JP6954071B2 - Network monitoring equipment and methods - Google Patents

Description

The present invention relates to a network monitoring technique for monitoring communication by a terminal connected to a communication network and interfering with unauthorized communication by an unauthorized unauthorized terminal.

Conventionally, as a network monitoring technology that monitors communication by a terminal connected to a communication network and interferes with communication by an unauthorized unauthorized terminal, a technology for monitoring an ARP request sent from the terminal at the start of communication has been proposed. (See, for example, Patent Document 1).
For example, when communicating with an arbitrary partner terminal via a communication network consisting of a LAN, the IP address of the partner terminal is required in order to send and receive packets by IP at layer 3 (network layer).

In addition to this, in order to send and receive a frame containing a packet in Ethernet (registered trademark) in layer 2 (data link layer), the MAC address of the other terminal is required.
Therefore, in layer 2, a protocol for acquiring the MAC address of the partner terminal of the specified IP address by sending and receiving control packets called ARP request and ARP reply, that is, ARP (Address Resolution Protocol) is defined.

In this ARP, first, the source terminal broadcasts an ARP request packet in which the IP address of the other terminal is designated as the confirmation IP address to the communication network. Next, each terminal connected to the communication network confirms whether the confirmation IP address of the ARP request packet matches the IP address of its own terminal. After that, the terminal having the same IP address notifies the source terminal of the ARP reply packet including the MAC address of the own terminal.

The above-mentioned conventional technique pays attention to the fact that such an ARP request packet is always transmitted from a malicious terminal, and the actual MAC address corresponding to the specified confirmation IP address for the ARP request packet from the malicious terminal. A fake ARP reply packet using a MAC address different from the above is notified from the network monitoring device to the unauthorized terminal.
As a result, the fraudulent terminal is notified of a MAC address different from the original one by a fake ARP reply packet, so that the fraudulent terminal is confused and cannot communicate, and as a result, the communication of the fraudulent terminal is disturbed. Become.

Japanese Unexamined Patent Publication No. 2008-227600

However, in such a conventional technique, a fake ARP reply packet is transmitted from a network monitoring device that is not designated as a destination of the ARP request packet, so that the fake ARP reply packet is sent to an unauthorized terminal or the same communication network. It may be inspected by another connected terminal device and determined to be an invalid ARP reply packet.
Therefore, in such a case, the ARP reply packet from the terminal with the confirmation IP address specified in the ARP request packet may cause the unauthorized terminal to start communication, and as a result, the communication of the unauthorized terminal cannot be interrupted. There was a problem.

The present invention is intended to solve such a problem, and an object of the present invention is to provide a network monitoring technique capable of reliably interfering with communication by an unauthorized terminal.

In order to achieve such an object, the network monitoring device according to the present invention is permitted to communicate with an arbitrary terminal via a communication network and a communication I / F unit via the communication network. When the duplication confirmation packet is transmitted from an arbitrary terminal by monitoring the communication between the storage unit that stores the address list in which the address of the legitimate terminal is registered in advance and the terminal connected to the communication network, the duplication confirmation packet A communication monitoring unit that determines whether or not the source terminal of the duplicate confirmation packet is an unauthorized terminal by extracting the confirmation IP address included in the above and collating it with the address list, and the source terminal is an unauthorized terminal. When it is determined that the above is the case, it is provided with a duplicate response reply unit that returns a duplicate response packet indicating that the confirmation IP address is duplicated to the source terminal.

Moreover, the network monitoring equipment according to the present invention, additionally sets the case where the transmission source terminal is determined to be unauthorized terminal, to the communication I / F section the confirmation IP address as the new local IP address communication It also has an I / F setting unit.

Further, in one configuration example of the network monitoring device according to the present invention, when the communication monitoring unit transmits an ARP probe packet for duplication confirmation as the duplication confirmation packet, the confirmation IP included in the ARP probe packet. By extracting the address and collating it with the address list, it is determined whether or not the source terminal is an unauthorized terminal, and the duplicate response reply unit determines that the source terminal is an unauthorized terminal. In this case, the ARP reply packet for duplicate response, in which the confirmation IP address included in the ARP probe packet is used as the source address and the own device MAC address is used as the source MAC address, is returned to the source terminal. Is.

