Patent ID: 7360245

Claim:
A method for preventing an address spoofing based attack from a network, the network having one or more hosts and one or more routers for transporting at least one packet, each router having one or more interfaces, and each interface having a directly connected sub-network, the method comprising: receiving a packet into a first interface of a router; deriving a first source physical address for the packet based on a source IP address of the packet, a sub-network mask of the first interface, and a memory space of the first interface containing information about the respective IP address of the hosts and one or more other routers and their corresponding physical addresses; obtaining a second source physical address directly from an encapsulating frame of the packet; determining whether the packet is address spoofed by comparing the first and second source physical addresses, wherein the step of determining further comprises: examining whether the source IP address is within a subnet IP address space of a directly connected sub-network of the interface; if the source IP address is within the subnet IP address space, determining whether the first source physical address matches the second source physical address; if the source IP address is not within the subnet IP address space, checking whether the packet is routed from a neighboring router on the same directly connected sub-network of the interface by checking whether the second source physical address matches with a source physical address present in a neighboring router physical address list of the interface, wherein the packet can be determined to be address spoofed when either the second source physical address fails to match the first physical address or the packet is not routed from a neighboring router on the same directly connected sub-network of the interface; and discarding the packet if the packet is determined to be address spoofed.