Detection of duplicated network addresses

The present invention relates to an access unit for coupling a plurality of subscribers to a data communication network, and comprising an auto-configuration control unit adapted to learn, from first auto-configuration data issued by an auto-configuration server and transiting through said access unit towards a particular subscriber coupled to said access unit, a particular network address as being dynamically assigned to said particular subscriber.An access unit according to the invention is characterized in that said auto-configuration control unit is further adapted to learn, from second auto-configuration data transiting through said data communication network, said particular network address as being newly assigned to another subscriber, and in that said access unit further comprises an auto-configuration preemption unit coupled to said auto-configuration control unit, and adapted thereupon to issue an auto-configuration control signal towards said particular subscriber, whereby a new auto-configuration session is initiated between said particular subscriber and said auto-configuration server, and further whereby a new network address is dynamically assigned to said particular subscriber.

FIELD OF INVENTION

The present invention relates to an access unit for coupling a plurality of subscribers to a data communication network, and comprising an auto-configuration control unit adapted to learn, from first auto-configuration data issued by an auto-configuration server and transiting through said access unit towards a particular subscriber coupled to said access unit, a particular network address as being dynamically assigned to said particular subscriber.

BACKGROUND

Dynamic Host Configuration Protocol (DHCP) allows automatic configuration of client's hosts, and more specifically dynamic assignment of network addresses. DHCP is built on a client-server model, where designated DHCP servers allocate network addresses and deliver configuration parameters to dynamically configured hosts. DHCP assigns network addresses for a finite period of time (referred to as a lease) and re-uses them once they are released, thereby postponing exhaustion of available network addresses.

An access unit provides subscribers with an access towards a data communication network. Examples of an access unit are an access multiplexer or an Ethernet bridge. The access unit typically forwards user traffic at the data link layer (L2). Yet, the access unit may snoop DHCP traffic e.g. for populating an IP anti-spoofing filter (to check whether a network address is validly used by a client).

Network addresses happen to be sometimes duplicated on account of e.g. restart or reboot of the access unit, restart or reboot of the DHCP server, thereby causing communication problems for the corresponding subscribers.

It is an object of the present invention to prevent duplication of network addresses within a data communication system.

SUMMARY

According to the invention, this object is achieved due to the fact that said auto-configuration control unit is further adapted to learn, from second auto-configuration data transiting through said data communication network, said particular network address as being newly assigned to another subscriber, and in that said access unit further comprises an auto-configuration preemption unit coupled to said auto-configuration control unit, and adapted thereupon to issue an auto-configuration control signal towards said particular subscriber, whereby a new auto-configuration session is initiated between said particular subscriber and said auto-configuration server, and further whereby a new network address is dynamically assigned to said particular subscriber.

Upon receipt of auto-configuration data instructing the access unit that a particular network address has been newly assigned, to a subscriber, the access unit checks whether this network address conflicts with the network address of a particular subscriber coupled to the access unit. If so, the access unit forces this particular subscriber to renew his network address.

An access unit according to the invention is advantageous in that duplicated network addresses are immediately detected, and in that incurred communication problems are immediately and automatically repaired.

It is to be noticed that the newly assigned network address is not declined, and that the access unit conforms with the network configuration enforced by the auto-configuration server.

It is also to be noticed that the present invention is applicable to whatever type of auto-configuration protocol, being DHCP, BOOT Protocol (BOOTP), Point-to-Point Protocol (PPP) in combination with Remote Authentication Dial-In User Service (RADIUS), etc.

An embodiment of an access unit according to the invention is characterized in that said second auto-configuration data are issued by said auto-configuration server and are transiting through said access unit towards said another subscriber, which another subscriber being coupled to said access unit.

The second auto-configuration data forms part of e.g. a DHCPACK signal issued by a DHCP server and transiting through the access unit (acting as a DHCP relay or as an intermediate switch) towards a DHCP client.

This embodiment is capable of detecting any network address that is duplicated within the scope of one access unit only.

Another embodiment of an access unit according to the invention is characterized in that said second auto-configuration data are L2-advertised by another access unit, which another subscriber being coupled to said another access unit, which access unit and which another access unit belonging to a same L2-advertising domain.

The L2-advertising domain is e.g. an Ethernet-based Local Area Network (LAN) or Virtual Local Area Network (VLAN) or Metropolitan Area Network (MAN), and the second auto-configuration data are advertised by means of e.g. a gratuitous ARP request.

This embodiment is capable of detecting any network address that is duplicated across multiple access units, yet within the scope of one L2-advertising domain.

A further embodiment of an access unit according to the invention is characterized in that said auto-configuration server is a DHCP server, and said auto-configuration control signal is a DHCPFORCERENEW message.

This embodiment is further advantageous in that it relies upon an existing DHCP control signal, thereby reducing implementation costs.

