Supermicro SSE-G2252, User Manual

Page: 864 / 1401

Chapter 24: General Security Measures
ARP Inspection
– 875 –
show ipv6
source-guard
binding
This command shows the IPv6 source guard binding table.
S
YNTAX
show ipv6 source-guard binding [ dynamic | static ]
dynamic - Shows dynamic entries configured with ND Snooping or
DHCPv6 Snooping commands (see page 854 )
static - Shows static entries configured with the ipv6 source-guard
binding command.
C
OMMAND
M
ODE
Privileged Exec
E
XAMPLE
Console#show ipv6 source-guard binding
MAC Address IPv6 Address VLAN Interface Type
-------------- --------------------------------------- ---- --------- ----
00AB-11CD-2345 2001::1 1 Eth 1/5 STA
Console#
ARP I
NSPECTION
ARP Inspection validates the MAC-to-IP address bindings in Address
Resolution Protocol (ARP) packets. It protects against ARP traffic with
invalid address bindings, which forms the basis for certain “man-in-the-
middle” attacks. This is accomplished by intercepting all ARP requests and
responses and verifying each of these packets before the local ARP cache is
updated or the packet is forwarded to the appropriate destination,
dropping any invalid ARP packets.
ARP Inspection determines the validity of an ARP packet based on valid IP-
to-MAC address bindings stored in a trusted database – the DHCP snooping
binding database. ARP Inspection can also validate ARP packets against
user-configured ARP access control lists (ACLs) for hosts with statically
configured IP addresses.