Further, the network monitoring method according to the present invention is a network monitoring method used in a network device connected to a communication network, and the storage unit has an address of a legitimate terminal that is permitted to communicate via the communication network. A storage step for storing a pre-registered address list and a communication monitoring unit monitor communication by a terminal connected to the communication network, and when a duplicate confirmation packet is transmitted from an arbitrary terminal, the duplicate confirmation packet is transmitted. By extracting at least one of the MAC address and the IP address included in the above and collating it with the address list, a communication monitoring step of determining whether or not the source terminal of the duplicate confirmation packet is an unauthorized terminal. , overlapping response response unit, overlapping response replies the sender terminal and the determined if an unauthorized terminal, duplicate response packet indicating that the check IP addresses are duplicated, and returns to the source terminal When the communication I / F setting unit determines that the source terminal is an unauthorized terminal, the communication I / F setting unit additionally sets the confirmation IP address as a new own IP address in the communication I / F unit. , Further prepared .

According to the present invention, since the ARP reply packet for duplicate response is returned to the malicious terminal in response to the duplicate confirmation packet from the unauthorized terminal, it is possible to reliably interfere with the communication by the unauthorized terminal. Further, according to the present invention, since it is possible to prevent the unauthorized terminal from setting its own IP address used in the communication network L, communication interference is caused after the unauthorized terminal becomes available for its own IP address. Higher security can be obtained as compared with the conventional technique to be performed.

It is a block diagram which shows the structure of the network monitoring apparatus. This is an example of address list configuration. This is a configuration example of an ARP packet. This is an example of transmitting an ARP probe packet. It is a sequence diagram which shows the network monitoring operation.

Next, an embodiment of the present invention will be described with reference to the drawings.
[Network monitoring device]
First, the network monitoring device 10 according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration of a network monitoring device.

The network monitoring device 10 is composed of network devices such as UTM (Unified Threat Management), gateways, routers, switches, and hubs as a whole, and is connected to a communication network L such as a LAN (Local Area Network) to become a communication network L. It has a function of monitoring communication by the connected terminal and interfering with unauthorized communication with the authorized legitimate terminal 20 by the unauthorized unauthorized terminal 21.

As shown in FIG. 1, the network monitoring device 10 includes a communication I / F unit 11, a storage unit 12, a communication monitoring unit 13, a duplicate response reply unit 14, and a communication I / F setting unit 15 as main functional units. I have.

The communication I / F unit 11 has a function of performing communication by transmitting and receiving packets to and from a legitimate terminal 20 and an unauthorized terminal 21 connected to the communication network L.
The storage unit 12 is composed of a storage device such as a semiconductor memory or a hard disk, and has a function of storing various processing data and programs used for the operation of the network monitoring device 10. The main processing data stored in the storage unit 12 includes the local IP address and the local MAC address of the network monitoring device 10, and the address list 12A of the regular terminal 20.

FIG. 2 is an example of an address list configuration. Here, for each regular terminal 20, a MAC address and an IP address are registered in advance as the regular terminal address used in the regular terminal 20. When determining the fraudulent terminal 21, the MAC address and IP address of the fraudulent terminal 21 are collated with the MAC address and IP address of the legitimate terminal 20. Since it is possible to collate only one of the MAC address and the IP address at the time of collation, only one of the MAC address and the IP address may be registered in the address list 12A as the legitimate terminal address.

The communication monitoring unit 13 monitors the communication by the legitimate terminal 20 or the unauthorized terminal 21 connected to the communication network L, and when the duplication confirmation packet is transmitted from an arbitrary terminal, the confirmation IP address included in the duplication confirmation packet is set. By extracting and collating with the address list, it has a function of determining whether or not the source terminal of the duplicate confirmation packet is an unauthorized terminal 21.

