【正文】 t impact reliability, and these above all for head check sum should by still higher level agreement (UDP and TCP) preside. 3. Tone toward spread and option 39。support up (4) Stream tag (5) Both identity authentication and secrecy 1. Spread address The clean culture address and design to appoint by one or more of mainframe intercept 39。ACL, foundation security user tunnel grade came kept away aim at two tiered attack； Past route filtration, versus route informational encrypt and authentication, orient multicasting control, bump route rapidity of convergence withal relieve route oscillation impact grade measure, came muscle threeply Network security up at up. In order to pose construct safety Tnumber, return ought adopt rest safety precautions.(one)incorporation AAA authentication, natpt, two/threeply mpls VPN, repose ACL standard visit list and static state spread visit list, phony sliver fold attack grade came realize safety precautions in.(two)past route filtration, static route, policy route and route loadsharing came realize security route.(three)through the medium of sshv2(secure shell beta two edition), snmpv3(Simple Network Management Protocol beta three edition), ex., endue tenor visit security, line visit security with.(four)through the medium of Hierarchical Direct, customtailor privilege class supervise grade instrument came realize Network security management.(five)past sophisticated alarm, log and audit function realize work clock.(six)supply visit list and in such a way that sshv2(secure shell beta two edition), snmpv3(Simple Network Management Protocol beta three edition), endue tenor visit security, line visit security with.(four)past Hierarchical Direct, customtailor privilege class supervise grade instrument critical event deplete work resource of potential safety hazard, such as both encapsulation attack, broadcast packet attack, MAC waterflooding, spanning tree attack grade second floor attack, as well as mendacious ICMP messenger, ICMP waterflooding, source address beguile , route oscillation grade aim at threeply consultative attack into erect security user tunnel grade came kept away aim at two tiered attack； in such a way that route filtration, versus route informational encrypt and authentication, orient multicasting control, advance route rapidity of convergence withal alleviate route oscillation impact grade measure, filter , versus route informational encrypt and authentication, orient multicasting control, bump route rapidity of convergence withal relieve route oscillation impact grade measure, came muscle threeply Network security up at up out for above physical layer upwards stratification plane, subsistent potential safety hazard mostly has be from aim at different kinds of consultative security menace, as well as with a view of illegality 9 occupancy work resource or exhaust work resource39。graveness superiority at rest with that the log, routing protocol event and error logging grade, for administration of works personnel make fault analysis, orient and statistics of the both the security of the both the attack； past MAC address and IP address binding, confine per port 39。 encryption (Part of past encrypt should grouping stash) 6. limited traffic flow management (The IP address of the conceal originality dispatcher) 7. key management IPSec frame initially definitive agreement include inspect weight head (AH), encapsulation security lotus (ESP) and key management. 2 IPSec:IP layer protocol security IPSec protocol bring necessity forth IPSec at IP layer endue safety service, it lead system be able to according to require select secure protocol, take serve station utilized algorithm in time for clap demand serve required key to relevant OSI in for to with. The path of the IPSec be used to shield a stick of or multiyear mainframe and mainframe partment, safety shut and safety shut partment, safety shut and mainframe partment. Both IPSec be able to submitted safety service multitude include access control, connectionless integrality, data source authentication, reject retransmitted packet(partial sequence integrality form), privacy and finitude transmission current privacy. For these serve equal at IP layer endue, so any higher level protocol use they, for instance TCP, UDP, ICMP, BGP and so on. It was through the medium of twain large transmission secure protocol, header authentication(AH)and encapsulation safe load(ESP), and key manager harmonize discuss 39。authentication mechanism and security measure in of whereas IP address lie heap problem, consultative maxima shorting namely sans versus IP address. It was repose IP protocol of last, TCP subsection and UDP protocol data packet is encapsulation be on the security menace of IP WRAPT suffer at work upper Tran missive, wherefore sameness be confronted with IP layer station encounter that owing to UDP. Now that people all the while in thought method set, yet still avoid less namely as per TCP tie hour in at rest thrice handshake Machinemade attack. Either these attack summarize arisen include： One: source address cheat(source address spoofing) or IP cheat(IP spoofing)； Two: source routing select cheat(source routing spoofing)； Three: rip attack(rip attacks)； Four: discriminate attack(authentication attacks)； 3 Five: TCP serial number cheat(TCP sequence number spoofing)； Six: TCP/IP protocol data stream adopt plaintext transmission； Seven: TCP serial number BOMB attack(TCP SYN flooding attack), for short SYN attack； Eight: easy fraudulence (ease of spoofing). Network Security Both moiety end user versus thereof visit, furthermore enterprise work proper no more will exterior closed among be mainframe puter system suffer among it was one relatively walkway that it was resource that both that of one be indispensable