Patent ID: 9038182
Filing Date: 2015-05-19
Classification: H04L

Abstract:
1. A spoofing attack defense method using a blocking server, which checks an IP address and a MAC address included in an ARP packet relayed through an L2 switch 104 in a network and blocks a transferring of the ARP packet when it is confirmed that the addresses are used in a spoofing attack, comprising: a first step that an address collecting part a second step that the address collecting part a third step that the address collecting part a fourth step that, when an ARP packet is introduced to the client a fifth step that, when the MAC address of the sender extracted in the fourth step is included in the blocked MAC address list stored in the block address DB a sixth step that the ARP packet processing part wherein the fifth step further comprises: a 5-1st step that, when the MAC address of the sender extracted in the fourth step is not included in the blocked MAC address list, if the IP address and MAC address of the sender is not in the allowed IP-MAC address list, or if the IP address and MAC address of the sender is different from configuration of the allowed IP-MAC addresses which are mapped in the allowed IP-MAC address list and stored in an address pair, the ARP packet is defined as a suspected ARP packet; a 5-2nd step that the address checking part a 5-3rd step that, the accrued number during a desired period of time is more than a threshold value, the suspected ARP is categorized as an infected ARP packet.