H3C S3100 Series, Operation Manual

Page: 489 / 1057

1-5
packets, or through trusted ports if the MAC address table contains no such destination MAC
addresses.
Introduction to ARP Packet Rate Limit
To prevent the man-in-the-middle attack, a switch enabled with the ARP attack detection function
delivers ARP packets to the CPU to check the validity of the packets. However, this causes a new
problem: If an attacker sends a large number of ARP packets to a port of a switch, the CPU will get
overloaded, causing other functions to fail, and even the whole device to break down. To guard against
such attacks, S3100-EI series Ethernet switches support the ARP packets rate limit function, which will
shut down the attacked port, thus preventing serious impact on the CPU.
With this function enabled on a port, the switch will count the ARP packets received on the port within
each second. If the number of ARP packets received on the port per second exceeds the preconfigured
value, the switch considers that the port is attacked by ARP packets. In this case, the switch will shut
down the port. As the port does not receive any packet, the switch is protected from the ARP packet
attack.
At the same time, the switch supports automatic recovery of port state. If a port is shut down by the
switch due to high packet rate, the port will revert to the Up state after a configured period of time.
Introduction to Gratuitous ARP
The following are the characteristics of gratuitous ARP packets:
z
Both source and destination IP addresses carried in a gratuitous ARP packet are the local
addresses, and the source MAC address carried in it is the local MAC addresses.
z
If a device finds that the IP addresses carried in a received gratuitous packet conflict with those of
its own, it returns an ARP response to the sending device to notify of the IP address conflict.
By sending gratuitous ARP packets, a network device can:
z
Determine whether or not IP address conflicts exist between it and other network devices.
z
Trigger other network devices to update its hardware address stored in their caches.
The gratuitous ARP packet learning function:
When the gratuitous ARP packet learning function is enabled on a switch and the switch receives a
gratuitous ARP packet, the switch can add the information carried in the packet to its own dynamic ARP
mapping table if it finds no corresponding ARP entry for the ARP packet in the cache.
ARP Configuration
Configuring ARP Basic Functions
Table 1-4 Configure ARP basic functions
Operation Command Remarks
Enter system view system-view —
Add a static ARP entry
arp static ip-address
mac-address
[ vlan-id
interface-type
interface-number
]
Optional
By default, the ARP
mapping table is empty,
and the address mapping
entries are created
dynamically by ARP.