Patent ID: 7464183

Claim:
A method of using a firewall resident on a host computer to prevent spoofing of an address resolution cache of said host computer, the method comprising: said firewall receiving a first unsolicited message from a target computer station that submits a genuine address resolution for a network protocol address; said firewall checking independently cached address resolution information associated with said host computer; in response to determining that cached address resolution information for said network protocol address of said target computer station has a previously cached address resolution which differs from said genuine address resolution submitted by said first unsolicited message, said firewall issuing a first broadcast request for network elements having said network protocol address to reply with address resolution information in order to check the authenticity of said first unsolicited message submitting said genuine address resolution for said network protocol address; in response to determining that no reply messages match said previously cached address resolution that would contradict said genuine address resolution in said first unsolicited message, said firewall determining that said first unsolicited message is not spoofed and permitting at least one message to pass onto said host computer which includes said genuine address resolution for said target computer station; said firewall receiving a second unsolicited message from a spoofer that submits a spoofed address resolution for said network protocol address of said target computer station; said firewall checking said independently cached address resolution information associated with said host computer; in response to determining that said previously cached address resolution information for said network protocol address differs from said spoofed address resolution submitted by said second unsolicited message, said firewall issuing a second broadcast request for network elements having said network protocol address to reply with address resolution information in order to check the authenticity of said second unsolicited message submitting said spoofed address resolution for said network protocol address of said target computer station; in response to receiving a reply message from said target computer station that matches said previously cached address resolution, said firewall determining that said second unsolicited message is a spoofed message and blocking at least one message which includes said spoofed address resolution from passing onto said host computer; wherein said firewall is operable to protect said host computer from spoofed address resolution messages while permitting genuine address resolutions.