Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
862
Source Verification of Cable-side IP Addresses
The C4/c CMTS Cable Source Verify feature is intended to eliminate host-initiated corruption of the layer 2 and layer 3
address spaces on the cable network. The feature adds a source IP address verification phase to the IP address learning
process of the C4/c CMTS. Each unknown source address received in an IP, ARP, or ND packet on a cable-side interface is
subjected to a configurable series of address validation checks prior to learning. If any check fails, the address remains
unlearned and all IP, ARP, and ND packets sourced from that address are dropped.
The C4/c CMTS examines source addresses of directly connected hosts to verify that their IP addresses do not belong to
other hosts. Also, the C4/c CMTS inhibits the traffic of an indirectly connected host if the return route to that address is not
via the cable modem that originated the packet.
Source Verify via Internal Database — The C4/c CMTS maintains an internal database (MAC DB) of CPE source IPs (SIPs),
MAC addresses, and associated CMs. The database is populated through DHCP snooping for dynamically assigned CPE IP
addresses or through either MAC learning or DOCSIS® pre-provisioning for statically assigned CPE IP addresses. This
database along with the routing tables serves as the default authority for SIP verification.
Source Verify via DHCP Server — This facility allows the C4/c CMTS to query a DHCP server for the CM MAC address
associated with a given SIP when that SIP is not present in the MAC DB of the C4/c CMTS. It does this using a DHCP
LEASEQUERY message. Cable Source Verify supports multiple versions of the lease query protocol for IPv4. For IPv6 there is
only one version.
Source Verify via Authoritative DHCP Server — With authoritative DHCP lease query, any indication returned by the DHCP
server that indicates that the server has no knowledge of the address results in denial of packet forwarding. This implies
that all CPE IP addresses (whether directly attached or not) will be either dynamically assigned by the DHCP server or
statically reserved at the DHCP server.
For IPv6
Users of Cable Source Verify and IPv6 should be aware of the following:
Lease Query Option 47 — The C4/c CMTS verifies IPv6 source address leases based on the association of the CPE with the
CM. If a CPE is using an IPv6 source address assigned by the DHCPv6 server to a CPE behind a different or unknown CM,
then these packets will be denied. This requires that the DHCPv6 server respond to a request for a lease query option 47
