D-Link xStack DGS-3400 Series Reference Manual page 317

x Stack
Allow Zero IP
Forward DHCP PKT
Mode
Stop Learning
Threshold (0-500)
Recover Learning
®
DGS-3400 Series Layer 2 Gigabit Ethernet M anaged Sw itch
Loose state is that it uses less CPU resources because the Switch only checks incoming ARP
packets. However, it also means that Loose state cannot block users who send only unicast IP
packets. An example of this is that a malicious user can perform DoS attacks by statically
configuring the ARP table on their PC. In this case, the Switch cannot block such attacks
because the PC will not send out ARP packets.
Enabled (IPv6) - Enable the IPv6 packet checking. All packets are dropped by default until a
legal IP packet is detected.
Enabled (All) – Enable both IPv6 and IPv4 packet checking. All packets are dropped by default
until a legal IP packet is detected.
Enabled (Strict+IPv6) - Enable the IPv6 packet checking in strict mode. All packets are
dropped by default until a legal IP packet is detected.
Enabled (Strict+All) - Enable both IPv6 and IPv4 packet checking in strict mode. All packets
are dropped by default until a legal IP packet is detected.
Enabled (Loose+IPv6) - Enable IPv6 packet checking. All packets are dropped by default until
a legal IP packet is detected.
Enabled (Loose+All) - Enable both IPv6 and IPv4 packet checking. All packets are dropped by
default until a legal IP packet is detected.
Disabled - Disable the IPv4 packet checking.
Disabled (IPv6) - Disable the IPv6 packet checking.
Disabled (All) - Disable both IPv4 and IPv6 packet checking.
Use the pull-down menu to enable or disable this feature. Once enabled, the Switch will allow
ARP packets with a Source IP of 0.0.0.0 to pass through.
This is useful in some scenarios when a client (for example, a wireless Access Point,) sends
out an ARP request packet before accepting the IP address from a DHCP server. In this case,
the ARP request packet sent out from the client will contain a Source IP of 0.0.0.0. The Switch
will need to allow such packets to pass, or else the client cannot know if there is another
duplicate IP address in the network.
By default, the Switch will forward all DHCP packets. However, if the port state is set to Strict,
all DHCP packets will be dropped. In that case, select Enable so that the port will forward
DHCP packets even under Strict state. Enabling this feature also ensures that DHCP snooping
works properly.
Use the pull-down menu to select ARP or ACL mode.
ARP – When selecting this mode, the Switch will perform ARP Packet Inspection only and no
ACL rules will be used.
ACL – When selecting this mode, the Switch will perform IP Packet Inspection in addition to
ARP Packet Inspection. ACL rules will be used under this mode.
Whenever a MAC address is blocked by the Switch, it will be recorded in the Switch's L2
Forwarding Database (FDB) and associated with a particular port. To prevent the Switch FDB
from overloading in case of an ARP DoS attack, the administrator can configure the threshold
when a port should stop learning illegal MAC addresses.
Enter a Stop Learning threshold between 0 and 500. Entering 500 means the port will enter the
Stop Learning state after 500 illegal MAC entries and will not allow additional MAC entries,
both legal or illegal, to be learned on this port. In the Stop Learning state, the port will also
automatically purge all blocked MAC entries on this port. Traffic from legal MAC entries are still
forwarded.
Entering 0 means no limit has been set and the port will keep learning illegal MAC addresses.
This feature can only be applied when a port is already in Stop Learning state. Check Normal
304