It is to be noticed that the term ‘comprising’, also used in the claims, should not be interpreted as being restricted to the means listed thereafter. Thus, the scope of the expression ‘a device comprising means A and B’ should not be limited to devices consisting only of components A and B. It means that with respect to the present invention, the relevant components of the device are A and B.

The above and other objects and features of the invention will become more apparent and the invention itself will be best understood by referring to the following description of an embodiment taken in conjunction with the accompanying drawings wherein:

DESCRIPTION OF EMBODIMENTS

CPE11and12are coupled to the access multiplexer21via twisted pairs, optical fibers or a wireless interface. CPE13is coupled to the access multiplexer22. The access multiplexers21and22and the DHCP server23are coupled to each other via the EMAN31. The EMAN31is further coupled to the Internet33via the edge router32.

The EMAN31, the edge router32and the Internet33compose a data communication network30.

CPE11,12and13include any piece of equipment that is assigned a public IP address, being a router, a modem, a server, a set top box, a personal computer, etc.

CPE11,12and13, together with the DHCP server23, form part of the same IP subnet, meaning they are considered as a single route by the edge router32as far as IP routing is concerned.

There is seen inFIG. 2a preferred embodiment of the access multiplexer21comprising the following functional blocks:subscriber ports101to107for coupling to CPE,a network port111for coupling to a data communication network,an Ethernet switch121,an auto-configuration preemption unit122,an auto-configuration control unit123,a local repository124, wherein IP addresses are held in one-to-one relationships with MAC addresses (see IP@+MAC@ inFIG. 2).

The Ethernet switch121is coupled to the subscriber ports101to107, to the network port111, to the auto-configuration preemption unit122and to the auto-configuration control unit123. The auto-configuration control unit123is further coupled to the local repository124and to the auto-configuration preemption unit122.

The Ethernet switch121is adapted to switch any incoming Ethernet frame from any ingress port towards any egress port by means of a forwarding table. The Ethernet switch121learns which MAC address is associated to which port by decoding the source MAC address of the incoming frames, and populates on the fly the forwarding table with the so-learned associations.

The Ethernet switch121further accommodates internal port(s) (not shown) whereto the auto-configuration preemption unit122and the auto-configuration control unit123are coupled for receiving and transmitting frames from and to the data communication system1.

The Ethernet switch121is further adapted to forward a copy of DHCP and ARP traffic received through the network port111towards the auto-configuration control unit123for further processing.

The auto-configuration control unit123is adapted to decode auto-configuration data from DHCP and ARP traffic.

The auto-configuration control unit123is further adapted to validate a MAC addresses as being a MAC address of a subscriber coupled to the access multiplexer21(further referred to as a local MAC address or as a local subscriber). This information can be retrieved e.g. by reading out the forwarding table and by validating the MAC addresses that have been learnt as being associated with any of the subscriber ports101to107.

The auto-configuration control unit123is further adapted to check whether a newly-assigned IP address conflicts with the IP address of a local subscriber, and if so to request the auto-configuration preemption unit122to preempt the corresponding DHCP session.

The auto-configuration control unit123is further adapted to update the local repository124(add a new entry, update or delete an existing entry) according to the so-decoded auto-configuration data, and to broadcast gratuitous ARP requests throughout the EMAN31whenever a local subscriber is assigned a new IP address.

The auto-configuration preemption unit122is adapted to issue a DHCPFORCERENEW signal under control of, and by making use of the information provided by, the auto-configuration control unit123.

An operation of the preferred embodiment follows.

Initially, CPE11(more specifically, a DHCP client housed by CPE11) initiates a DHCP session to obtain network configuration parameters from a DHCP server. The network configuration parameters includes a public IP address, primary and secondary Domain Name Server's (DNS) IP addresses, gateway's IP address, the applicable MTU size, etc.

The DHCP session is initiated by broadcasting a DHCPDISCOVER message (not shown), which DHCP message being relayed by the access multiplexer21towards the EMAN31. The DHCP session goes on by exchanging further DHCP messages (DHCPOFFER, DHCPREQUEST), and terminates with the DHCP server23returning a DHCPACK1message to the DHCP client. The DHCPACK1 message contains, as auto-configuration data ACD1and as far as the present invention is concerned, a public IP address IP@1associated with a particular MAC address MAC@1uniquely identifying CPE11.

The Ethernet switch121forwards a copy of the DHCPACK1 message towards the auto-configuration control unit123.

Next, the auto-configuration control unit123checks throughout the local repository124whether the IP address IP@1conflicts with another local subscriber's IP address, that is to say whether the IP address IP@1is already held in the local repository124as being associated to another local MAC address. Presently, there is no such IP address.

The auto-configuration control unit123validates the MAC@1as being a local MAC address, creates a new entry in the local repository124wherein the IP address IP@1is associated with the MAC address MAC@1, and next broadcasts a gratuitous ARP request ARP1through the network port111, and further throughout the EMAN31, whereby the IP address IP@1is advertised as being associated with the MAC address MAC@1.

