Abstract:
A network switch including a plurality of ports, a packet processor, and a first processor. The plurality of ports are configured to receive a plurality of packets transmitted from a network to the network switch. The packet processor comprises a classifier configured to select a subset of the plurality of packets according to sampling criteria. The first processor is configured to determine, based on the subset of the plurality of packets, whether the plurality of packets are associated with an attack on the network switch. The classifier is further configured to, prior to the first processor determining whether the plurality of packets are associated with an attack, copy the subset of the plurality of packets to the first processor while maintaining the plurality of packets in the packet processor.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This present disclosure is a continuation of U.S. application Ser. No. 11/170,904, filed on Jun. 29, 2005, which claims priority under 35 U.S.C. §119(e) to U.S. Provisional Application No. 60/685,524, filed on May 26, 2005. 
    
    
     BACKGROUND 
     The present invention relates generally to data communications. More particularly, the present invention relates to a data link layer switch with protection against Internet Protocol spoofing. 
     Secure data communications networks such as corporate intranets are the subject of increasingly numerous and sophisticated attacks from outside the network. One common component of such attacks, referred to as Internet Protocol (IP) spoofing, alters the IP source address of packets transmitted by the attacker. One purpose of IP spoofing is to conceal the identity of the attacker. 
     Another purpose of IP spoofing is to present the attacker as a user within the secure intranet under attack. Because devices within a secure intranet trust each other, an attacker masquerading as such a device can do more damage than an attacker that appears to be outside the network. For example, an attacker could transmit packets to a local-area network (LAN) using a altered or “spoofed” address of 192.168.1.200. Because this is the form of the internal IP addresses for many small LANs, the attacker may be accepted as a computer within the LAN. 
     SUMMARY 
     In general, in one aspect, the invention features a network switch including a plurality of ports, a packet processor, and a first processor. The plurality of ports are configured to receive a plurality of packets transmitted from a network to the network switch. The packet processor comprises a classifier configured to select a subset of the plurality of packets according to sampling criteria. The first processor is configured to determine, based on the subset of the plurality of packets, whether the plurality of packets are associated with an attack on the network switch. The classifier is further configured to, prior to the first processor determining whether the plurality of packets are associated with an attack, copy the subset of the plurality of packets to the first processor while maintaining the plurality of packets in the packet processor. 
     In general, in one aspect, the invention features a data link layer switch comprising: a processor; a plurality of ports to exchange packets of data with a network; a memory to store a switch table; and a packet processor to transfer the packets of data between the ports according to the switch table, the packet processor comprising a classifier to send copies of selected ones of the packets of data to the processor; wherein the processor determines whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets. 
     Some embodiments comprise an alarm unit to manifest an indication of the attack when the processor determines that the attack upon the data link layer switch has occurred. Some embodiments comprise a blocking unit to block the packets of data that are related to an attack when the processor determines that the attack upon the data link layer switch has occurred. In some embodiments, the classifier identifies the selected ones of the packets of data according to at least one of the group consisting of: contents of the packets of data; sampling criteria describing the packets of data; and a sampling algorithm. In some embodiments, the sampling criteria describing the packets of data comprise at least one of the group consisting of: destination addresses of the packets of data; source addresses of the packets of data; identifiers of switch interfaces of the data link layer switch receiving the packets of data into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the packets of data from the data link layer switch; data rates of the packets of data; quantities of data in the packets of data; identifiers of other network devices in the paths of the packets of data; and times of occurrence of the packets of data. In some embodiments, the memory stores a table of data flows describing traffic patterns of the packets of data; wherein the processor modifies the table of data flows based on characteristics of the selected ones of the packets of data; and wherein the processor determines whether the attack upon the data link layer switch has occurred based on the contents of the table of data flows. In some embodiments, the table of data flows comprises at least one of the group consisting of: destination addresses of packets in the data flows; source addresses of packets in the data flows; identifiers of switch interfaces of the data link layer switch receiving the data flows into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the data flows from the data link layer switch; data rates of the data flows; quantities of data in the data flows; identifiers of other network devices involved in the data flows; and times of occurrence of the data flows. In some embodiments, the data link layer switch comprises a plurality of switch interfaces; wherein the table of data flows comprises a plurality of forwarding entries each comprising an Internet Protocol (IP) address and an identifier of the one of the switch interfaces from which packets having the IP address as a destination address should be transmitted; and wherein the processor determines that an attack upon the data link layer switch has occurred when none of the forwarding entries comprises both (1) the IP source address of one of the packets, and (2) an identifier of the one of the switch interfaces on which the one of the packets was received. 
     In general, in one aspect, the invention features a data link layer switch comprising: means for processing; port means for exchanging packets of data with a network; memory means for storing a switch table; and packet processor means for transferring the packets of data between the port means according to the switch table, the packet processor means comprising classifier means for sending copies of selected ones of the packets of data to the processor means; wherein the processor means determines whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets. 
