ciaddr,htype,hlenandchaddriszeroandClientidentifieroptionisnotpresentandOption82withonlyRemote-Idsub-optionispresent.
SendsaLEASEACTIVEpopulatingtheciaddrwiththeIPaddressthatwasmostrecentlyaccessedbytheclient.
AllotherIPaddressesarereturnedinAssociated-IPoption.
RelayagentthensendsaLeasequerywith"QuerybyIPAddress"foralltheadditionalIPaddressesreturnedinAssociated-ipoption.
2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:ServermayreturnaLEASEUNASSIGNEDifitknowsitmanagestheleasefortheconnectionidentifiedbyRemote-Idsub-optionbutnoleaseisassignedyet.
ServermayreturnLEASEUNKNOWNifitdoesnotknowthecorrespondingRemote-idsub-option.
2009InfosysTechnologiesLimitedSANOGXIVWhyBulkLeasequeryTraditionalleasequery(Both4388)andleasequerybyremote-idworksontheprincipleofretrievingoneleaseatatimeWhilequerybyremote-idsolvesalltheproblemsassociatedwithRFC4388basedleasequerymechanism,itstillinvolvesgeneratinghugenumberofleasequeriestogetallthepossibledataBulkleasequeryworksontheprincipleofestablishingTCPconnectionbetweenRAandServerandretrievinginformationinbulk2009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery49DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerMACIPAddressLeaseTimeInterfaceM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I2M3192.
168.
1.
3T2I3I1I2I32009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery50DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerCRASHI1I2I3MACIPLeaseI/f2009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery51DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerMACIPAddressLeaseTimeInterfaceM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I2M3192.
168.
1.
3T2I33DataTrafficfrom192.
168.
1.
81BulkLeaseQueryinaTCPSession2LeaseActiveofallleases4DataTrafficfrom192.
168.
1.
8LeaseinformationofallinterfacesobtainedininonequeryI1I2I32009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServer1TCPSession2BulkLeaseQuerywithXID23LEASEQUERYACTIVEforXID24LEASEQUERYACTIVEforXID25LEASEQUERYACTIVEforXID26LEASEQUERYDONEforXID27TCPsessionclose2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:AQuerier(TypicallyaRelayAgent)establishesaTCPconnectionwiththeserveronport67.
Twonewquerytypesareadded"QuerybyRelay-ID"whererelay-idisauniqueRelayagentIdentifier.
AllleasesallocatedthroughaspecificRelayAgent.
"QueryforallconfiguredIPs"whereallIPaddressheldbyDHCPServerirrespectiveofstateisreturned.
Inthiscase,unassignedIPaddressesarereturnedwithUNASSIGNEDstate.
Newfiltersareadded:StartandEndtimefiltercanbepassedtoretrieveleasesforwhichstatehaschangedwithinthespecifiedtime.
Otherquerytypes(QuerybyIPAddress,MACaddress,Client-IDandremote-id)arealsosupported.
2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:UponreceivingaBULKLEASEQUERY,DHCPservergeneratesastreamofLEASEACTIVEforeachleasethatfulfilsthequery.
EndofleaseforagivenqueryisindicatedbytheLEASEQUERYDONEmessage.
MultipleBulkLeasequerycanbeinitiatedoverasingleTCPconnection.
Transactionid(XID)isusedtodistinguishbetweentherepliesformultiplequeries.
2009InfosysTechnologiesLimitedSANOGXIVStandardizationandImplementationeffortsStandardizationefforts:Querybyremote-idandBulkLeaseQuerydraftisbeingstandardizedinDHCworkinggroupofIETF.
Implementationefforts:WehavecreatedaProof-Of-Conceptimplementationof'QuerybyRemote-Id'and'BulkLeaseQuery'byenhancingISCDHCPserver.
2009InfosysTechnologiesLimitedSANOGXIVReferences:S.
Bellovin,"SecurityproblemsintheTCP/IPprotocolsuite,"SIGCOMMComputerCommunicationReview,vol.
19,no.
2,pp.
32–48,1989.
R.
BeverlyandS.
Bauer,"Thespooferproject:inferringtheextentofsourceaddressfilteringontheinternet,"inSRUTI'05:Proc.
oftheStepstoReducingUnwantedTrafficontheInternet,2005.
