3Com Switch 7754, Configuration Manual

Page: 575 / 940

Configuring ARP 575
Introduction to ARP
Packet Rate Limit
If an attacker sends a large number of ARP packets to a port of a switch, the CPU
will get overloaded, causing other functions to fail, and even the whole device to
break down. To guard against such attacks, Switch 7750 Ethernet switches
support the ARP packets rate limit function, which can disable the attacked port
from receiving any packet temporarily, thus preventing serious impact on the CPU.
With this function enabled on a port, the switch will count the ARP packets
received on the port within each second. If the number of ARP packets received on
the port per second exceeds the preconfigured value, the switch considers that the
port is being attacked by ARP packets. In this case, the switch disables the port
from receiving any packet, generates an alarm message, and logs the event. At the
same time, the switch continues to count the ARP packets on the port. If the
number of received ARP packets remains under the preconfigured value for a
certain period (port state auto-recovery interval), the port will revert to the Up
state.
Switch 7750 Ethernet switches support configuring trusted ports for ARP packet
rate limit. A switch does not count ARP packets or limit ARP packets received on a
trusted port.
Introduction to ARP
Source Suppression
With the ARP source suppression function, the switch classifies incoming ARP
packets and limits the maximum number of ARP packets with the same type that
can be sent to the CPU in a time of time, so as to protect the CPU from being
attacked by illegal ARP packets generated by ARP scanning of a host to the whole
network.
A Switch 7750 classifies incoming ARP packets into the following types:
■
Arbitrary ARP packets, whose source/destination IP addresses are not
distinguished
■
Pass-through ARP packets, whose source IP addresses are the same one and
destination IP addresses are not the IP address of the current switch
■
Locally-terminated ARP packets, whose source IP addresses are the same one
and destination addresses are the IP address of the current switch.
For each type, you can set the maximum number of ARP packets that can be sent
to the CPU in a unit of time on the switch. When the number of ARP packets
received in a unit of time exceeds the corresponding setting, the switch will regard
the exceeding ones as illegal ARP packets and discard them.
Configuring ARP
ARP entries in a Switch 7750 can be one of two types; static or dynamic, as
described in Table 447.
Table 447 ARP entry
ARP entry Generation method Maintenance method
Static ARP entry Manually configured Manual maintenance
Dynamic ARP entry Dynamically generated A dynamic ARP entry ages out when ARP
aging timer expires.