Chapter 9
| General Security Measures
ARP Inspection
– 365 –
Eth 1/3 DISABLED 5
Eth 1/4 DISABLED 5
Eth 1/5 SIP 1
Eth 1/6 DISABLED 5
.
.
.
show ipv6
source-guard binding
This command shows the IPv6 source guard binding table.
Syntax
show ipv6 source-guard binding [dynamic | static]
dynamic - Shows dynamic entries configured with ND Snooping or
DHCPv6 Snooping commands (see page 343)
static - Shows static entries configured with the ipv6 source-guard binding
command.
Command Mode
Privileged Exec
Example
Console#show ipv6 source-guard binding
MAC Address IPv6 Address VLAN Interface Type
-------------- --------------------------------------- ---- --------- ----
00AB-11CD-2345 2001::1 1 Eth 1/5 STA
Console#
ARP Inspection
ARP Inspection validates the MAC-to-IP address bindings in Address Resolution
Protocol (ARP) packets. It protects against ARP traffic with invalid address bindings,
which forms the basis for certain “man-in-the-middle” attacks. This is accomplished
by intercepting all ARP requests and responses and verifying each of these packets
before the local ARP cache is updated or the packet is forwarded to the appropriate
destination, dropping any invalid ARP packets.
ARP Inspection determines the validity of an ARP packet based on valid IP-to-MAC
address bindings stored in a trusted database – the DHCP snooping binding
database. ARP Inspection can also validate ARP packets against user-configured
ARP access control lists (ACLs) for hosts with statically configured IP addresses.
To Next Page
Loading...