IETFStandards:RFC2131,DynamicHostConfigurationProtocolLayer2RelayAgenthttp://www.
ietf.
org/id/draft-ietf-dhc-l2ra-04.
txthttp://www.
ietf.
org/id/draft-ietf-dhc-l2ra-extensions-01.
txtQuerybyremote-idhttp://www.
ietf.
org/id/draft-ietf-dhc-leasequery-by-remote-id-02.
txtBulkleasequeryhttp://www.
ietf.
org/id/draft-ietf-dhc-dhcpv4-bulk-leasequery-00.
txtTR-101fromBroadbandForumhttp://www.
broadband-forum.
org/technical/download/TR-101.
pdf2009InfosysTechnologiesLimitedSANOGXIV2009InfosysTechnologiesLimitedSANOGXIVThankYou
com)PavanKurapati(pavan_kurapati@infosys.
com)RamakrishnaRaoDTV(ramakrishnadtv@infosys.
com)2009InfosysTechnologiesLimitedSANOGXIVAgendaSpoofing–What,WhyandHowTypesofuserconnectionsinBroadbandAccessConcentratorsTypesofspoofingHowtocollectdatatodoAnti-spoofinginAccessNetworkAnti-spoofingHowtorecoveranti-spoofingdataafterBACcrash/reboot2009InfosysTechnologiesLimitedSANOGXIVWhatisSpoofiingSpoofingisaprocesswherebyoneentitymasqueradesasanotherentityWhyisspoofingdoneSpoofingAbyBisdoneforvariouspurposesBseekstheprivilegesofABintendstohideitstracksAsanattackonAHowisspoofingdoneWeshallseeincomingslides2009InfosysTechnologiesLimitedSANOGXIVTheultimategoalofspoofingUnauthorizedServiceGetserviceonsomeoneelse'sexpenseLossofServiceonTargetMakesurethatthetargetdoesnotgetanyserviceDifficulttotracetheattackerMakesurethatpeoplecannotfindwhoattackedthem.
UnnecessarypacketscloggingthenetworkMakesurethatnobodygetsagoodservice.
SecondaryvictimPrimarytargetrespondstospoofpacketandoverwhelmthesourcewhichbecomessecondaryvictim.
2009InfosysTechnologiesLimitedSANOGXIVTypesofuserconnectionsforanIPbasedDSLAMBridgedIPRoutingRFC2684basedbridgedencapsulationbetweenEndUserandDSLAMDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fDynamicIPallocationusingDHCPPPPoE/APPPterminationinDSLAMIPallocationfromlocalpoolDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fIPoARFC2684basedroutedencapsulationbetweenEndUserandDSLAMDSLAMinroutingmodewithroutedVLANsconfiguredonuplinki/fDynamicIPallocationusingDHCPL3DSLAMxDSLHomeHubxDSLHomeHubMPLSCloudPEPRouterPRouterBRASL3n/wDataCenterL3DSLAMInternetservices2009InfosysTechnologiesLimitedSANOGXIV6DSLAML3AxDSLHomeHubL3n/wDHCP2UnicastDISCOVER+Option82populatedwithRemote-ID/Circuit-ID1BroadcastDHCPDISCOVERUnicastDHCPOFFERwithoption82echoed3SendDHCPOFFERtothehostafterremovingoption8246UnicastREQUEST+Option82populatedwithRemote-ID/Circuit-ID5BroadcastDHCPREQUESTUnicastDHCPACKtotheclientwithoption827SendDHCPACKtothehostafterremovingoption828AddressallocationmechanismsforIPDSLAM–DHCP2009InfosysTechnologiesLimitedSANOGXIVTypesofuserconnectionsforaLayer2DSLAM1:1VLANsMapeveryuserconnectiontooneunique802.
