3Com 4210G Series, Configuration Manual, Page: 228 / 1133

4-2
Displaying and Maintaining ARP Source Suppression
To do… Use the command… Remarks
Display the ARP source suppression
configuration information
display arp source-suppression
Available in any view
Configuring ARP Defense Against IP Packet Attacks
Introduction to ARP Defense Against IP Packet Attacks
When forwarding an IP packet, a device depends on ARP to resolve the MAC address of the next hop.
If the address resolution is successful, the forwarding chip forwards the packet directly. Otherwise, the
device runs software for further processing. If the device cannot resolve the next hops for large
numbers of incoming packets, the CPU of the device will be exhausted. This is called IP packet
attacks.
To protect a device against IP packet attacks, you can enable the ARP defense against IP packet
attacks function. After receiving an IP packet whose next hop cannot be resolved by ARP, a device with
this function enabled creates a black hole route immediately and the forwarding chip simply drops all
packets matching the next hop during the age time of the black hole route.
Enabling ARP Defense Against IP Packet Attacks
The ARP defense against IP packet attack function applies to packets to be forwarded and those
originated by the device.
Follow these steps to configure ARP defense against IP packet attacks:
To do… Use the command… Remarks
Enter system view
system-view
—
Enable ARP defense against IP packet
attacks
arp resolving-route enable
Optional
Enabled by default.
Configuring ARP Active Acknowledgement
Introduction
Typically, the ARP active acknowledgement feature is configured on gateway devices to identify invalid
ARP packets.
With this feature enabled, the gateway, upon receiving an ARP packet with a different source MAC
address from that in the corresponding ARP entry, checks whether the ARP entry has been updated
within the last minute:
z
If yes, the gateway does not update the ARP entry;
z
If not, the gateway unicasts an ARP request to the source MAC address of the ARP entry.
Then,
z
If an ARP reply is received within five seconds, the ARP packet is ignored;
z
If not, the gateway unicasts an ARP request to the MAC address of the ARP packet.