When the communication monitoring unit 13 determines that the source terminal of the duplicate confirmation packet is an unauthorized terminal 21, the duplicate response reply unit 14 indicates that the confirmation IP address included in the duplicate confirmation packet is duplicated. It has a function of returning a duplicate response packet to a source terminal, that is, an unauthorized terminal 21.

When the communication monitoring unit 13 determines that the source terminal of the duplicate confirmation packet is an unauthorized terminal 21, the communication I / F setting unit 15 sets the confirmation IP address included in the duplicate confirmation packet to a new own IP address. It has a function to additionally set the communication I / F unit 11 as.

In the present embodiment, a case where an ARP probe packet for duplication confirmation is used as a specific example of the duplication confirmation packet will be described as an example.
FIG. 3 is a configuration example of an ARP packet. Here, an example in which the ARP packet 40 is stored in the data unit 31 of the Ethernet frame 30 is shown.
The ARP packet 40 has an operation code 41, a source MAC address 42, a source IP address 43, a destination MAC address 44, and a destination IP address 45 as main control data.

The operation code 41 is identification information indicating the type of ARP of the ARP packet 40. When the packet is used as an ARP request packet, the operation code 41 is set to 0x0001, and when the packet is used as an ARP reply packet, the operation code 41 is set to 0x0002.
The source MAC address 42 and the source IP address 43 are the source MAC address and IP address for transmitting the ARP packet.
The destination MAC address 44 and the destination IP address 45 are the MAC address and IP address of the destination of the ARP packet.

FIG. 4 is an example of transmitting an ARP probe packet. Here, it is assumed that the MAC address of the unauthorized terminal 21 and the confirmation IP address to be confirmed, and the MAC address and IP address of the network monitoring device 10 are as follows.
・ Unauthorized terminal 21
MAC address: "xx: xx: xx: xx: xx: 01"
Confirmation IP address: "xxx1"
・ Network monitoring device 10
MAC address: "yy: yy: yy: yy: yy: 02"
IP address: "yyy2"

When an ARP probe packet for duplication confirmation is transmitted from the unauthorized terminal 21, the MAC address of the unauthorized terminal 21 is set as the source MAC address 42, but the confirmation IP address cannot be used yet, so the source IP address 43 is used. Is set to an unused IP address indicating unused. Further, a broadcast address is set in the destination MAC address 44 so that the ARP probe packet is received by all terminals, and a confirmation IP address, that is, an IP address that the unauthorized terminal 21 wants to use is set in the destination IP address 45. Will be done.

・ ARP probe packet (for duplicate confirmation)
Source MAC address: "xx: xx: xx: xx: xx: 01" (MAC address of unauthorized terminal)
Source IP address: "0.0.0.0" (unused IP address)
Destination MAC address: "FF: FF: FF: FF: FF: FF" (broadcast address)
Destination IP address: "xxx1" (confirmation IP address)

On the other hand, the network monitoring device 10 forcibly notifies that the confirmation IP address that the unauthorized terminal 21 wants to use is a duplicate address, and interferes with the use of the confirmation IP address. Therefore, when transmitting an ARP reply packet for duplicate response to an ARP probe packet from an unauthorized terminal 21, the source MAC address 42 is set to the MAC address of the own device, and the source IP address is set to the source IP address. The confirmation IP address is set. Further, the source MAC address and the source IP address of the ARP probe packet are set as they are in the destination MAC address and the destination IP address.

・ ARP reply packet (for duplicate response)
Source MAC address: "yy: yy: yy: yy: yy: 02" (MAC address of monitoring device)
Source IP address: "xxx1" (confirmation IP address)
Destination MAC address: "xx: xx: xx: xx: xx: 01" (ARP probe source MAC address)
Destination IP address: "0.0.0.0" (ARP probe source IP address)

As a result, the unauthorized terminal 21 has already specified the source MAC address for the source IP address, that is, the confirmation IP address specified by the unauthorized terminal 21 in the received ARP reply packet. There is a terminal to be used, and it is determined that the confirmed IP address is a duplicate address. Therefore, the unauthorized terminal 21 cannot perform communication using the confirmed IP address.