1qbasedVLANNoneedofanyMAClearningofindividualhostsDownstreamtrafficmappingdonebasedonVLANsQinQorStackedVLANsAnouterServiceVLANidentifyingaspecificserviceisaddedDownstreammappingdonebasedoncombinationofCVLANandSVLANN:1TransparentBridgedVLANsMultipleusersmappedtoacommonVLANDownstreammappingdonebasedonVLANandDstMACcombinationMAClearningisrequiredforoperationL2DSLAMxDSLHomeHubxDSLHomeHubMPLSCloudPEPRouterPRouterBRASAccessAggregationDataCenterL2DSLAMInternetservices2009InfosysTechnologiesLimitedSANOGXIV8DSLAML2RAxDSLHomeHubBRASL3RAMetroDHCP2BroadcastDISCOVER+Option82populatedwithRemote-ID/Circuit-ID1BroadcastDHCPDISCOVER3UnicastDISCOVERwith'giaddr'populatedUnicastDHCPOFFERwithoption82echoed45BroadcastDHCPOFFERwithoption82andwithout'giaddr'SendDHCPOFFERtothehostafterremovingoption8268BroadcastREQUEST+Option82populatedwithRemote-ID/Circuit-ID7BroadcastDHCPREQUEST9UnicastREQUESTwith'giaddr'populatedUnicastDHCPACKtotheclientwithoption8210SendDHCPACKtothehostafterremovingoption8211AddressallocationmechanismsforL2DSLAM–DHCP2009InfosysTechnologiesLimitedSANOGXIV9DSLAML2RAxDSLHomeHubBRASL3RAMetroDHCPRADIUSPortEnabled1EAPOLStart2IdentityRequest3IdentityResponse4IdentityDetails5EAPMD5Challenge6MD5ChallengeResponse7AuthSuccess8AuthSuccess9DHCPAuthentication&AddressallocationmechanismsforL2DSLAM–DHCP+802.
1x2009InfosysTechnologiesLimitedSANOGXIV10DSLAMxDSLHomeHubBRASMetroRADIUS2PADI+IntermediateAgentpopulatedwithRemote-ID/Circuit-ID1PADIPADO+IntermediateAgentechoed35PADR6PADR+IntermediateAgentpopulatedwithRemote-ID/Circuit-IDPADS+IntermediateAgentechoed79PPPNegotiationsAuthentication&AddressallocationmechanismsforL2DSLAM-PPPoEPADOafterremovingagentinformationoption4PADSafterremovingagentinformationoption82009InfosysTechnologiesLimitedSANOGXIVTypeofSpoofingMACSpoofingIPSpoofingARPSpoofingControlprotocolinternalheaderspoofingPPPoEsession-idspoofingDHCPchaddr,ciaddr,relay-agent-informationoptionspoofing2009InfosysTechnologiesLimitedSANOGXIV12DSLAMAttackerChangeSrcMACaddressandfloodtrafficSimulates1000sofMACaddressatfasterratexDSLMACTablemaximumlimitreachedLegitimatetrafficdroppedduetoMACtableexhaustionChangingSourceMACaddresstoanillegitimateaddressAttackerxDSLMACI/FB2A2FloodtrafficwithbothMACAandMACBMACBLegitimatetrafficblockedMACAMACspoofing2009InfosysTechnologiesLimitedSANOGXIVIPspoofingChangingSourceIPaddresstoanillegitimateaddressAttackerxDSLIPBDoSattackonIPAIPASendtrafficwithIPAandMACBRepliesfloodedtoIPA12PingofDeathServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVARPspoofingRespond/sendARPResponsewithillegitimateIPaddressABCDARP:WhoisIPB1ARPReply:IamIPB:MACA2IPMACAABATrafficflowingtohostAARPTableABCDGratuitousARP:IamIPB:MACA1IPMACAABATrafficflowingtohostAARPTableServiceProvider'sNetworkServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVDHCPHeaderDHCPHeaderspoofingOp(1)Htype(1)Hlen(1)Hops(1)Xid(4)Secs(2)Flags(2)Ciaddr(4)Yiaddr(4)Siaddr(4)Giaddr(4)Chaddr(16)Sname(64)File(128)Options(Variable)ClientIdenrtifierRelayAgentOptionDSLAMAttackerxDSLL2RAL3RADHCPServerABDHCPRelease:MACB:SrcIP:BChaddr:A2Spoof'chaddr'fieldDHCPRelease:MACB:SrcIP:BClientId:A3Spoof'ClientIdentifier'fieldDHCPRelease:MACB:SrcIP:BOption82RemoteId:A4SpoofOption82fieldChangingInternalfieldswithinDHCPheaderDHCPRelease:MACB:SrcIP:BCiaddr:A1Spoof'ciaddr'field2009InfosysTechnologiesLimitedSANOGXIVSimilarlyPPPoESession-IDfieldidentifiesauniquesession.
