Safeguard Engine Settings - D-Link DGS-3700-12 User Manual

DGS-3700-12/DGS-3700-12G Series Layer 2 Gigabit Ethernet User Manual
Figure 8- 59 Trusted Host window
To delete an entry click the corresponding Delete button.

Safeguard Engine Settings

Periodically, malicious hosts on the network will attack the Switch by utilizing packet flooding (ARP Storm) or other
methods. These attacks may increase the Safeguard Engine beyond its capability. To alleviate this problem, the
Safeguard Engine function was added to the Switch's software.
The Safeguard Engine can help the overall operability of the Switch by minimizing the workload of the Switch while the
attack is ongoing, thus making it capable to forward essential packets over its network in a limited bandwidth. When
the Switch either (a) receives too many packets to process or (b) exerts too much memory, it will enter an Exhausted
mode. When in this mode, the Switch only receives a small amount of ARP or IP broadcast packets for a calculated
time interval. Every five seconds, the Switch will check to see if there are too many packets flooding the Switch. If the
threshold has been crossed, the Switch will do a rate limit and only allow a small amount of ARP and IP broadcast
packets for five seconds. After another five-second checking interval arrives, the Switch will again check the ingress
flow of packets. If the flooding has stopped, the Switch will again begin accepting all packets. Yet, if the checking
shows that there continues to be too many packets flooding the Switch, it will still only accept a small amount of ARP
and IP broadcast packets for double the time of the previous stop period. This doubling of time for stopping ingress
ARP and IP broadcast packets will continue until the maximum time has been reached, which is 320 seconds and
every stop from this point until a return to normal ingress flow would be 320 seconds. For a better understanding,
examine the following example of the Safeguard Engine.
247