DWS-3160 Series Gigabit Ethernet Unified Switch CLI Reference Guide
943
prevent ARP spoofing attack, we will demonstrate here via using Packet Content ACL on the
Switch to block the invalid ARP packets which contain faked gateway’s MAC and IP binding.
Configuration
The configuration logic is as follows:
•
Only if the ARP matches Source MAC address in Ethernet, Sender MAC address and Sender
IP address in ARP protocol can pass through the Switch. (In this example, it is the gateway’s
ARP.)
•
The Switch will deny all other ARP packets which claim they are from the gateway’s IP.
The design of Packet Content ACL on the Switch enables users to inspect any offset chunk. An
offset chunk is a 4-byte block in a HEX format, which is utilized to match the individual field in an
Ethernet frame. Each profile is allowed to contain up to a maximum of four offset chunks.
Furthermore, only one single profile of Packet Content ACL can be supported per Switch. In other
words, up to 16 bytes of total offset chunks can be applied to each profile and a Switch. Therefore,
a careful consideration is needed for planning and configuration of the valuable offset chunks.
In Table 6, you will notice that the Offset_Chunk0 starts from the 127th byte and ends at the 128th
byte. It also can be found that the offset chunk is scratched from 1 but not zero.
Offset
Chunk
Offset
Chunk0
Offset
Chunk1
Offset
Chunk2
Offset
Chunk3
Offset
Chunk4
Offset
Chunk5
Offset
Chunk6
Offset
Chunk7
Offset
Chunk8
Offset
Chunk9
Offset
Chunk10
Offset
Chunk11
Offset
Chunk12
Offset
Chunk13
Offset
Chunk14
Offset
Chunk15
Byte
127
3
7
11
15
19
23
27
31
35
39
43
47
51
55
59
Byte
128
4
8
12
16
20
24
28
32
36
40
44
48
52
56
60
Byte
1
5
9
13
17
21
25
29
33
37
41
45
49
53
57
61
Byte
2
6
10
14
18
22
26
30
34
38
42
46
50
54
58
62
Offset
Chun
k
Offset
Chunk1
6
Offset
Chunk1
7
Offset
Chunk1
8
Offset
Chunk1
9
Offset
Chunk2
0
Offset
Chunk2
1
Offset
Chunk2
2
Offset
Chunk2
3
Offset
Chunk2
4
Offset
Chunk2
5
Offset
Chunk2
6
Offset
Chunk2
7
Offset
Chunk2
8
Offset
Chunk2
9
Offset
Chunk3
0
Offset
Chunk3
1
Byte
63
67
71
75
79
83
87
91
95
99
103 107 111 115 119 123
Byte
64
68
72
76
80
84
88
92
96
100 104 108 112 116 120 124
Byte
65
69
73
77
81
85
89
93
97
101 105 109 113 117 121 125
Byte
66
70
74
78
82
86
90
94
98
102 106 110 114 118 122 126
Table 6. Chunk and Packet Offset
The following table indicates a completed ARP packet contained in Ethernet frame which is the
pattern for the calculation of packet offset.