SpoofingthiscanalsocauseservicedisruptionPPPoEHeaderPPPoEHeaderspoofingVERTYPECODESESSION_IDLENGTHPAYLOADChangingSESSION_IDfieldinPPPoEHeaderAttackerxDSLIPBIPAPPPoEIABRAS1PADT:SESSION_ID:ASessionDisconnectedServiceProvider'sNetwork2009InfosysTechnologiesLimitedSANOGXIVAnti-spoofingWhatisanti-spoofingMechanismtoidentifyspoofingandstoppingit.
Howanti-spoofingisdoneBydroppingthespoofedpacketsHowtoidentifythespoofedpacketsByverifyingIPAddressofthereceivedpacket.
ByverifyingMACaddressofthereceivedpacket.
ByverifyingthecombinationofIPandMACaddressforagiveninterfaceByverifyingtheIPaddress,MACaddressandothersessionbasedidentificationintheprotocolheader.
2009InfosysTechnologiesLimitedSANOGXIVDatarequiredforAnti-spoofingForeachuserconnectionListofValidIPaddressesassignedListofValidMACaddressesandifpossiblethecombinationofMACandIPaddresses,TimeforwhicheachIPaddressisvalid.
2009InfosysTechnologiesLimitedSANOGXIVWhyanti-spoofinginBroadbandAccessConcentrator(BAC)BACisattherightplace:Itknowsalltherequiredinformationtodoanti-spoofing.
Anti-spoofingbecomesdifficultandlesseffectiveifitisnotdoneasnearthesourceaspossible.
Itisnotonlyimportanttodropspoofedpackets,itisimportanttodropthemasearlyaspossible.
2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC-PPPoE1xDSLHomeHubBRASL3RAMetroRADIUS2PADIPADO34PADRPADSBACObtainSession-IDfromPADSIPMACSession-IDI/FAA1011BB1022PPPLCPPPPIPCPBACObtainIPinformationfromIPCP567PADTBACDeletethespoofingentry2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC-DHCPxDSLHomeHubBRASL3RAMetroDHCPIPMACLeaseI/FAA2001BB120212DHCPDISCOVERDHCPOFFER34DHCPREQUESTDHCPACKBACObtainIP/MAC/LeasetimefromDHCPACKMessage6DHCPRELEASEBACRemovetheentryfromtableLeaseEXPIREBACRemovetheentryfromtable2009InfosysTechnologiesLimitedSANOGXIVDatacollectionforAntispoofinginBAC–802.
1x+DHCP1xDSLHomeHubBRASL3RAMetroDHCP2InitialEAPNegotiationsEAPAuthSuccess34DHCPMessageexchangeDHCPACKBACObtaintheMACaddressfromEAPAuthSuccessmessageIPMACLeaseI/FAA2001BB1202RADIUSBACObtainIP&LeasetimefromDHCPACKMessage2009InfosysTechnologiesLimitedSANOGXIVMACAntispoofingDSLAMAttackerAttackerxDSLMACI/FB2A1FloodtrafficwithbothMACAandMACBMACBNoImpactonAMACAMACBIPMACLeaseI/FBB1202Floodtrafficwith1000'sofSrcMACsinadditiontoMACBCompareAntispooftableanddiscardnonmatchingentriesNoMACtableExhaustion!
MACI/FB2MACTableAntiSpoofTableIPMACLeaseI/FAA2001BB1202CompareAntispooftableanddiscardnonmatchingentriesNospoofingofNeighbor'sMAC!
2009InfosysTechnologiesLimitedSANOGXIVIPAntispoofingAttackerxDSLIPBNoImpactonAIPASendtrafficwithIPAandMACB1IPMACLeaseI/FAA2001BB1202CompareIPagainstthei/finAntispooftableMetro2009InfosysTechnologiesLimitedSANOGXIVARPAntispoofingABCDARP:WhoisIPB1ARPReply:IamIPB:MACA2IPMACAABBARPTableABCDGratuitousARP:IamIPB:MACA1IPMACAABBARPTableIPMACLeaseI/FAA2001BB1202CompareIP/MACagainstthei/finAntispooftableIPMACLeaseI/FAA2001BB1202ServiceProviderN/wServiceProviderN/w2009InfosysTechnologiesLimitedSANOGXIVDHCPHeaderAntispoofingDSLAMAttackerxDSLL2RAL3RADHCPServerABDHCPRelease:MACB:SrcIP:BChaddr:A1AntiSpooffilterdiscardDHCPRelease:MACB:SrcIP:BOption82RemoteId:A3Option82fromuntrustedentity.