     Some embodiments comprise means for manifesting an indication of the attack when the processor means determines that the attack upon the data link layer switch has occurred. Some embodiments comprise means or blocking the packets of data that are related to an attack when the processor means determines that the attack upon the data link layer switch has occurred. In some embodiments, the classifier means identifies the selected ones of the packets of data according to at least one of the group consisting of: contents of the packets of data; sampling criteria describing the packets of data; and a sampling algorithm. In some embodiments, the sampling criteria describing the packets of data comprise at least one of the group consisting of: destination addresses of the packets of data; source addresses of the packets of data; identifiers of switch interfaces of the data link layer switch receiving the packets of data into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the packets of data from the data link layer switch; data rates of the packets of data; quantities of data in the packets of data; identifiers of other network devices in the paths of the packets of data; and times of occurrence of the packets of data. 
     In some embodiments, the memory means stores a table of data flows describing traffic patterns of the packets of data; wherein the processor means modifies the table of data flows based on characteristics of the selected ones of the packets of data; and wherein the processor means determines whether the attack upon the data link layer switch has occurred based on the contents of the table of data flows. In some embodiments, the table of data flows comprises at least one of the group consisting of: destination addresses of packets in the data flows; source addresses of packets in the data flows; identifiers of switch interfaces of the data link layer switch receiving the data flows into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the data flows from the data link layer switch; data rates of the data flows; quantities of data in the data flows; identifiers of other network devices involved in the data flows; and times of occurrence of the data flows. In some embodiments, the data link layer switch comprises a plurality of switch interface means each associated with one or more of the port means; wherein the table of data flows comprises a plurality of forwarding entries each comprising an Internet Protocol (IP) address and an identifier of the one of the switch interface means from which packets having the IP address as a destination address should be transmitted; and wherein the processor means determines that an attack upon the data link layer switch has occurred when none of the forwarding entries comprises the IP source address of one of the packets and an identifier of the one of the switch interface means on which the one of the packets was received. 
     In general, in one aspect, the invention features a method for a data link layer switch comprising a processor, the method comprising: exchanging packets of data with a network; storing a switch table; and transferring the packets of data between ports of the data link layer switch according to the switch table; sending copies of selected ones of the packets of data to the processor; wherein the processor determines whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets. 
     Some embodiments comprise, upon determining that an attack upon the data link layer switch has occurred, performing at least one of the group consisting of: manifesting an indication of the attack; and causing the packets of data that are related to the attack to be blocked. Some embodiments comprise identifying the selected ones of the packets of data according to at least one of the group consisting of contents of the packets of data; sampling criteria describing the packets of data; and a sampling algorithm. In some embodiments, the sampling criteria describing the packets of data comprise at least one of the group consisting of: destination addresses of the packets of data; source addresses of the packets of data; identifiers of switch interfaces of the data link layer switch receiving the packets of data into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the packets of data from the data link layer switch; data rates of the packets of data; quantities of data in the packets of data; identifiers of other network devices in the paths of the packets of data; and times of occurrence of the packets of data. Some embodiments comprise storing a table of data flows describing traffic patterns of the packets of data; modifying the table of data flows based on characteristics of the selected ones of the packets of data; and determining whether the attack upon the data link layer switch has occurred based on the contents of the table of data flows. In some embodiments, the table of data flows comprises at least one of the group consisting of: destination addresses of packets in the data flows; source addresses of packets in the data flows; identifiers of switch interfaces of the data link layer switch receiving the data flows into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the data flows from the data link layer switch; data rates of the data flows; quantities of data in the data flows; identifiers of other network devices involved in the data flows; and times of occurrence of the data flows. In some embodiments, the data link layer switch comprises a plurality of switch interfaces, further comprising storing in the table of data flows a plurality of forwarding entries each comprising an Internet Protocol (IP) address and an identifier of the one of the switch interfaces from which packets having the IP address as a destination address should be transmitted; and determining that an attack upon the data link layer switch has occurred when none of the forwarding entries comprises the IP source address of one of the packets and an identifier of the one of the switch interfaces on which the one of the packets was received. 
     In general, in one aspect, the invention features a computer program for a data link layer switch that exchanges packets of data with a network, the computer program comprising examining copies of selected ones of the packets of data; and determining whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets. 