[Operation of the present embodiment]
Next, the operation of the network monitoring device 10 according to the present embodiment will be described with reference to FIG. FIG. 5 is a sequence diagram showing a network monitoring operation.
Here, it is assumed that the MAC address and the IP address of the regular terminal 20 have already been set in the storage unit 12 of the network monitoring device 10.

When the unauthorized terminal 21 is linked up to the communication network L (step 100), it is desired to use it as shown in FIG. 4 in order to confirm that the IP address used by itself does not overlap with other terminals. An ARP probe packet for duplication confirmation in which the confirmation IP address is designated as the destination IP address is transmitted by broadcast to all terminals connected to the communication network L (step 101).

This ARP probe packet is received by each legitimate terminal 20, but since the designated destination IP address, that is, the confirmation IP address is different from the IP address of the own terminal, the APR reply packet is not returned to the ARP probe packet.

On the other hand, the network monitoring device 10 constantly monitors the communication by the legitimate terminal 20 or the fraudulent terminal 21 connected to the communication network L via the communication I / F unit 11, and the ARP probe packet transmitted from the fraudulent terminal 21. In response to the detection of (step 102), a series of communication jamming processes (step 103) as follows are executed.

First, the communication monitoring unit 13 extracts the source MAC address from the detected ARP probe packet (step 110) and collates it with the address list 12A of the storage unit 12 (step 111). Determines whether or not is an unauthorized terminal 21 (step 112).
Here, when the source MAC address matches that of the legitimate terminal 20 registered in the address list 12A and the verification is successful (step 112: NO), the communication monitoring unit 13 cancels a series of communication jamming processes. Then return to communication monitoring.

On the other hand, if the source MAC address does not match that of the legitimate terminal 20 registered in the address list 12A and the verification fails (step 112: YES), the communication monitoring unit 13 determines the source terminal of the ARP probe packet. Is an unauthorized terminal 21 (step 113).
When the communication monitoring unit 13 determines that the source terminal of the ARP probe packet is an unauthorized terminal 21, the communication I / F setting unit 15 uses a new own IP address as the confirmation IP address included in the ARP probe packet. Is additionally set in the communication I / F unit 11 (step 114). As a result, the legitimate terminal 20 and the fraudulent terminal 21 recognize that the confirmation IP address is being used by the network monitoring device 10.

Further, when the communication monitoring unit 13 determines that the source terminal of the ARP reply packet is an unauthorized terminal 21, the duplicate response reply unit 14 determines that the confirmation IP address included in the ARP probe packet is duplicated. As the duplicate response packet indicating the above, an ARP reply packet as shown in FIG. 4 is generated (step 115), transmitted from the communication I / F unit 11 to the communication network L (step 116), and a series of communication interference processing is completed. do.

As a result, the ARP probe packet transmitted from the network monitoring device 10 is received by the unauthorized terminal 21 via the communication network L (step 104), and the unauthorized terminal 21 transmits the received ARP probe packet with the source MAC address. Since the address value is set in the original IP address, it is confirmed that the confirmation IP address is duplicated (step 105). As a result, communication on the communication network L using the confirmed IP address is abandoned.

After that, even when the unauthorized terminal 21 tries to communicate using a different new IP address, it is necessary to confirm the duplication of the new IP address. Therefore, the unauthorized terminal 21 transmits the ARP probe packet for duplicate confirmation in which the new confirmation IP address to be used is specified as the destination IP address, but the network monitoring device 10 executes the above-mentioned communication interference process. Therefore, communication on the communication network L using the new IP address will be hindered.