DiscardIPMACLeaseI/FAA2001BB1202InspectDHCPHeader&comparechaddr&ClientIDwithantispooftableAcceptDHCPwithoption82onlyifitiscomingfromtrustedentityDHCPRelease:MACB:SrcIP:BCiaddr:A2AntiSpooffilterdiscard2009InfosysTechnologiesLimitedSANOGXIVPPPoEHeaderAntispoofingAttackerxDSLIPBIPAPPPoEIABRAS1PADT:SESSION_ID:101IPMACSession-IDI/FAA1011BB1022SessionIDdoesnotmatchNoImpactonAMetro2009InfosysTechnologiesLimitedSANOGXIVLosingdatacollectedforanti-spoofingDatausedinAntispoofingcanbelostduetovariousreasonsPlannedrebootSoftwarecrashPowerfailureReplacementofsystemSoftwareupgrade2009InfosysTechnologiesLimitedSANOGXIVHowtorecoverlostdataStaticconfigurationRequiredDataisavailableintheconfiguration.
PPPoEForPPPoE,thekeep-alivetimersareconfiguredandthesessionisre-initiatediftherearenorepliestothekeep-alivemessagesDHCPDHCPdoesnothavekeepalivemechanisminplace.
DHCPhasa'leasetime'whichisusuallyinorderof'days'.
Howtorecoverfromthissituation2009InfosysTechnologiesLimitedSANOGXIVRecoveringLeaseinformationforDHCPStableStorage:NotveryusefulasnotmanyBACssupportstablestorage.
LimitederasecyclesisalsoabottleneckinthisapproachBroadcastARPs:NeedtowaitfordownstreamtraffictoarriveandinitiateARPrequests.
Willincreasethedelay.
Cannotgetthecompleteinformationinonerequest.
PronetospoofingattacksifamalicioususerrepliestotheARPrequest.
RedundantcontrollersBACcanhaveredundantcontrollersandupononecontrollercrash,theothercontrollercantakeoverwithpre-synchedleasedata.
Notsuitableforpowerfailurescenariosorforupgrades.
Havingredundantcontrollersalsoaddtohardwarecosts2009InfosysTechnologiesLimitedSANOGXIVRecoveringLeaseinformationforDHCPQuerythroughSNMP/LDAPCurrentlynostandardMIBsareavailableforDHCPleaseinformation.
BACstypicallydonotsupportSNMPclientinterfacesQueryleaseinformationfromDHCPserverSolvesmostoftheproblemsstatedabove2009InfosysTechnologiesLimitedSANOGXIVLeasequeryforDHCP(RFC4388)RFC4388introducedanewDHCPrequestLeasequerywhichaBACcanusetoqueryDHCPservertoobtainleaseinformation.
ThreetypesofqueriesaresupportedQuerybyIPaddressOnlyIPaddressispopulatedinthequerymessage.
QuerybyMACaddressOnlyMACaddressispopulatedinthequerymessage.
Ifmorethanoneleaseisavailable,thencorrespondingIPaddressesarereturnedinassociated-ipoption.
BACthengetsadditionaldatabygeneratingquerybyIPaddress.
QuerybyClientidentifierOnlyclientidentifieroptionispopulatedinthequerymessage.
Ifmorethanoneleaseisavailable,thencorrespondingIPaddressesarereturnedinassociated-ipoption.
BACthengetstheadditionaldatabyqueryingbyIPaddress.
2009InfosysTechnologiesLimitedSANOGXIVLeasequeryforDHCP(RFC4388)Threetypesofreplymessagetypesareintroduced:DHCPLEASEACTIVEWhenDHCPserverknowsaboutthequeryidentifier.
