216
Step Command
Remarks
2.
Enable source MAC-based
ARP attack detection and
specify the handling method.
arp source-mac
{
filter
|
monitor
}
By default, this feature is disabled.
3.
Configure the threshold.
arp source-mac threshold
threshold-value
By default, the threshold is 30.
4.
Configure the aging timer for
ARP attack entries.
arp source-mac aging-time
time
By default, the lifetime is 300
seconds.
5.
(Optional.) Exclude specified
MAC addresses from this
detection.
arp source-mac exclude-mac
mac-address
&<1-10>
By default, no MAC address is
excluded.
NOTE:
When an ARP attack entry expires, ARP packets sourced from the MAC address in the entry can be
processed normally.
Displaying and maintaining source MAC-based ARP attack
detection
Execute
display
commands in any view.
Task Command
Display ARP attack entries detected by source
MAC-based ARP attack detection.
display arp source-mac
{
slot
slot-number
|
interface
interface-type
interface-number
}
Configuration example
Network requirements
As shown in
, the hosts access the Internet through a gateway (Device). If malicious users send
a large number of ARP requests to the gateway, the gateway may crash and cannot process requests
from the clients. To solve this problem, configure source MAC-based ARP attack detection on the
gateway.