     Some embodiments comprise, upon determining that an attack upon the data link layer switch has occurred, performing at least one of the group consisting of manifesting an indication of the attack; and causing the packets of data that are related to the attack to be blocked. Some embodiments comprise identifying the selected ones of the packets of data according to at least one of the group consisting of contents of the packets of data; sampling criteria describing the packets of data; and a sampling algorithm. In some embodiments, the sampling criteria describing the packets of data comprise at least one of the group consisting of destination addresses of the packets of data; source addresses of the packets of data; identifiers of switch interfaces of the data link layer switch receiving the packets of data into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the packets of data from the data link layer switch; data rates of the packets of data; quantities of data in the packets of data; identifiers of other network devices in the paths of the packets of data; and times of occurrence of the packets of data. Some embodiments comprise storing a table of data flows describing traffic patterns of the packets of data; modifying the table of data flows based on characteristics of the selected ones of the packets of data; and determining whether the attack upon the data link layer switch has occurred based on the contents of the table of data flows. In some embodiments, the table of data flows comprises at least one of the group consisting of destination addresses of packets in the data flows; source addresses of packets in the data flows; identifiers of switch interfaces of the data link layer switch receiving the data flows into the data link layer switch; identifiers of switch interfaces of the data link layer switch transmitting the data flows from the data link layer switch; data rates of the data flows; quantities of data in the data flows; identifiers of other network devices involved in the data flows; and times of occurrence of the data flows. In some embodiments, the data link layer switch comprises a plurality of switch interfaces, and the computer program further comprises storing in the table of data flows a plurality of forwarding entries each comprising an Internet Protocol (IP) address and an identifier of the one of the switch interfaces from which packets having the IP address as a destination address should be transmitted; and determining that an attack upon the data link layer switch has occurred when none of the forwarding entries comprises the IP source address of one of the packets and an identifier of the one of the switch interfaces on which the one of the packets was received. 
     The details of one or more implementations are set forth in the accompanying drawings and the description below. Other features will be apparent from the description and drawings, and from the claims. 
    
    
     
       DESCRIPTION OF DRAWINGS 
         FIG. 1  shows a data link layer switch in communication with a network according to a preferred embodiment of the present invention. 
         FIG. 2  shows an initialization process for the data link layer switch of  FIG. 1  for learning traffic patterns in the data flows traversing the switch according to a preferred embodiment of the present invention. 
         FIG. 3  shows a protection process for the data link layer switch of  FIG. 1  for detecting and handling an IP spoofing attack according to a preferred embodiment of the present invention 
     
    
    
     The leading digit(s) of each reference numeral used in this specification indicates the number of the drawing in which the reference numeral first appears. 
     DETAILED DESCRIPTION 
     Embodiments of the present invention provide data link layer switches with protection against Internet Protocol (IP) spoofing attacks. Data link layer switches according to preferred embodiments of the present invention collect data describing the data flows traversing the switch to establish characteristic traffic patterns for the switch. When subsequent data flows vary significantly from these characteristic traffic patterns, an attack upon the switch is declared. 
     Preferably the data link layer switch operates in two phases. First, in an initialization phase, the switch learns the traffic patterns by examining the data flows comprising the traffic and populating a data flow table based on this examination, as described below. Thereafter, the switch operates in a protection phase, in which the switch compares the patterns of the data flows in the switch traffic to the patterns in the data flow table to determine whether an attack upon the switch has occurred. Further, the switch can continue to learn traffic patterns during the protection phase. 
       FIG. 1  shows a data link layer switch  100  in communication with a network  102  according to a preferred embodiment of the present invention. A data link layer switch is a network switch that forwards traffic at the data link layer (that is, layer 2 of the Open Systems Interconnection (OSI) Reference Model), but does not route traffic at the network layer (that is, layer 3 of the OSI Reference Model), as is well-known in the relevant arts. Network  102  can be a local-area network such as a corporate intranet or the like, and is generally protected from attackers on a wide-area network  126  such as the Internet by a firewall  120 , although this is not required. 
     Switch  100  comprises a processor  104 , a memory  106  to store a switch table  108 , a plurality of ports  110 A-N to exchange packets of data with network  102 , and a packet processor  112  to transfer the packets of data between ports  110  according to switch table  108 . Packet processor  112  comprises a classifier  114  to determine properties of the packets, and to direct the packets accordingly. In some embodiments, switch  100  additionally comprises an alarm unit  122  and a blocking unit  124 . 
     Data link layer switch  100  can be fabricated as one or more semiconductors. Memory  106  can be fabricated as part of one or more of the semiconductors. 
       FIG. 2  shows an initialization process  200  for data link layer switch  100  for learning traffic patterns in the data flows traversing switch  100  according to a preferred embodiment of the present invention. Classifier  114  selects some or all of the packets of data that traverse switch  100  (step  202 ), and sends a copy of each of the selected packets to processor  104  (step  204 ). Because network traffic patterns generally do not change rapidly, a small sample of the packets is sufficient to produce accurate characteristic network traffic patterns. 