DHCPLEASEUNKNOWN:WhenDHCPserverdoesnotknowaboutthequeryidentifier.
AnAccessConcentratorcachethisinformationsothatthiscanbeusedtoavoidgeneratingLeaseQueryforthequeryidentifier.
ThisisknownasNegativeCaching.
DHCPLEASEUNASSIGNED:WhenDHCPserverdoesmanagethequeryidentifierbutnoleaseisyetassigned.
NegativeCachingisdoneforthisresponseaswell.
2009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven34DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1MACIPLeaseI/fM1192.
168.
1.
2T1I1AntiSpoofTable123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven35DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerCRASHMACIPLeaseI/fAntiSpoofTable123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–DataDriven36DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServer1DataTrafficfrom192.
168.
1.
22LeaseQuerybyIPAddress3LeaseActiveM1,T1,I1MACIPLeaseI/fM1192.
168.
1.
2T1I1AntiSpoofTable4DataTrafficfrom192.
168.
1.
25123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching37xDSLHomeHubServiceProviderNetworkDHCPServerCRASH123I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching381DataTrafficfrom192.
168.
1.
102LeaseQuerybyIPAddressNegativeCachingxDSLHomeHubServiceProviderNetworkDHCPServer123MACIPThresholdI/fM1192.
168.
1.
10T1I13LeaseUNKNOWN182.
168.
1.
10,M14I12009InfosysTechnologiesLimitedSANOGXIVRFC4388basedleasequery–NegativeCaching392DataTrafficfrom192.
168.
1.
103LeaseQuerybyIPAddressNegativeCachingxDSLHomeHubServiceProviderNetworkDHCPServer123MACIPThresholdI/fM1192.
168.
1.
10T1I14LeaseUNKNOWN182.
168.
1.
10,M1Thresholdexpired1I12009InfosysTechnologiesLimitedSANOGXIVIssueswithRFC4388basedleasequeryExistingLeasequerymechanismisdatadriven:LeasequeryisinitiatedonlywhenAccessConcentratorsreceivesdataExistingmethodsuggeststheuseofnegativecaching.
NegativeCachingconsumeslotofresourcesunderspoofattacks.
Resultsinincreasedoutagetimefortheclients.
2009InfosysTechnologiesLimitedSANOGXIVIssueswithRFC4388basedleasequery(contd.
.
)Gettingconsolidatedleaseinformationperconnectionisnotpossible:Existingmechanismdoesn'thaveanymethodstogetconsolidatedleaseinformationforalltheclientsbelongingtoaconnection/circuitMultipleclientscanresideforagivenconnection/circuit.
IfAccessconcentratorhasleaseinformationofalltheclientsforagivenconnection/circuit,anti-spoofingcanbedoneindataplane(fastpath)2009InfosysTechnologiesLimitedSANOGXIVQuerybyremote-idRemote-IDsuboptionidentifyiesaconnection/circuituniquely.
ThisisgloballyuniqueidentifierRemote-IDcanbetrustedastheyarecreatedbyRelayAgent.
AccessConcentratorneednotwaitforthetraffictoarriveandcangenerateLeaseQueryassoonasitcomesupafterareboot.
DHCPServercanprovideconsolidatedLeaseInformationforaspecificconnection/circuit.
Oncealltheleaseinformationforagivenconnection/circuitisobtained,anti-spoofingcanbedoneindataplane(fastpath).
NoneedforNegativeCaching.
2009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId43xDSLHomeHubServiceProviderNetworkDHCPServer123M1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1M3192.
168.
1.
10T3I1MACIPLeaseI/fAntiSpoofTableI12009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId44xDSLHomeHubServiceProviderNetworkDHCPServerCRASH123MACIPLeaseI/fAntiSpoofTableI12009InfosysTechnologiesLimitedSANOGXIVLeaseQuerybyRemoteId451LeaseQuerybyRemoteIdforI12LeaseActiveofallthreeleases*3DataTrafficfrom192.
168.
1.
8xDSLHomeHubServiceProviderNetworkDHCPServer123M1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I1M3192.
168.
1.
10T3I1MACIPLeaseI/fAntiSpoofTable4DataTrafficfrom192.
168.
1.
8BACdoesnotneedtowaitforthetraffictoinitiateLQLeasequerybyremote-idresultsinobtainingcompleteinformationonagiveninterface.
