TWM541160U - Apparatus for blocking network and computer-readable medium - Google Patents

Abstract

A device for blocking network and a computer-readable medium are provided, which are adapted for performing network management on Internet Protocol (IP) connected devices in a network domain. The device is configured for executing a method for blocking network, and the method contains the following steps. Whether the IP connected devices are belong to the blocking group is determined. At least one fake address is generated. The fake address is excluded from Media Access Control (MAC) addresses of the IP connected devices in the blocking group. Then, for each IP connected device in the blocking group, a fake packet is broadcasted. The fake packet contains one of the fake addresses. Therefore, a purpose of blocking network would be achieved effectively.

Description

Network blocking device and computer readable storage media

The novel creation is related to a network management technology, and in particular to a network blocking device and a computer readable storage medium.

With the rapid development of technology, a wide variety of electronic devices are becoming more and more popular. In order to achieve the purpose of resource sharing, the network becomes a necessary equipment for information exchange, which has led to the rapid growth of commercial and home networking equipment (for example, smart phones, smart cameras, wireless sharing devices, smart TVs, etc.). In response to the setting of a large number of networked devices, network administrators also need to control the network functions of these connected devices.

On the other hand, the security issue is a big problem for network management. In the face of networked devices that violate the security policy (for example, installing pirated software, virus code is not updated, over-broadcast, etc.), network administrators usually block these connected devices to prevent further impact on these connected devices. Other networked devices in the domain. It can be seen that there is a need to propose a network blocking scheme that is effective and meets actual needs.

The novel creation provides a network blocking device, and a computer readable storage medium, which blocks the network of the networked devices by broadcasting a forged packet having a fake address for the desired networked device.

The novel creation proposes a network blocking device, which is suitable for network management of a networked device in a domain, and includes a communication module and a processing unit. The communication module is used to transmit and receive packets. The processing unit is coupled to the communication module and configured to perform the following steps. Determine if the connected device is a blocked group. Generate at least one fake address. These forged addresses are excluded from the physical address of the networked device in the blocked group. Then, for each connected device in the blocking group, the forged packet is broadcasted through the communication module. The fake packet includes one of the aforementioned forged addresses.

From another point of view, the novel creation also proposes a computer readable storage medium for storing a computer program. The computer program is loaded into a network lockout device and causes the network lockout device to perform a network lockout method. This network blocking method includes the following steps. Determine if the connected device is a blocked group. Generate at least one fake address. This fake address is excluded from the physical address of the networked device in this blocked group. Next, the forged packets are broadcast for each networked device in the blocked group. The fake packet includes one of the aforementioned forged addresses.

Based on the above, the network blocking device and the computer readable storage medium proposed by the novel creation embodiment generate a fake address for the networked device belonging to the blocked group, and broadcast the free address resolution including the fake address. The Agreement (Gratuitous Address Resolution Protocol; GARP) responds to the packet. Accordingly, if other networked devices intend to transmit the packet to the networked device in the blocked group, the packet will not be effectively delivered, thereby blocking the network of the blocked group. In addition to being able to significantly reduce the amount of packet transmission, the broadcast method can be adapted to a large number of networked devices. On the other hand, for a small number of devices to block network devices, the present invention creates a packet for blocking a networked device by intercepting an Address Resolution Protocol (ARP) packet and transmitting a forged ARP packet. Block it.

The above described features and advantages of the present invention will become more apparent and understood from the following description.

The Gratuitous Address Resolution Protocol (GARP) response packet is a type of ARP response packet, and in order to broadcast the GARP reply (reply) packet, the target media access control (MAC) must be set to FF:FF. :FF:FF:FF:FF. The novel creation embodiment uses the broadcast GARP response packet to enable the networked devices in the domain to receive the forged GARP response packet (for example, including a fake address), so that the networked device cannot effectively encapsulate the packet. It is transmitted to the networked devices in the blocked group, which is in response to the timeliness of ARP packets and the environment of a large number of networked devices. In addition, the novel authoring embodiment intercepts the ARP request packet of the networked device in the blocking group and responds to the forged ARP response packet (for example, including the forged address), so that the subsequent transmission of the blocked group cannot be successfully completed. In the following, various embodiments in accordance with the spirit of the present invention are proposed, and those applying the present embodiment can appropriately adjust these embodiments according to their needs, and are not limited to the contents in the following description.