[Effect of this embodiment]
As described above, in the present embodiment, when the communication monitoring unit 13 monitors the communication by the terminal connected to the communication network L in the network monitoring device 10 and the duplicate confirmation packet is transmitted from an arbitrary terminal, the present embodiment is concerned. By extracting the confirmation IP address included in the duplication confirmation packet and collating it with the address list 12A of the storage unit 12, it is determined whether or not the source terminal of the duplication confirmation packet is an unauthorized terminal 21, and the source terminal determines whether or not it is an unauthorized terminal 21. When it is determined that the terminal is a fraudulent terminal 21, the duplicate response reply unit 14 returns a duplicate response packet indicating that the confirmation IP address is duplicated to the source terminal, that is, the fraudulent terminal 21. ..

More specifically, when the communication monitoring unit 13 transmits an ARP probe packet for duplication confirmation as a duplication confirmation packet, the communication monitoring unit 13 extracts the confirmation IP address included in the ARP probe packet and collates it with the address list 12A. Therefore, it is determined whether or not the source terminal is an unauthorized terminal 21, and when the duplicate response reply unit 14 determines that the source terminal is an unauthorized terminal 21, the confirmation IP address included in the ARP probe packet is used. The ARP reply packet for duplicate response, which uses the own device MAC address as the source MAC address as the source address, is returned to the source terminal.

As described above, the APR request packet is originally for requesting the MAC address corresponding to the specified IP address, but by setting the confirmation IP address that you want to use as the destination IP address, you can set the IP address. It is used as an ARP probe packet for checking duplicates.
In the present invention, the ARP reply packet for duplicate response to such the ARP probe packet for duplicate confirmation is returned only from the terminal of the IP address that matches the confirmation IP address, and the network monitoring device 10 for the duplicate response. The focus is on the fact that even if an ARP reply packet is transmitted, it is not regarded as an invalid ARP reply packet.

As a result, there is no possibility that the ARP reply packet for duplicate response is regarded as an invalid ARP reply packet as compared with the conventional technique for returning a fake ARP reply packet for the APR request packet for MAC address request. Further, even if the ARP reply packet for duplicate response is returned from the terminal of the confirmation IP address specified in the ARP probe packet to the unauthorized terminal 21, the unauthorized terminal 21 will not be able to communicate.

Therefore, according to the present invention, in response to the duplicate confirmation packet from the unauthorized terminal 21, the ARP reply packet for the duplicate response is returned to the unauthorized terminal 21, so that it is possible to reliably interfere with the communication by the unauthorized terminal 21. It becomes. Further, according to the present invention, since it is possible to prevent the unauthorized terminal 21 from setting its own IP address used in the communication network L, communication is performed after the unauthorized terminal 21 becomes available for its own IP address. Higher security can be obtained as compared with the conventional technique of interfering.

Further, in the present embodiment, when the communication I / F setting unit 15 determines in the communication monitoring unit 13 that the source terminal of the ARP probe packet for duplication confirmation is an unauthorized terminal 21, the confirmation IP address is set. The communication I / F unit 11 may be additionally set as a new own IP address.
As a result, a new communication I / F having the confirmed IP address as the own IP address and the original MAC address of the network monitoring device 10 as the own MAC address is connected to the communication network L.

Therefore, the legitimate terminal 20 and the unauthorized terminal 21 connected to the communication network L recognize that the new communication I / F actually exists in the communication network L in a communicable state. Therefore, even if the packet addressed to the confirmation IP address is erroneously transmitted, it can be correctly received by the network monitoring device 10.

[Extension of Embodiment]
Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made within the scope of the present invention in the configuration and details of the present invention. In addition, each embodiment can be implemented in any combination within a consistent range.

In the embodiment described above, when the communication I / F setting unit 15 of the network monitoring device 10 additionally sets the confirmation IP address included in the duplicate confirmation packet as a new own IP address in the communication I / F unit 11. In this case, the original MAC address of the network monitoring device 10 is assigned as the MAC address of the new communication I / F having the confirmed IP address, but as the MAC address of the new communication I / F. , You may assign a MAC address different from the original MAC address.

