332
To do… Use the command…
Remarks
Enable ARP source suppression arp source-suppression enable
Required
Disabled by default.
Set the maximum number of packets with the
same source IP address but unresolvable
destination IP addresses that the device can
receive in five consecutive seconds
arp source-suppression limit
limit-value
Optional
10 by default.
Enabling ARP black hole routing
Follow these steps to configure ARP black hole routing:
To do… Use the command… Remarks
Enter system view system-view —
Enable ARP black hole routing arp resolving-route enable
Optional
Enabled by default.
Displaying and maintaining ARP defense against IP packet
attacks
To do… Use the command…
Remarks
Display the ARP source suppression
configuration information
display arp source-suppression [ |
{ begin | exclude | include }
regular-expression ]
Available in any view
ARP defense against IP packet attack configuration example
Network requirements
As shown in Figure 126, a LAN contains two areas: an R&D area in VLAN 10 and an office area in
VLAN 20. The two areas connect to the gateway (Device) through an access switch respectively.
A large number of ARP requests are detected in the office area and are considered as the consequence
of an IP flood attack. To prevent such attacks, configure ARP source suppression and ARP black hole
routing.
To Next Page
Loading...
Need help?
General