1 is a schematic diagram of a communication system in accordance with an embodiment of the present invention. Referring to FIG. 1, the communication system 10 includes one or more IP connected device networks 110 and a network lockout device 150. In this embodiment, each device in the communication system 10 is in the same network domain (for example, a local area network (LAN), an internal network, etc.). In other embodiments, some of the devices in the communication system 10 are in different networks, and the communication system 10 may have an ARP proxy device. Moreover, the number of networked devices 110 in FIG. 1 is for illustrative purposes only and is not intended to limit the inventive embodiments.

The networked device 110 can be an electronic device such as a computer, a mobile phone, a wireless sharer, a server, a smart phone, a display device, a smart camera, a router, a network switch, etc., which can be based on at least one IP, a transmission control protocol (Transmission Control) Protocols such as Protocol; TCP) and User Datagram Protocol (UDP) communicate with another networked device 110 and network blocking device 150 for data transmission or connection to the Internet.

The network blocking device 150 can be various types of servers, wireless sharers, routers, network switches, computers, workstations, and the like. In practical applications, the network blocking device 150 may be a device used by a network administrator to act as a network control center in the network domain. In a hardware perspective, FIG. 2 is a block diagram of components of a network lockout device 150 in accordance with an embodiment of the present invention. Referring to FIG. 2, the network blocking device 150 includes at least (but not limited to) a communication module 151 and a processing unit 155.

The communication module 151 can be any type of wireless network interface module supporting WiFi standard or other wireless transmission function, or can support any Ethernet, optical fiber or other wired transmission function. Types of wired network interface modules, even a combination of wireless and wired network interface modules. In the present creative embodiment, the network lockout device 150 communicates with the networked device 110 via the communication module 151.

The processing unit 155 is connected to the communication module 151, and may be a central processing unit (CPU), or other programmable general purpose or special purpose microprocessor (Microprocessor), digital signal processor (Digital Signal Processor, DSP), Programmable Controller, Application Specific Integrated Circuit (ASIC) or other similar components or a combination of the above components. In the present creative embodiment, the processing unit 155 is configured to perform all operations of the network lockout device 150.

In order to facilitate the understanding of the operation flow of the present creative embodiment, the network blocking method of the network lockout device 150 in the present creative embodiment will be described in detail below. FIG. 3 is a flow chart showing a method of network blocking according to an embodiment of the present invention. Referring to FIG. 3, the method of this embodiment is applicable to the network lockout device 150 of FIGS. 1 and 2. Hereinafter, the method described in the novel creation embodiment will be described in terms of various components and modules in the network blocking device 150. The various processes of the method can be adjusted accordingly according to the implementation situation, and are not limited thereto. In addition, the novel creation embodiment can be divided into active blocking and passive blocking, and the following will first explain the active blocking.

In step S310, the processing unit 155 of the network lockout device 150 determines whether the networked device 110 belongs to the blocked group. Specifically, the network administrator sets a management policy for the network management of each connected device 110 in the domain to which the network belongs. This management policy may be for identity confirmation, system update, virus pattern update, disabling software, network abnormality, networked device 110 newly joined to the domain, IP conflict, regulatory requirements, etc., and the present creative embodiment is not limited. For the networked device 110 that violates the management policy, the new authoring embodiment includes the networked devices 110 in the blocking group to further block the communication transmission of the blocking group in the domain to avoid blocking the group. Each of the networked devices 110 affects the networked devices 110 of other non-blocking groups (eg, normal groups) via the network.

It should be noted that since the network blocking device 150 is used as the network control center in the network, it has stored connection information (for example, IP address, physical bit) of each networked device 110 in the network domain. Address (or MAC address), port, virtual local area network (VLAN) ID (Identifer; ID), device information (for example, computer name, group name, etc.) Such information may also assist in determining whether the networked device 110 belongs to a blocked group through instant event detection (eg, excessive traffic, IP address expiration, login operation, loading disabled software, usage time exceeding a predetermined shutdown time, etc.).

In step S330, the processing unit 155 of the network lockout device 150 generates a fake address. This fake address is excluded from the physical address of the networked device 110 in this blocked group. Specifically, in the ARP process, device A sends an ARP request packet for the inquiry of the physical address of device B, and device B can respond to its physical address to device A to ensure smooth communication between subsequent devices A and B. . In order to achieve the purpose of network blocking, in the active blocking embodiment, the network blocking device 150 will generate a spoofed address by each networked device 110 in the blocking group to enable the network domain to be connected. When the network device 110 intends to transmit data to the networked device 110 in the blocked group, the data is transmitted to the forged address. Thereby, the data to be transmitted to the networked devices 110 in the blocked group cannot be successfully delivered.

