Logging Of Dropped Packets; Default Dai Configuration - Cisco 7604 Configuration Manual

Chapter 38 Configuring Dynamic ARP Inspection
ARP ACLs take precedence over entries in the DHCP snooping binding database. The router uses ACLs
only if you configure them by using the ip arp inspection filter global configuration command. The
router first compares ARP packets to user-configured ARP ACLs. If the ARP ACL denies the ARP
packet, the router also denies the packet even if a valid binding exists in the database populated by DHCP
snooping.

Logging of Dropped Packets

When the router drops a packet, it places an entry in the log buffer and then generates system messages
on a rate-controlled basis. After the message is generated, the router clears the entry from the log buffer.
Each log entry contains flow information, such as the receiving VLAN, the port number, the source and
destination IP addresses, and the source and destination MAC addresses.
You use the ip arp inspection log-buffer global configuration command to configure the number of
entries in the buffer and the number of entries needed in the specified interval to generate system
messages. You specify the type of packets that are logged by using the ip arp inspection vlan logging
global configuration command. For configuration information, see the
section on page

Default DAI Configuration

Table 38-1
Table 38-1 Default DAI Configuration
Feature
DAI
Interface trust state
Rate limit of incoming ARP packets
ARP ACLs for non-DHCP environments
Validation checks
Log buffer
Per-VLAN logging
OL-4266-08
38-13.
shows the default DAI configuration.
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
"Configuring DAI Logging"
Default Setting
Disabled on all VLANs.
All interfaces are untrusted.
The rate is 15 pps on untrusted interfaces, assuming that
the network is a Layer 2-switched network with a host
connecting to as many as 15 new hosts per second.
The rate is unlimited on all trusted interfaces.
The burst interval is 1 second.
No ARP ACLs are defined.
No checks are performed.
When DAI is enabled, all denied or dropped ARP
packets are logged.
The number of entries in the log is 32.
The number of system messages is limited to 5 per
second.
The logging-rate interval is 1 second.
All denied or dropped ARP packets are logged.
Default DAI Configuration
38-5