H3C SOHO IE4300, Command Reference Manual

Page: 2499 / 3296

9
Parameters
mac-address &<1-10>
: Specifies a MAC address list. The
mac-address
argument indicates an
excluded MAC address in the format of H-H-H.
&<1-10>
indicates that you can specify a maximum
of 10 excluded MAC addresses each time.
Usage guidelines
If you do not specify a MAC address, the undo arp source-mac exclude-mac command
removes all excluded MAC addresses.
You can repeat this command to configure a maximum of 64 MAC addresses excluded from source
MAC-based ARP attack detection.
Examples
# Exclude a MAC address from source MAC-based ARP attack detection.
<Sysname> system-view
[Sysname] arp source-mac exclude-mac 001e-1200-0213
arp source-mac log enable
Use arp source-mac log enable to enable logging for source MAC-based ARP attack
detection.
Use undo arp source-mac log enable to disable logging for source MAC-based ARP attack
detection.
Syntax
arp source-mac log enable
undo arp source-mac log enable
Default
Logging for source MAC-based ARP attack detection is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
When the device detects a source MAC-based ARP attack, it generates a log message and sends it
to the information center. For information about the log destination and output rule configuration in
the information center, see
Network Management and Monitoring Configuration Guide .
The log messages help administrators to locate and solve problems.
Examples
# Enable logging for source MAC-based ARP attack detection.
<Sysname> system-view
[Sysname] arp source-mac log enable
arp source-mac threshold
Use
arp source-mac threshold
to set the threshold for source MAC-based ARP attack
detection. If the number of ARP packets sent from a MAC address within 5 seconds exceeds this
threshold, the device recognizes this as an attack.