The fake address can be set to the physical address of the network blocking device 150, a specific physical address (for example, 00:00:00:00:00:01, FF:FF:FF:00:00:00, etc.) or The physical address generated by the random number, any physical address that is different or unrelated to the networked device 110 in the blocked group, except 00:00:00:00:00:00 and FF:FF:FF:FF:FF: FF can be applied, this new creation is not limited to this.

In step S350, for each networking device 110 in the blocking group, the processing unit 155 of the network blocking device 150 broadcasts the forged packet through the communication module 151. The fake packet includes one of the aforementioned forged addresses. In this embodiment, the forged packet is a GARP response packet. The processing unit 155 sequentially (for example, every 0.03 seconds or 0.05 seconds for the next networked device 110 to be blocked) broadcasts the networked device 110 in the blocking group, including the forged address through the communication module 151. One of the GARP response packets. In addition, the GARP response packet further includes an IP address of one of the networked devices in the blocked group.

Specifically, it is assumed that in a scenario, there are n networked devices 110 in a certain area network (including the blocked device C of the blocked group, n is a positive integer). The processing unit 155 can send the forged ARP packets (including the forged address) to the other n-1 (except the blocking device C) networking devices 110 through the communication module 151 to notify the n-1 networked devices 110. The MAC address of C is this fake address (for example, 00:00:00:00:00:01). When the n-1 devices want to transmit data to device C, the data is transmitted to the fake MAC address, so that the data cannot be correctly delivered to device C.

In another scenario, in order to block the communication of the device C to the other n-1 networked devices 110, the processing unit 155 of the network blocking device 150 needs to send n-1 forged ARP packets to the device C through the communication module 151. To tell device C that the MAC addresses of the n-1 network connected devices 110 are fake addresses. Therefore, when the device C wants to transmit data to the n-1 networked devices 110, the data is transmitted to the forged address, so that the data sent by the device C cannot be correctly sent to the n-1 networked devices 110. .

In the foregoing two scenarios, in order not to affect the operation of the networked device 110, the processing unit 155 usually needs to stop, for example, 0.03 seconds, and then send one forged ARP packet every time the communication module 151 sends one forged ARP packet. However, the forged ARP packet information existing in the networked device 110 is time-sensitive, so the processing unit 155 must retransmit the forged ARP packet information to the networked device 110 through the communication module 151 every 60 seconds. Otherwise, these forged ARP packet information will expire, which will not effectively block the communication between devices, so the above situation has the following disadvantages:

a. The number of networked devices 110 increases, which will result in the failure of the blocking. Assume that there are 1200 connected devices 110. In order to block the communication between one of the devices C and the other 1199 connected devices 110, the network blocking device 150 needs to access the other 1199. The station connection devices 110 (except the device C) each send a fake ARP packet to inform the 1199 connection devices 110 that the MAC address of the device C is a certain forged address. The network blocking device 150 also needs to send 1199 forged ARP packets to the device C to inform the device C that the MAC address of the 1199 connecting devices 110 is a certain forged address. Therefore, the foregoing example sends a total of 1199 + 1199 = 2398 forged ARP packets to block communication between device C and other 1199 wired devices 110. However, since sending a fake ARP packet requires 0.03 seconds to send another fake ARP packet, sending 2398 forged packets takes at least (2398 - 1) * 0.03 seconds = 71.91 seconds. In this way, the forged ARP packet information received by the connection device 110 11 seconds before the start may be invalidated or expired in 60 seconds to 71 seconds. At this time, the device C has an opportunity to perform with other 1199 connection devices 110. communication.

b. If the device is to be blocked, the blocking will be invalid. Assume that there are 500 connecting devices 110 on the line, and 5 devices D to H should be blocked. The processing unit 155 of the network blocking device 150 needs to send a forged ARP packet to the other 495 connecting devices 110 through the communication module 151, and needs to send 495 forged ARP packets to the device D (the forging of the blocking devices E to H) The ARP packet is sent in the same or similar manner to the blocking device D, and will not be described here. Therefore, the communication between the blocking device D~H and the other 495 connection devices 110 needs to be sent (495 + 495) * 5 = 4950 forged ARP packets, which takes at least (4950 - 1) * 0.03 seconds = 148.47 seconds The forged ARP packet information received by these connection devices 110 will expire in 60 seconds to 148 seconds. In this way, the devices D to H have the opportunity to communicate with other 495 devices in 60 seconds to 148 seconds.

