-
0001-0001-0001 3333/- -
blackhole
------------------------------------------------------------------------------
-
Total items displayed = 1
If a blackhole MAC address entry is displayed, run the
undo mac-address blackhole
command to delete it.
2.
Run the
display this
command in the interface view or VLAN view.
l
If the command output contains
mac-limit maximum
, the number of learned MAC
addresses is limited. Run either of the following commands:
–
Run the
undo mac-limit
command in the interface or VLAN view to disable MAC
address limiting.
–
Run the
mac-limit
command in the interface or VLAN view to increase the
maximum number of learned MAC addresses.
l
Run the
display this
command in the interface view. If the command output contains
port-security max-mac-num
or
port-security enable
, the number of secure dynamic
MAC addresses is limited on the interface. Run either of the following commands:
NOTE
By default, the limit on the number of secure dynamic MAC addresses is 1 after port security is enabled.
–
Run the
undo port-security enable
command in the interface view to disable port
security.
–
Run the
port-security max-mac-num
command in the interface view to increase
the maximum number of secure dynamic MAC addresses on the interface.
Step 5
Check whether the number of learned MAC addresses has reached the maximum supported by
the AR2200-S.
Run the
display mac-address summary
command to check the number of MAC addresses in
the MAC address table.
l
If the number of learned MAC addresses has reached the maximum, no MAC address entry
can be created. Run the
display mac-address
command to view MAC address entries.
–
If the number of MAC addresses learned on an interface is much more than devices on
the network connected to the interface, the MAC address table may be maliciously
updated by an attacker. Check the device connected to the interface:
–
If the interface is connected to a device, run the
display mac-address
command on
the device to view its MAC address table. Locate the interface connected to the
malicious user according to the displayed MAC address entries. If the interface that
you find is connected to another device, repeat this step until you find the user of
the malicious user.
–
If the interface is connected to a computer, perform either of the following operations
after obtaining permission of the administrator:
–
Disconnect the computer. When the attack stops, connect the computer to the
network again.
–
Run the
port-security enable
command on the interface to enable port security
or run the
mac-limit
command to set the maximum number of MAC addresses
that the interface can learn to 1.
Huawei AR2200-S Series Enterprise Routers
Troubleshooting
4 LAN
Issue 01 (2012-01-06)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
65