     In some embodiments, classifier  114  selects the packets based on data contained in the packet, for example in the packet header. In some embodiments, classifier  114  selects the packets based on sampling criteria describing the packets. For example, packets can be selected based on destination addresses of the packets, source addresses of the packets, identifiers of switch interfaces of the data link layer switch  100  receiving the packets into the data link layer switch  100 , identifiers of switch interfaces of the data link layer switch  100  transmitting the packets from the data link layer switch  100 , data rates of the packets, quantities of data in the packets, identifiers of other network devices in the paths of the packets, times of occurrence of the packets, or the like, or any combination thereof. The packets can also be selected using a sampling algorithm such as a statistical sampling algorithm. However, embodiments of the present invention are independent of the manner of selection of the packets. 
     Memory  106  preferably stores a data flow table  116  that describes traffic patterns of the packets of data, preferably according to the data flows comprising the packets. In some embodiments the data flows can be defined by specifying a value or range of values for all or part of one or more fields in each packet in the data flow. For example, these fields can represent the media access control (MAC) or Internet protocol (IP) source address of the packet, the transport control protocol (TCP) or user datagram protocol (UDP) destination port of the packet, the protocol type of the packet, and so on. In some embodiments each data flow is defined as an ordered set of packets transmitted from one network device to another. Some embodiments define other types of data flows. However, embodiments of the present invention are independent of the manner in which data flows are defined. 
     Processor  104  modifies data flow table  116  based on characteristics of the selected ones of the packets of data (step  206 ). Data flow table  116  can include destination addresses of packets in the data flows, source addresses of packets in the data flows, identifiers of switch interfaces of the data link layer switch  100  receiving the data flows into the data link layer switch  100 , identifiers of switch interfaces of the data link layer switch  100  transmitting the data flows from the data link layer switch  100 , data rates of the data flows, quantities of data in the data flows, identifiers of other network devices involved in the data flows, times of occurrence of the data flows, and the like. However, embodiments of the present invention are independent of the particular packet characteristics used to modify data flow table  116 . 
     Process  200  then resumes at step  202 , and repeats until the initialization phase is complete. 
       FIG. 3  shows a protection process  300  for data link layer switch  100  for detecting and handling an IP spoofing attack according to a preferred embodiment of the present invention. Classifier  114  selects some or all of the packets of data that traverse switch  100  (step  302 ), for example as described above for process  200  of  FIG. 2 . Classifier  114  sends a copy of each of the selected packets to processor  104  (step  304 ). Because classifier  114  preferably selects only those packets that belong to new data flows, only a small portion of the packets of data that traverse switch  100  are selected, copied and sent to processor  104 . Therefore processor  104  is not unduly burdened. In addition, classifier  114  examines the original packets (not copies) in silicon. Therefore no copies are made for most packets. 
     Processor  104  determines whether an attack upon switch  100  has occurred (step  306 ) based on the copies of the packets. Preferably processor  104  determines whether an attack has occurred by comparing the patterns of the data flows comprising the selected packets to the patterns in data flow table  116 . For example, if data flow table  116  shows that a particular computer normally generates traffic only during regular business hours, but the selected packets show significant traffic with that computer late at night, an attack could have occurred. As a further example, if data flow table  116  shows that a particular computer normally generates a small amount of traffic, but the selected packets show a large amount of traffic with that computer, an attack could have occurred. Of course, these are only examples. Any sort of criteria can be used to establish patterns and detect attacks based on those patterns. 
     Preferably switch  100  continues to learn traffic patterns during the protection phase. Therefore, if in step  306  no attack has occurred, processor  104  modifies data flow table  116  based on characteristics of the selected packets of data (step  310 ), for example as described above for process  200  of  FIG. 2 . Process  300  then resumes at step  302 . 
     But if at step  306  processor  104  detects an attack, processor  104  responds (step  308 ). In some embodiments, alarm unit  122  manifests an indication of the attack, for example by sending a message to a system administrator. In some embodiments, blocking unit  124  disrupts the data flow of the attack, for example by causing the packets of data that are related to the attack to be blocked. Of course, processor  104  can employ other responses to the attack. However, embodiments of the present invention are independent of the type of response. 
     In some embodiments, switch  100  compares the path of a data flow to its reverse path. Switch  100  comprises a plurality of switch interfaces each associated with one or more of ports  110 , as is well-known in the relevant arts. Switch  100  determines whether the switch interface that receives a packet from a network device is the same switch interface that would be used to send a packet to that network device. If not, then it is likely that the network device is conducting an IP spoofing attack. This technique for detecting attacks can be used alone or in combination with the techniques described above. 
     According to these embodiments, data flow table  116  stores forwarding entries each comprising an Internet Protocol (IP) address and an identifier of the switch interface from which packets having the IP address as a destination address should be transmitted. When none of the forwarding entries comprises the IP source address of a packet and an identifier of the one of the switch interfaces on which that packet was received, processor  104  determines that an attack upon data link layer switch  100  has occurred. 
     A number of implementations of the invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other implementations are within the scope of the following claims.