In order to solve the foregoing shortcomings, in the embodiment of the novel authoring active blocking, the broadcast GARP response packet is borrowed (the destination MAC address is, for example, FF: FF: FF: FF: FF: FF, and the destination IP address is, for example, 0.0.0.0), the processing unit 155 of the network blocking device 150 generates a corresponding GARP response packet to each networked device 110 in the blocking group through the communication module 151. The IP address of each GARP response packet is set to block the IP address of one of the network devices 110 in the group, and the source MAC address is one of the forged addresses to notify the network device 110. The MAC address of a particular IP address (i.e., the IP address of one of the networked devices 110 in the blocked group) is a forged address.

For example, if the IP address of device C is 192.168.4.6, the source IP address in the fake GARP response corresponding to device C is set to 192.168.4.6, and the source MAC address is set to 00:00:00: 00:00:01.

Compared with the previously mentioned scenario (need to send a fake ARP packet to each of the other n-1 networked devices 110, a total of n-1 forged ARP packets are sent), the novel authoring embodiment is directed to the block group One of the network devices 110 (e.g., device C) only needs to send a fake GARP response packet, so that other n-1 networked devices 110 can receive the MAC address of device C as a forged address. Therefore, when the n-1 network connected devices 110 want to transmit data to the device C, the data is transmitted to the forged address and cannot be correctly transmitted to the device C.

In addition, the processing unit 155 of the network lockout device 150 can again broadcast the gratuitous address resolution protocol response through the communication module 151 before a certain GARP response packet (eg, for a networked device 110 in the blocked group) fails. Packet. Specifically, the gratuitous address resolution protocol response packet is time-sensitive (eg, sixty seconds, fifty seconds, etc.). Therefore, the processing unit 155 of the network lockout device 150 needs to broadcast the same or different again through the communication module 151 every certain time (for example, sixty seconds or a defined time of the aforementioned timeliness) (for example, the fake address can be changed, but the GARP The source IP address in the response packet is the GARP response packet of the networked device 110 in the blocking group until the networked device 110 to be blocked does not belong to the blocking group.

On the other hand, in the embodiment of the passive blocking, in step S310, the processing unit 155 of the network blocking device 150 further retrieves the ARP request packet through the communication module 151, and determines whether the source in the ARP request packet corresponds to the blocking group. Networked devices in the group. Specifically, when each networked device 110 in the blocking group wants to communicate with other networked devices 110, each connected device 110 in the blocking group broadcasts an ARP request packet in an attempt to obtain other networking of the desired communication. The MAC address of device 110. The processing unit 155 monitors the broadcast ARP request packet through the communication module 151, and extracts the ARP request packet sent by each networked device 110 in the blocking group.

Then, if the source in the ARP request packet corresponds to the networked device 110 in the blocked group, the processing unit 155 of the network blocking device 150 further transmits the ARP response packet including one of the forged addresses through the communication module 151. To the networked device 110 (which belongs to the blocked group) that sends the ARP request packet. The source IP address in the ARP response packet is set to the source IP address in the ARP request packet, and the source MAC address is set to the fake address (for example, 00:00:00:00:00:01), and the purpose The IP address and MAC address are the IP address and MAC address of the networked device 110 that sends the ARP request packet.

For example, device C sends an ARP request packet (including the destination IP address of 192.168.9.5), and the network blocking device 150 receives the ARP request packet, and responds to the forged ARP response packet (including the source IP address is 192.168.9.5, source MAC address is fake 00:00:00:00:00:01, destination IP address and MAC address is device C's IP address and MAC address) to device C.

Conversely, if the source in the ARP request packet does not correspond to the networked device 110 in the blocked group, the processing unit 155 of the network lockout device 150 does not respond to the falsified response packet.

Compared with the previously mentioned scenario (need to inform the device C that the other n-1 networked devices 110 have a forged address, a total of n-1 forged ARP packets are sent), the novel authoring embodiment only needs to block through the interception. The ARP request packets sent by the networked device 110 in the group can effectively block the communication of the networked devices 110. When the device C belonging to the blocked group wants to transmit data to the other n-1 networked devices 110, the data is transmitted to the forged address, so that the networked device 110 to be communicated cannot be correctly transmitted.