At this time, basically, any MAC address may be assigned to the new communication I / F as long as it does not overlap with the MAC address of each terminal connected to the communication network L. Therefore, a spare MAC address that is unlikely to be duplicated is set in the storage unit 12 in advance, and when a new communication I / F is added, the spare MAC address read from the storage unit 12 is used as the new communication I / F. It may be assigned to F.

Further, when the communication I / F unit 11 is provided with a spare communication module having a different MAC address in advance separately from the communication module of the current communication I / F, and a new communication I / F is added. The confirmation IP address included in the duplicate confirmation packet may be assigned to a new communication I / F composed of a spare communication module.

Further, regarding the new communication I / F to which the confirmation IP address included in the duplicate confirmation packet is assigned, the communication monitoring unit 13 monitors the use of the confirmation IP address by any terminal and confirms it over a certain monitoring period. When the use of the IP address is no longer confirmed, for example, the operation of the new communication I / F may be stopped. As a result, the power consumption of the new communication I / F can be reduced, and unnecessary processing for managing the confirmed IP address can be stopped.

10 ... Network monitoring device, 11 ... Communication I / F unit, 12 ... Storage unit, 12A ... Address list, 13 ... Communication monitoring unit, 14 ... Duplicate response reply unit, 15 ... Communication I / F setting unit, 20 ... Regular terminal , 21 ... Unauthorized terminal, 30 ... Ethernet frame, 31 ... Data part, 40 ... ARP packet, 41 ... Operation code, 42 ... Source MAC address, 43 ... Source IP address, 44 ... Destination MAC address, 45 ... Destination IP Address, L ... Communication network.

Claims (3)

A communication I / F unit that communicates with an arbitrary terminal via a communication network,
A storage unit that stores an address list in which the addresses of legitimate terminals that are permitted to communicate via the communication network are registered in advance, and a storage unit.
When the communication by the terminal connected to the communication network is monitored and the duplication confirmation packet is transmitted from an arbitrary terminal , at least one of the MAC address and the IP address included in the duplication confirmation packet is extracted and described above. A communication monitoring unit that determines whether or not the source terminal of the duplicate confirmation packet is an unauthorized terminal by collating with the address list.
Duplicate response packet indicating that if the source terminal is determined to be unauthorized terminal, is confirmed IP address is duplicated, and a duplicate response returning unit for returning to the sender terminal,
If the source terminal is determined to be unauthorized terminal, the communication I / F setting unit additionally sets the communication I / F the confirmation IP address as a new local IP address, further comprising said Rukoto Network monitoring device. In the network monitoring device according to claim 1,
When the ARP probe packet for duplication confirmation is transmitted as the duplication confirmation packet, the communication monitoring unit extracts the confirmation IP address included in the ARP probe packet and collates it with the address list to perform the transmission. Determine if the original terminal is a fraudulent terminal and
When it is determined that the source terminal is an unauthorized terminal, the duplicate response reply unit uses the confirmation IP address included in the ARP probe packet as the source address and the own device MAC address as the source MAC address. A network monitoring device characterized in that an ARP reply packet for a duplicate response is returned to the source terminal. A network monitoring method used by network devices connected to communication networks.
A storage step in which the storage unit stores an address list in which the addresses of legitimate terminals permitted to communicate via the communication network are registered in advance, and a storage step.
When the communication monitoring unit monitors the communication by the terminal connected to the communication network and the duplicate confirmation packet is transmitted from an arbitrary terminal , at least one of the MAC address and the IP address included in the duplicate confirmation packet is included in the duplicate confirmation packet. And a communication monitoring step of determining whether or not the source terminal of the duplicate confirmation packet is an unauthorized terminal by extracting and collating with the address list.
Duplicate response response unit, overlapping response reply step of the source terminal and the determined if an unauthorized terminal, duplicate response packet indicating that the check IP addresses are duplicated, and returns to the source terminal equipped with a door,
Communication I / F setting unit, when the source terminal is determined to be unauthorized terminal, the step of adding configure the communication I / F section the confirmation IP address as a new local IP address, further comprising Rukoto A network monitoring method characterized by.

Images