2-6
ARP detection mechanism
With ARP detection enabled for a specific VLAN, ARP messages arriving on any interface in the VLAN
are redirected to the CPU to have their MAC and IP addresses checked. ARP messages that pass the
check are forwarded, and other ARP messages are discarded.
Enabling ARP Detection Based on DHCP Snooping Entries/Static IP-to-MAC
Bindings
With this feature enabled, the device compares the source IP and MAC addresses of an ARP packet
received from the VLAN against the DHCP snooping entries, or static IP-to-MAC binding entries. You
can specify a detection type or types as needed.
1) After you enable ARP detection based on DHCP snooping entries for a VLAN,
z
Upon receiving an ARP packet from an ARP untrusted port, the device compares the ARP packet
against the DHCP snooping entries. If a match is found, that is, the parameters (such as IP address,
MAC addresses, port index, and VLAN ID) are consistent, the ARP packet passes the check; if not,
the ARP packet cannot pass the check.
z
Upon receiving an ARP packet from an ARP trusted port, the device does not check the ARP
packet.
z
If ARP detection is not enabled for the VLAN, the ARP packet is not checked even if it is received
from an ARP untrusted port.
ARP detection based on DHCP snooping entries involves both dynamic DHCP snooping entries and
static IP Source Guard binding entries. Dynamic DHCP snooping entries are automatically generated
through the DHCP snooping function. For details, refer to
DHCP Configuration
in the
IP Service Volume
.
Static IP Source Guard binding entries are created by using the
user-bind
command. For details, refer
to
IP Source Guard Configuration
in the
Security Volume
.
2) After you enable ARP detection based on static IP-to-MAC bindings, the device, upon receiving an
ARP packet from an ARP trusted/untrusted port, compares the source IP and MAC addresses of
the ARP packet against the static IP-to-MAC bindings.
z
If an entry with a matching IP address but a different MAC address is found, the ARP packet is
considered invalid and discarded.
z
If an entry with both matching IP and MAC addresses is found, the ARP packet is considered valid
and can pass the detection.
z
If no match is found, the ARP packet is considered valid and can pass the detection.
If all the detection types are specified, the system uses static IP-to-MAC binding entries first, then
DHCP snooping entries. To protect gateways, ARP detection based on IP-to-MAC binding entries is
required. After passing this type of ARP detection, users that can pass ARP detection based on DHCP
snooping entries are considered to be valid. The last two detection types are used to prevent ARP
spoofing. You can select detection types according to the networking environment.
z
If all access clients acquire IP addresses through DHCP, it is recommended that you enable DHCP
snooping and ARP detection based on DHCP snooping entries on your access device.