In order to let those skilled in the art understand the operation flow of the novel creation, an example is given below. 4 is a flow chart illustrating a network lockout. Please refer to FIG. 1 and FIG. 4 at the same time. In the following, the implementation scenario will be described in conjunction with the networked device 110 and the network blocking device 150 of FIG. The various processes can be adjusted accordingly according to the implementation situation, and are not limited thereto.

First, the network lockout device 150 determines whether it is necessary to perform blocking based on a management policy (for example, whether to disable the software, whether the system is updated, whether the virus code is updated, etc.) (step S410), and (if yes, an event that violates the management policy occurs) The networked device 110 is divided into a normal group and a blocked group (step S420). It is assumed that the normal group has x network connected devices 110, and the blocked group has y connected devices 110. x and y are positive integers.

In order to block the normal group from transmitting data to the blocked group (ie, active network blocking), the network blocking device 150 sequentially sends out y forged GARP every 60 seconds and each interval of the blocking group is 0.03 seconds. The response packet is sent (step S430). The y GARP response packets respectively indicate that the MAC address of the y networked device 110 is a fake address (for example, 00:00:00:00:00:01). The x network connected devices 110 sequentially receive the y fake GARP response packets, and the MAC addresses of the y networked devices 110 are considered to be fake addresses (for example, 00:00:00:00: 00:01). Therefore, when the x networking devices 110 are to transmit data to the y networking device 110, their data will be transmitted to the MAC forgery address of the non-existing device, thereby achieving the purpose of communication blocking. On the other hand, if no blocking is required, the network lockout device 150 stops capturing the ARP request packet (step S440), and ends the program accordingly (step S450).

For the data transfer of the blocking group to the normal group (ie, passive network blocking), the network blocking device 150 determines whether to stop capturing the ARP request packet (step S460). If so (for example, y is zero), the program is terminated (step S450). On the other hand, if no (for example, y is 5), the network lockout device 150 retrieves the ARP request packet (step S470). Next, the network lockout device 150 determines whether the ARP request packet belongs to the blockade group (step S480). If (for example, the source of the ARP request packet is the y networked device 110 belonging to the blocked group), the network blocking device 150 responds to the forged ARP of one of the y networked devices 110 that send the ARP request packet. The response packet (for example, the source IP address is the destination IP address set in the ARP request packet, and the source MAC address is set to 00:00:00:00:00:01) (step S490). Therefore, when one of the y-networking devices 110 (for example, device y1) is to transmit data to one of the x-networked devices 110 (for example, device x1), the data is transmitted to the non-existent Forged address. In addition, when these forged ARP response packets fail in 60 seconds, device y1 may issue an ARP request packet again to query the MAC address of device x1. The network blocking device 150 also responds to the device y1 with a fake ARP response packet (for example, the source MAC address is set to 00:00:00:00:00:01) in response to the device y1, the MAC bit of the device x1 only The non-existent MAC address is 00:00:00:00:00:01. In this way, the cycle is repeated to achieve the purpose of communication blockade.

In an embodiment of the present invention, the network blocking method can be implemented as a computer program on a non-transitory computer readable storage medium, and the computer program includes a plurality of instructions for implementing the network blocking method after execution. Each step. For example, the computer readable storage medium can be any data storage device that can be read by a computer system, including a read only memory (ROM) and a random access memory (RAM). A compact disc read only memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and a transmission medium are not limited herein.

In summary, the network blocking device proposed by the novel creation embodiment and the computer readable storage medium can block the normal group by blocking the fake GARP response packet and passively responding to the fake ARP response packet. Group and block group data transfer to normal groups.

Accordingly, in view of the aforementioned shortcomings a. (increased on-line equipment), it is assumed that there are 1200 uplink network-connected devices. In order to block 1199 network-connected devices from communicating with device C, the present creative embodiment only needs to send a fake GARP response packet. Inform the 1199 networked devices that the MAC address of device C is a fake MAC address. Sending this GARP response packet time will not exceed 60 seconds, so that these fake GARP response packet information can have enough time to retransmit the fake GARP response packet before the next 60 seconds expire. As for the blocking device C to communicate with 1199 networked devices, since the device C broadcasts the ARP request packet before the communication to try to obtain the MAC address of the networked device to be communicated, the device C falsifies the ARP according to the packet information of the ARP request packet. In response to the packet (in response to the MAC address of the network device to which the device C is about to communicate is a forged MAC address), device C cannot transmit the data to the networked device to be communicated. If the device C sends the ARP broadcast packet again to query the MAC address of the communication network device, the new creation embodiment can also respond to the device C forging the ARP packet according to the information related to the ARP request packet (also telling the device C to communicate) The MAC address of the networked device is a fake address), so that it continues until the device C stops communicating with other normal devices.

For the above disadvantages b. (to increase the number of devices to be blocked), it is assumed that there are 500 online connected devices. In order to block 495 normal devices from communicating to devices D to H, the prior art can send 5 fake GARP response packets to inform this. 495 devices The MAC address of the device D to H is a fake MAC address (the five fake GARP response packets are sent at intervals of 0.03 seconds). Sending 5 GARP response packets contains a transmission interval of approximately (5 - 1) * 0.03 = 0.12 seconds, which does not exceed 60 seconds. Therefore, the five fake GARP response packet information will be retransmitted to the five fake GARP response packets immediately before the next 60 seconds expire. As for the blocking device D ~ H to communicate with 495 devices, because the device D ~ H will send an ARP request packet before communication with the normal device to try to obtain the MAC address of the normal device, so as long as the information is encapsulated according to the ARP request, it can respond The device D~H forges the ARP packet (in response to the normal device MAC address to be communicated by the device D~H as the forged address), the device D~H cannot transmit the data to the networked device to be communicated.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the novel creation, and any person skilled in the art can make some changes without departing from the spirit and scope of the novel creation. Retouching, the scope of protection of this new creation is subject to the definition of the scope of the patent application attached.

10‧‧‧Communication system
110‧‧‧Networking equipment
150‧‧‧Network blocking equipment
151‧‧‧Communication Module
155‧‧‧Processing unit
S310～S350, S410～S490‧‧‧ steps

1 is a schematic diagram of a communication system in accordance with an embodiment of the present invention. 2 is a block diagram showing the components of a network lockout device in accordance with an embodiment of the present invention. FIG. 3 is a flow chart showing a method of network blocking according to an embodiment of the present invention. 4 is a flow chart illustrating a network lockout.

150‧‧‧Network blocking equipment

151‧‧‧Communication Module

155‧‧‧Processing unit

Claims (6)

A network blocking device is configured to perform network management on a plurality of networked devices in a network domain, including: a communication module for transmitting and receiving packets; a processing unit coupled to the communication module, and And configured to: determine whether the networked devices belong to a lock group; generate at least one fake address, wherein the at least one fake address is excluded from the physical bits of the networked devices in the blocked group Outside the address; and for each of the networked devices in the blocked group, a forged packet is broadcast through the communication module, wherein the forged packet includes one of the at least one forged address. The network blocking device of claim 1, wherein the forged packet is a gratuitous address resolution protocol response packet, and the processing unit is further configured to perform: sequentially for each of the blocking groups The networked device broadcasts, by the communication module, the gratuitous address resolution agreement response packet including one of the at least one forged address, wherein the gratuitous address resolution agreement response packet further includes the block in the block group The internet protocol address of one of the networked devices. The network blocking device of claim 2, wherein the processing unit is further configured to: perform the free address resolution through the communication module again before the gratuitous address resolution protocol response packet fails The agreement responds to the packet. The network blocking device of claim 1, wherein the processing unit is further configured to: retrieve an address resolution protocol request packet through the communication module; and determine that the address resolution protocol requires a packet Whether the source in the corresponds to the networked devices in the blocked group. The network blocking device of claim 4, wherein the processing unit is further configured to perform: if the address resolution protocol requires the source in the packet to correspond to the networking in the blocked group And transmitting, by the device, an address resolution protocol response packet including one of the at least one forged address. A computer readable storage medium for storing a computer program for loading into a network lockout device and causing the network lockout device to perform at least the following steps: determining whether a plurality of networked devices belong to a Blocking the group; generating at least one spoofed address, wherein the at least one spoofed address is excluded from the physical address of the networked devices in the blocked group; and the plurality of connected networks in the blocked group The device broadcasts a spoofed packet, wherein the falsified packet includes one of the at least one spoofed address.