NoneedofinitiatingsubsequentqueriesI1*Leaseactiveforoneleaseisreturnedfollowedbyassociated-IPoption.
ThisresultsinsubsequentquerybyIPforremainingleases2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:ServeridentifiesaLeasequerybyremote-idwhentheleasequerymessagehas:Chaddr,siaddr,Ciaddr,htype,hlenandchaddriszeroandClientidentifieroptionisnotpresentandOption82withonlyRemote-Idsub-optionispresent.
SendsaLEASEACTIVEpopulatingtheciaddrwiththeIPaddressthatwasmostrecentlyaccessedbytheclient.
AllotherIPaddressesarereturnedinAssociated-IPoption.
RelayagentthensendsaLeasequerywith"QuerybyIPAddress"foralltheadditionalIPaddressesreturnedinAssociated-ipoption.
2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:ServermayreturnaLEASEUNASSIGNEDifitknowsitmanagestheleasefortheconnectionidentifiedbyRemote-Idsub-optionbutnoleaseisassignedyet.
ServermayreturnLEASEUNKNOWNifitdoesnotknowthecorrespondingRemote-idsub-option.
2009InfosysTechnologiesLimitedSANOGXIVWhyBulkLeasequeryTraditionalleasequery(Both4388)andleasequerybyremote-idworksontheprincipleofretrievingoneleaseatatimeWhilequerybyremote-idsolvesalltheproblemsassociatedwithRFC4388basedleasequerymechanism,itstillinvolvesgeneratinghugenumberofleasequeriestogetallthepossibledataBulkleasequeryworksontheprincipleofestablishingTCPconnectionbetweenRAandServerandretrievinginformationinbulk2009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery49DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerMACIPAddressLeaseTimeInterfaceM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I2M3192.
168.
1.
3T2I3I1I2I32009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery50DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerCRASHI1I2I3MACIPLeaseI/f2009InfosysTechnologiesLimitedSANOGXIVBulkLeaseQuery51DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServerMACIPAddressLeaseTimeInterfaceM1192.
168.
1.
2T1I1M2192.
168.
1.
8T2I2M3192.
168.
1.
3T2I33DataTrafficfrom192.
168.
1.
81BulkLeaseQueryinaTCPSession2LeaseActiveofallleases4DataTrafficfrom192.
168.
1.
8LeaseinformationofallinterfacesobtainedininonequeryI1I2I32009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:DSLAMLayer3RelayAgentxDSLHomeHubServiceProviderNetworkDHCPServer1TCPSession2BulkLeaseQuerywithXID23LEASEQUERYACTIVEforXID24LEASEQUERYACTIVEforXID25LEASEQUERYACTIVEforXID26LEASEQUERYDONEforXID27TCPsessionclose2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:AQuerier(TypicallyaRelayAgent)establishesaTCPconnectionwiththeserveronport67.
Twonewquerytypesareadded"QuerybyRelay-ID"whererelay-idisauniqueRelayagentIdentifier.
AllleasesallocatedthroughaspecificRelayAgent.
"QueryforallconfiguredIPs"whereallIPaddressheldbyDHCPServerirrespectiveofstateisreturned.
Inthiscase,unassignedIPaddressesarereturnedwithUNASSIGNEDstate.
Newfiltersareadded:StartandEndtimefiltercanbepassedtoretrieveleasesforwhichstatehaschangedwithinthespecifiedtime.
Otherquerytypes(QuerybyIPAddress,MACaddress,Client-IDandremote-id)arealsosupported.
2009InfosysTechnologiesLimitedSANOGXIVProtocolDetails:UponreceivingaBULKLEASEQUERY,DHCPservergeneratesastreamofLEASEACTIVEforeachleasethatfulfilsthequery.
EndofleaseforagivenqueryisindicatedbytheLEASEQUERYDONEmessage.
MultipleBulkLeasequerycanbeinitiatedoverasingleTCPconnection.
Transactionid(XID)isusedtodistinguishbetweentherepliesformultiplequeries.
2009InfosysTechnologiesLimitedSANOGXIVStandardizationandImplementationeffortsStandardizationefforts:Querybyremote-idandBulkLeaseQuerydraftisbeingstandardizedinDHCworkinggroupofIETF.
