374
Step Command
Remarks
2.
Enable source MAC address
based ARP attack detection
and specify the detection
mode.
arp anti-attack source-mac
{
filter
|
monitor
}
Disabled by default.
3.
Configure the threshold.
arp anti-attack source-mac threshold
threshold-value
Optional.
50 by default.
4.
Configure the age timer for
ARP attack detection entries.
arp anti-attack source-mac aging-time
time
Optional.
300 seconds by default.
5.
Configure protected MAC
addresses.
arp anti-attack source-mac exclude-mac
mac-address
&<1-10>
Optional.
Not configured by
default.
NOTE:
After an ARP attack detection entry expires, ARP packets sourced from the MAC address in the entry can
be processed normally.
Displaying and maintaining source MAC address based ARP
attack detection
Task Command
Remarks
Display attacking MAC addresses
detected by source MAC address based
ARP attack detection.
display arp anti-attack source-mac
{
slot
slot-number
|
interface
interface-type
interface-number
} [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Configuration example
Network requirements
As shown in
, the hosts access the Internet through a gateway (Device). If malicious users send
a large number of ARP requests to the gateway, the gateway may crash and cannot process requests
from the clients. To solve this problem, configure source MAC address based ARP attack detection on the
gateway.
