Configuring Arp Defense Against Ip Packet Attacks; Introduction - H3C S5500-SI Series Operation Manual

User and
gateway
spoofing
prevention

Configuring ARP Defense Against IP Packet Attacks

Introduction

If a device receives large numbers of IP packets from a host to unreachable destinations,
The device sends large numbers of ARP requests to the destination subnets, which increases the
load of the destination subnets.
The device keeps trying to resolve destination IP addresses, which increases the load of the CPU.
To protect the device from IP packet attacks, you can enable the ARP source suppression function or
ARP black hole routing function.
If the packets have the same source address, you can enable the ARP source suppression function.
With the function enabled, whenever the number of ARP requests triggered by the packets with
unresolvable destination IP addresses from a host within five seconds exceeds a specified threshold,
the device suppresses the sending host from triggering any ARP requests within the following five
seconds.
If the packets have various source addresses, you can enable the ARP black hole routing function.
After receiving an IP packet whose destination IP address cannot be resolved by ARP, the device with
this function enabled immediately creates a black hole route and simply drops all packets matching the
route during the aging time of the black hole route.
Task
Configuring Source MAC Address Based
ARP Attack Detection
Configuring ARP Packet Source MAC
Address Consistency Check
Configuring ARP Active Acknowledgement
Configuring ARP Detection
Configuring ARP Automatic Scanning and
Fixed ARP
Configuring ARP Gateway Protection
Configuring ARP Filtering
Optional
Configure this function on gateways
(recommended).
Optional
Configure this function on gateways
(recommended).
Optional
Configure this function on gateways
(recommended).
Optional
Configure this function on access
devices (recommended).
Optional
Configure this function on gateways
(recommended).
Optional
Configure this function on access
devices (recommended).
Optional
Configure this function on access
devices (recommended).
1-2
Remarks