Implementationefforts:WehavecreatedaProof-Of-Conceptimplementationof'QuerybyRemote-Id'and'BulkLeaseQuery'byenhancingISCDHCPserver.
2009InfosysTechnologiesLimitedSANOGXIVReferences:S.
Bellovin,"SecurityproblemsintheTCP/IPprotocolsuite,"SIGCOMMComputerCommunicationReview,vol.
19,no.
2,pp.
32–48,1989.
R.
BeverlyandS.
Bauer,"Thespooferproject:inferringtheextentofsourceaddressfilteringontheinternet,"inSRUTI'05:Proc.
oftheStepstoReducingUnwantedTrafficontheInternet,2005.
IETFStandards:RFC2131,DynamicHostConfigurationProtocolLayer2RelayAgenthttp://www.
ietf.
org/id/draft-ietf-dhc-l2ra-04.
txthttp://www.
ietf.
org/id/draft-ietf-dhc-l2ra-extensions-01.
txtQuerybyremote-idhttp://www.
ietf.
org/id/draft-ietf-dhc-leasequery-by-remote-id-02.
txtBulkleasequeryhttp://www.
ietf.
org/id/draft-ietf-dhc-dhcpv4-bulk-leasequery-00.
txtTR-101fromBroadbandForumhttp://www.
broadband-forum.
org/technical/download/TR-101.
pdf2009InfosysTechnologiesLimitedSANOGXIV2009InfosysTechnologiesLimitedSANOGXIVThankYou
- Changeoption82相关文档
- 配置option82
- truckoption82
- Multipleoption82
- 支持option82
- 招标文件项目名称:汕头大学行政楼网络设备采购项目(重招)
- 支持option82
Linode（$5/月），新用户注册送100美元,11个数据中心云服务器
关于Linode，这是一家运营超过18年的VPS云主机商家，产品支持随时删除(按小时计费)，可选包括美国、英国、新加坡、日本、印度、加拿大、德国等全球十多个数据中心，最低每月费用5美元($0.0075/小时)起。目前，注册Linode的新用户添加付款方式后可以获得100美元赠送，有效期为60天，让更多新朋友可以体验Linode的产品和服务。Linode的云主机产品分为几类，下面分别列出几款套餐配置...
触碰云高性价20.8元/月，香港云服务器,美国cn2/香港cn2线路,4核4G15M仅115.2元/月起
触碰云怎么样?触碰云是一家成立于2019年的商家。触碰云主营香港/美国 VPS服务器、独立服务器以及免备案CDN。采用的是kvm虚拟构架，硬盘Raid10,Cn2线路，去程电信CN2、移动联通直连，回程三网CN2。最低1核1G带宽1M仅20.8元/月，不过这里推荐香港4核4G15M,香港cn2 gia线路云服务器，仅115.2元/月起，性价比还是不错的。点击进入：触碰云官方网站地址触碰云优惠码：优...
iON Cloud七月促销适合稳定不折腾的用户，云服务器新购半年付8.5折，洛杉矶/圣何塞CN2 GT线路，可选Windows系统
iON Cloud怎么样？iON Cloud今天发布了7月份优惠，使用优惠码:VC4VF8RHFL，新购指定型号VPS半年付或以上可享八五折！iON的云服务器包括美国洛杉矶、美国圣何塞（包含了优化线路、CN2 GIA线路）、新加坡（CN2 GIA线路、PCCW线路、移动CMI线路）这几个机房或者线路可供选择，有Linux和Windows系统之分，整体来说针对中国的优化是非常明显的，机器稳定可靠，比...
option82为你推荐
-
巨星prince去世有几位好莱坞巨星死在2016年bbs.99nets.com做一款即时通讯软件难吗 像hi qq这类的www.jjwxc.net在哪个网站看小说？月神谭有没有什么好看的小说?拒绝言情小说!8090lu.com《8090》节目有不有高清的在线观看网站啊？8090lu.com8090看看电影网怎么打不开了抓站工具抓鸡要什么工具?www.bbb551.com广州欢乐在线551要收费吗？www.bbb551.comHUNTA551第一个第二个妹子是谁呀？？广告法请问违反了广告法，罚款的标准是什么