2-2
Configuring ARP Source Suppression
Introduction to ARP Source Suppression
If a device receives large numbers of IP packets from a host to unreachable destinations,
z
The device sends large numbers of ARP requests to the destination subnets, which increases the
load of the destination subnets.
z
The device continuously resolves destination IP addresses, which increases the load of the CPU.
To protect the device from such attacks, you can enable the ARP source suppression function. With the
function enabled, whenever the number of ARP requests triggered by the packets with unresolvable
destination IP addresses from a host within five seconds exceeds a specified threshold, the device
suppresses the sending host from triggering any ARP requests within the following five seconds.
Configuring ARP Source Suppression
Follow these steps to configure ARP source suppression:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable ARP source suppression
arp source-suppression
enable
Required
Disabled by default.
Set the maximum number of packets with the
same source IP address but unresolvable
destination IP addresses that the device can
receive in five consecutive seconds
arp source-suppression
limit limit-value
Optional
10 by default.
Displaying and Maintaining ARP Source Suppression
To do…
Use the command…
Remarks
Display the ARP source suppression
configuration information
display arp
source-suppression
Available in any view
Configuring ARP Active Acknowledgement
Introduction to ARP Active Acknowledgement
Typically, the ARP active acknowledgement feature is configured on gateway devices to identify invalid
ARP packets.
ARP active acknowledgement works before the gateway modifies an ARP entry to prevent an incorrect
ARP entry being generated. For details about the working mechanism, refer to
ARP Attack Protection
Technology White Paper
.
Configuring ARP Active Acknowledgement
Follow these steps to configure ARP active acknowledgement:
