Kontron CP6923, Справочное руководство, Страница: 130 / 480

Switching Commands CP6923
CP6923 CLI Reference Manual Page 2 - 86
2.16.19 show ip source binding
Use this command to display the IPSG bindings.
Example: The following shows example CLI display output for the command.
(switch) #show ip source binding
MAC Address IP Address Type Vlan Interface
----------------- --------------- ------------- ----- -------------
00:00:00:00:00:08 1.2.3.4 dhcp-snooping 2 0/1
00:00:00:00:00:09 1.2.3.4 dhcp-snooping 3 0/1
00:00:00:00:00:0A 1.2.3.4 dhcp-snooping 4 0/1
2.17 Dynamic ARP Inspection Commands
Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. DAI prevents a
class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for other stations by poisoning the
ARP caches of its unsuspecting neighbors. The miscreant sends ARP requests or responses mapping another
station’s IP address to its own MAC address.
DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges and builds a binding database
of valid {MAC address, IP address, VLAN, and interface} tuples.
When DAI is enabled, the switch drops ARP packets whose sender MAC address and sender IP address do not
match an entry in the DHCP snooping bindings database. You can optionally configure additional ARP packet
validation.
2.17.1 ip arp inspection vlan
Use this command to enable Dynamic ARP Inspection on a list of comma-separated VLAN ranges.
Format
show ip source binding [{static/dynamic}] [interface slot/port] [vlan id]
Mode • Privileged EXEC
• User EXEC
Term Definition
MAC Address The MAC address for the entry that is added.
IP Address The IP address of the entry that is added.
Type Entry type; statically configured from CLI or dynamically learned from DHCP Snooping.
VLAN VLAN for the entry.
Interface IP address of the interface in slot/port format.
Default
disabled
Format
ip arp inspection vlan vlan-list
Mode Global Config