1-3
Enabling ARP Black Hole Routing
Follow these steps to configure ARP black hole routing:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable ARP black hole routing
arp resolving-route enable
Optional
Enabled by default
Displaying and Maintaining ARP Source Suppression
To do…
Use the command…
Remarks
Display the ARP source suppression
configuration information
display arp source-suppression
Available in any view
Configuring ARP Packet Rate Limit
Introduction
This feature allows you to limit the rate of ARP packets to be delivered to the CPU. For example, if an
attacker sends a large number of ARP packets to an ARP detection enabled device, the CPU of the
device may become overloaded because all the ARP packets are redirected to the CPU for checking.
As a result, the device fails to deliver other functions properly or even crashes. To prevent this, you need
to configure ARP packet rate limit.
It is recommended that you enable this feature after the ARP detection is configured, or use this feature
to prevent ARP flood attacks.
Configuration Procedure
Follow these steps to configure ARP packet rate limit:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter Ethernet interface
view
interface interface-type
interface-number
—
Configure ARP packet rate
limit
arp rate-limit
{
disable |
rate pps drop
}
Required
By default, the ARP packet rate limit
is enabled and is 100 pps.
Configuring Source MAC Address Based ARP Attack Detection
Introduction
This feature allows the device to check the source MAC address of ARP packets. If the number of ARP
packets sent from a MAC address within five seconds exceeds the specified value, the device
considers this an attack and adds the MAC address to the attack detection table. Before the attack