Let us assume, as a first working assumption, that the DHCP server23accidentally re-assigns the IP address IP@1to the local subscriber usr2during a further DHCP session, meaning that a further-received DHCPACK2message contains, as configuration data ACD2, the IP address IP@1associated with another MAC address MAC@2uniquely identifying CPE12.

A copy of the DHCPACK2message is forwarded towards the auto-configuration control unit123.

The auto-configuration control unit123checks throughout the local repository124whether the IP address IP@1conflicts with another local subscriber's IP address. Presently, the auto-configuration control unit123identifies the local MAC address MAC@1as being already associated with the IP address IP@1. Thus, the auto-configuration control unit123sends a trigger PREMPT to the auto-configuration preemption unit122with MAC@1and IP@1as target MAC and IP address respectively.

The auto-configuration control unit123validates the MAC address MAC@2as being a local MAC address, updates the corresponding entry in the local repository124by re-associating the IP address IP@1with the MAC address MAC@2, and broadcasts a gratuitous ARP request ARP2through the network port111, and further throughout the EMAN31, whereby the new association between the IP address IP@1and the MAC address MAC@2is advertised.

Upon receipt of the trigger PREMPT, the auto-configuration preemption unit122sends a DHCPFORCERENEW message with MAC@1and IP@1as destination MAC and IP address respectively, thereby forcing the corresponding device to re-initiate a new DHCP session, and further to get new auto-configuration data ACD4including a new IP address IP@2.

Let us assume, as a second working assumption, that the DHCP server23accidentally re-assigns the IP address IP@1to the subscriber usr3during a further DHCP session. The access multiplexer22broadcasts a gratuitous ARP request ARP3throughout the EMAN31, whereby the IP address IP@1is advertised as being associated with a MAC address MAC@3uniquely identifying CPE13(ACD3).

A copy of the ARP3message is forwarded to the auto-configuration control unit123.

The auto-configuration control unit123checks throughout the local repository124whether the IP address IP@1conflicts with a local subscriber's IP address. Presently, the auto-configuration control unit123identifies the local MAC address MAC@1as being already associated with the IP address IP@1. Thus, the auto-configuration control unit123sends a trigger PREMPT to the auto-configuration preemption unit122with MAC@1and IP@1as target MAC and IP address respectively.

The auto-configuration control unit123does not validate the MAC address MAC@3as being a local MAC address, and thus deletes the entry associating the IP address IP@1to the local MAC address MAC@1from the local repository124.

Upon receipt of the trigger PREMPT, the auto-configuration preemption unit122sends a DHCPFORCERENEW message with MAC@1and IP@1as destination MAC and IP address respectively, thereby forcing the corresponding device to re-initiate a new DHCP session, and further to get new auto-configuration data ACD4including a new IP address IP@2.

It is to be noticed that gratuitous ARPs may also be issued by CPE upon assignment of a new IP address, e.g. for dealing with local address conflicts. Yet, such ARPs are dropped by the access multiplexer for security issues (ARP poisoning, ARP flooding, etc). The present invention offers an alternative and wide-scope solution for fixing duplicated network addresses, while keeping network security alike.

In an alternative embodiment of the present invention, the access multiplexers21and22acts as gateway routers towards the edge router32, and further towards the Internet33. As such, they are assigned public IP addresses.

The access multiplexers21and22acts as DHCP relays, and push their own IP address before forwarding upstream DHCP messages towards the DHCP server23. In this way, the server can return them downstream DHCP messages, for further forwarding towards the appropriate destination.

In an alternative embodiment, PPP in combination with RADIUS is used in lieu of DHCP.

The access multiplexers21and22terminate the PPP sessions and collaborate with a RADIUS server for authenticating the subscribers, which RADIUS server providing back network configuration parameters (possibly in collaboration with a third-party server) to the access multiplexers for encapsulation and further forwarding towards the subscribers.

The local repository123is populated upon receipt of RADIUSACCESSACCEPT messages, wherein auto-configuration data are encoded (in lieu of DHCPACK messages).

It is to be noticed that the present invention is not restricted to Ethernet-based data communication systems, but is applicable to whatever type of link layer protocol, being token ring, Asynchronous Transfer Mode (ATM) with dedicated ATM circuit(s) for advertising auto-configuration data to peer access units and with dedicated advertising messages, etc.

A final remark is that embodiments of the present invention are described above in terms of functional blocks. From the functional description of these blocks, given above, it will be apparent for a person skilled in the art of designing electronic devices how embodiments of these blocks can be manufactured with well-known electronic components. A detailed architecture of the contents of the functional blocks hence is not given.

While the principles of the invention have been described above in connection with specific apparatus, it is to be clearly understood that this description is made only by way of example and not as a limitation on the scope of the invention, as defined in the appended claims.