| 摘要 |
In a method and device for searching (or chasing) an unauthorized access, it is determined whether or not the device itself is designated as a searching device at an endpoint of a subnet accommodating an unauthorized access terminal; and if the device itself is not designated as the searching device at the endpoint and when an unauthorized access that has been regarded by the searching device at the endpoint as not having an address spoofed is detected or a notification of the unauthorized access is received, a search request including an address of the unauthorized access terminal is issued towards the searching device at the endpoint. Also, if the device itself is designated as the searching device at the endpoint and when the search request is received, countermeasure processing is performed to a switch in a lower layer accommodating the unauthorized access terminal included in the search request. If the device itself is not designated as the endpoint and when the search request is received, the search request to a next hop searching device is issued. Alternatively, the searching device which has initiated issuing the search request performs the search request sequentially to a searching device of an intermediate hop between the searching devices on both ends until the searching device at the endpoint is verified.
|
